Privacy policy

Last updated November 8, 2026

This policy explains what personal information Stoaroute collects, why, how we protect it, and the choices you have.

1. Who we are

Stoaroute makes software that delivery companies use to run their routes, drivers, schedules, inspections, people and payments. This policy covers this website and the Stoaroute app. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles.

We have a privacy officer who is responsible for how Stoaroute handles personal information. You can reach them as described in Contact us.

2. What we collect

On this website. When you ask for a demo we collect your name, work email, company and, if you choose to give them, your phone number, fleet size and a message. Our servers keep basic technical logs, such as the time of a request and the browser used, to keep the site secure.

In the app. To run a delivery operation, the app holds:

Account details: name, work email, role and phone number.
Work records: schedules, hours worked, clock-in and clock-out times, time-off requests, pay rates and pay summaries.
Route records: stops, arrival times, delivery notes and route issues.
Vehicle records: inspections, photos, signatures, maintenance and fuel.
Expenses and receipts.
Messages and announcements sent inside the app.
Location, as explained in the next section.

We don’t ask for government ID numbers, bank account numbers or health information in the app.

3. Location

A driver’s phone shares its location with Stoaroute only while the driver has an active route open in the app, so the office can see arrival times and where each route is. The app also records the location at the moment someone clocks in or out, and when an inspection is done. It does not track anyone when the app is closed or when they are off shift.

The phone always asks the driver for permission first, and the driver can turn it off in their phone settings. Some features, like live arrival times, won’t work without it.

Employers decide whether to use these features and are responsible for telling their employees about them. In Ontario, employers with 25 or more employees must have a written electronic monitoring policy under the Employment Standards Act, 2000.

4. Data our customers enter

When a company uses Stoaroute, that company decides what information about its team, vehicles and clients goes into the app and who in the company can see it. The company is responsible for that information, and Stoaroute handles it on the company’s behalf, only to provide the service and as the company instructs.

If you work for a company that uses Stoaroute and have a question about your information, ask your employer first. We will help them answer you.

5. How we use it

To provide the app: show routes, schedules and arrival times, send alerts to the right phones, and keep the records the company needs.
To answer demo requests and talk with companies interested in Stoaroute.
To keep the service secure, fix problems and improve it.
To meet legal obligations.

We do not sell personal information, and we do not use it for advertising. We don’t use one company’s data to serve another company.

We use a small number of service providers to run Stoaroute. They only receive what they need to do their job, and they must protect it.

Replit hosts the app, the website and the database (United States).
Google Maps Platform shows maps and calculates directions, travel times and addresses. Addresses and positions are sent to Google for that. Google’s use is covered by the Google Privacy Policy.
Browser push services from Apple, Google and Mozilla deliver notifications to phones that turned them on. They receive the text of the notification only.

When we add or change a service provider that handles customer data, we update this list. We may also disclose information if the law requires it, for example under a court order.

7. Where it is stored

Stoaroute’s data is stored with our hosting provider in the United States. Information stored outside Canada is protected by our agreements with our providers, but it may be accessible to courts and authorities there under local law.

8. How we protect it

Every connection to Stoaroute is encrypted (HTTPS).
Passwords are stored as one-way hashes (bcrypt), never in plain text. We can’t see them.
Each company’s data is kept separate, and every request is checked against the company and role of the person signed in.
Each role only sees the modules its company allows. A driver never sees payroll.
Repeated failed sign-ins are slowed down to block password guessing.
Only the people who run Stoaroute can reach the systems, and only to support the service.

No system is perfectly secure, but we review and improve these safeguards as Stoaroute grows.

9. If something goes wrong

If we learn of a breach that affects a customer’s data, we will tell that customer without undue delay, explain what happened, and help them respond. Where a breach creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as PIPEDA requires, and keep a record of it.

10. How long we keep it

We keep demo requests while we are in conversation with your company, and up to two years after.

App data is kept while the company’s account is active. When a company leaves Stoaroute, it can ask for a copy of its data within 30 days. After that we delete it within 90 days, unless the law requires us to keep it. Deleted data may remain in backups for a short time until they are replaced.

11. Your rights

You can ask to see the personal information we hold about you, ask us to correct it, or withdraw your consent where the law allows. We answer within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

12. Children

Stoaroute is a tool for businesses and is not meant for anyone under 16. We don’t knowingly collect information from children.

13. Cookies and browser storage

This website does not use advertising or tracking cookies. It only uses what it needs to work, like remembering your cookie choice. Fonts are served from our own servers, so no third party sees your visit. The app uses your browser’s storage to keep you signed in and to remember settings such as day or night mode.

You can change your choice at any time in cookie preferences. If we ever add analytics, it will stay off unless you turn it on.

14. Changes to this policy

If we change this policy, we update the date at the top of this page. For important changes, we tell our customers at least 30 days before they take effect.

15. Contact us

Questions about privacy, or a request about your information? Email our privacy officer at info@stoaroute.com or use the contact form on our website and choose “Privacy” in your message. We reply within 30 days.