Privacy Policy

1. Who is responsible for your information

treadflow plays two different roles, and it matters which one applies to you.

• Our customers (tire shops, dealerships and storage operators). When a business signs up, we are responsible for the account information we collect about its team and for how we run the website and service.
• The customers of those businesses. A business using treadflow enters its own customers, vehicles, tire sets, addresses and requests into the platform. For that information the business decides what is collected and why, and treadflow processes it on the business's behalf. If you are a tire shop's customer and want to see, correct or delete your information, contact that shop first. We will help the shop respond.

2. Information we collect

Account and team information

When an organization is created or a person is invited, we collect organization name, first and last name, username, email address, phone number, and a password (stored only as a one-way hash) or, if you choose Google sign-in, the identity details Google shares with us. We also record each person's role (for example admin, staff, driver or customer) and what they have permission to do.

Information a business stores about its customers

Businesses may record, and customers may add or edit through the customer portal:

• customer or business name, email, billing email, phone and addresses;
• vehicle details such as plate number, make and model, VIN, colour and notes;
• tire sets, tag numbers, seasons, warehouse locations, and movement history;
• pickup and drop-off requests, scheduled dates and time windows, route stops and status history;
• photos taken by drivers (pickup, delivery and damage documentation) and customer signatures captured at handoff;
• free-text notes.

Activity and technical information

We keep an activity log of important actions (who did what, and when) so businesses can audit their own operations. Our servers and security tools also log technical data such as IP address, browser and device type, pages requested and error details.

Payments

Paid plans are processed by Stripe. Card details go directly to Stripe and are not stored by treadflow. We keep the plan, subscription status and Stripe identifiers needed to manage the subscription.

Location

treadflow does not track a driver's or customer's live GPS location. Addresses are entered by people using the service, and we send them to mapping services to suggest addresses and calculate routes (see “Who else handles your information”).

3. How we use information

• to provide the service: inventory tracking, dispatch, driver tasks, the customer portal and notifications;
• to sign you in, keep accounts secure, and enforce roles and permissions;
• to send service emails such as invitations, email verification and password resets;
• to manage plans, usage limits and billing;
• to monitor performance, fix errors and prevent abuse;
• to understand how the website and product are used so we can improve them;
• to meet legal obligations and respond to lawful requests.

We do not sell personal information, and we do not use customer data to show advertising.

4. Who else handles your information

We use the following service providers to run treadflow. They may process information only to provide their service to us.

Some of these providers operate outside Canada, so information may be stored or processed in other countries, including the United States, where it may be accessible to courts and authorities under local law. We may also disclose information if required by law, or as part of a merger or sale of the business, in which case we will make sure the new owner honours this policy.

Within a business, information is visible according to roles: admins and staff see their organization's records, drivers see the tasks assigned to them, and customers see their own records. Access by treadflow staff is limited to a read-only support console with personal details masked by default, two-factor authentication, and logging of every sensitive view or support action (for example resending an invitation).

5. Cookies and similar technologies

• Sign-in cookie (essential). A secure, HTTP-only auth_token cookie keeps you signed in. It expires with your session and is cleared when you sign out.
• Preferences. Your browser may store small settings such as display theme.
• Analytics and monitoring. PostHog and Sentry may use cookies or local storage to recognize a browser across visits and to group errors and sessions. You can block these in your browser settings; essential sign-in will still work.

We do not use advertising cookies.

6. How long we keep information

We keep account information while your organization's account is active. A business controls how long it keeps its customer and tire records. When an account is closed or deletion is requested, we delete or de-identify information within a reasonable time, except where we must keep it for legal, tax, fraud-prevention or dispute reasons. Backups are overwritten on a rolling schedule. Delivery photos and signatures are kept with the delivered request as proof of handoff, and users cannot delete them once a request is delivered.

7. Security

We protect information with encrypted connections, hashed passwords, role-based access controls, per-business scoping of data, two-factor authentication on our own staff console, and audit logging. No system is perfectly secure. If we learn of a breach that creates a real risk of significant harm, we will notify affected organizations and, where required, the privacy regulator.

8. Your choices and rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and similar laws, you can ask to access the personal information we hold about you, ask us to correct it, withdraw consent where consent is the basis for processing, and ask us to delete it. Signed-in users can update their profile from My Account. For anything else, or to make a request about information a business holds about you, email privacy@treadflow.ca. We will respond within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada.

9. Children

treadflow is built for businesses and is not directed to children under 13. We do not knowingly collect their information.

10. Changes to this policy

We will post any changes here and update the effective date. If a change is significant, we will also notify account administrators by email.

11. Contact

Questions about privacy: privacy@treadflow.ca. See also our Terms of Service.