Comprehensive Privacy Policy

Last updated: June 22, 2026

Drive Tutor Inc. ("Drive Tutor", "we", "us", or "our") operates the Drive Tutor website, mobile applications, instructor portal, and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through the Platform.

Drive Tutor is a technology platform. Driving instructors using the Platform are independent businesses or independent service providers. Drive Tutor does not provide driving instruction, operate instructor vehicles, employ instructors, or collect lesson fees on behalf of instructors.

1. Scope

This Policy applies to learners, guardians, instructors, website visitors, applicants, and other people who use or communicate with the Platform.

The Platform is not offered to children under 16. Learners who are 16 or 17 must use a guardian-managed account. The guardian controls the account and receives account communications. Learners who are 18 or older may manage their own account.

Third-party websites and services linked from the Platform have their own privacy practices. This Policy does not govern information a person provides directly to an independent instructor outside the Platform.

2. Information We Collect

The information collected depends on the person's role, the features used, and whether verification is required.

Account and contact information

We may collect names, email addresses, telephone numbers, passwords or authentication records, age, gender, city, mailing or pickup address, account role, guardian and learner relationship information, profile photographs, communication preferences, and support communications.

Learner and guardian information

We may collect learner Ontario G1, G2, or G licence numbers and expiry dates, identity selfies, learning focus, transmission preference, availability, requested pickup information, lesson requests, instructor relationships, progress, lesson history, notes, ratings, feedback, reports, and safety information.

For a guardian-managed account, we may collect the guardian's government identification and identity selfie and information needed to manage the learner's account. The learner does not operate a separate account.

Instructor and vehicle information

We may collect instructor application details, instructor licence and expiry information, 6D insurance documents, municipal licences, criminal background-check documentation, professional credentials, service areas, languages, biography, rates, experience, availability-related scheduling information, vehicle details and photographs, document versions, verification decisions, and subscription status.

Lesson and Platform activity

We may collect requests, acceptances, cancellations, rescheduling activity, lesson times and locations, attendance, no-show and punctuality information, lesson focus, notes, progress, ratings, feedback, reports, referral relationships, notification history, and account activity.

Subscription and transaction information

Stripe processes instructor subscription payments. We may receive and retain Stripe customer, subscription, invoice, payment-status, refund, and transaction-reference information. Drive Tutor does not receive or store complete payment-card numbers or card security codes.

Phone verification and communications

Drive Tutor uses Twilio Verify to send one-time passcodes for phone-number verification, account security, and fraud prevention. When a verification code is requested, we provide the telephone number and verification-related technical information to Twilio. These messages are transactional, not marketing messages. Message and data rates may apply.

We use Resend for transactional email and Firebase Cloud Messaging for push notifications. Communications may include account, verification, safety, request, referral, lesson, cancellation, rescheduling, reminder, subscription, and support information.

Device, log, and security information

We and our service providers may collect IP address, browser type, device type, operating system, app version, unique device or installation identifiers, push-notification token, session identifiers, access times, pages or screens used, error information, and technical, authentication, security, and fraud-prevention logs.

Drive Tutor does not currently collect precise GPS location through the app. Users may provide a city, service area, mailing address, or lesson pickup address manually.

Sensitive information

Depending on the account type, we may collect sensitive information including Ontario G1, G2, or G licence information, guardian government-issued identification, identity-verification selfies, criminal background-check records, insurance records, professional credentials, guardian-managed account information, and safety or user reports. We seek express consent where required and restrict access to people and providers who need the information for an authorized purpose.

We do not use identity selfies to create facial-recognition templates or perform automated biometric identification.

3. Public and Private Information

Some instructor profile information is intended to help learners evaluate instructors and may be displayed publicly or to signed-in Platform users. This may include the instructor's name, profile photograph, biography, verified status, service areas, languages, vehicle details, rates, experience, offerings, and aggregated lesson or profile information.

Limited learner or guardian-managed learner information may be shown to instructors where necessary to review a request, manage an accepted learner relationship, schedule a lesson, or address a safety issue. Precise pickup information is not intended for general public display.

Identity documents, verification selfies, criminal background checks, insurance documents, private reports, internal review notes, lesson notes, and support communications are not public. Ratings or review text may be displayed where the Platform identifies them as publishable content. A person should not include unnecessary personal or sensitive information in a review.

4. How We Collect Information

We may collect information:

• directly from a user, guardian, instructor, applicant, or authorized representative;
• through account registration, applications, questionnaires, document uploads, referrals, lesson activity, reports, feedback, and support requests;
• automatically from devices, browsers, apps, security systems, and service providers;
• from another Platform user where needed for a request, referral, accepted relationship, offline learner scheduling record, report, or safety matter; and
• from service providers such as Stripe, Twilio, Supabase, Firebase, Resend, Vercel, Apple, and Google.

An instructor who creates a private external learner scheduling record may enter only the limited fields permitted by the Platform and is responsible for confirming that the learner or guardian authorized the instructor to provide the information to Drive Tutor. External learners do not receive app access or accept Drive Tutor's app terms directly through the current workflow. External learner records are not public and are visible only to the instructor and authorized Drive Tutor personnel.

5. Why We Use Information

We may use personal information to:

• create, authenticate, secure, and administer accounts;
• verify telephone numbers, identity, eligibility, licences, insurance, credentials, and documents;
• review and approve learner, guardian, and instructor accounts;
• provide profiles, search, referrals, requests, scheduling, lessons, notes, progress, feedback, and reporting features;
• connect a referral learner directly with the referring instructor;
• provide reminders and transactional email, SMS, in-app, and push notifications;
• process and administer instructor subscriptions, invoices, cancellations, and refunds through Stripe;
• provide support and respond to privacy, safety, legal, and account requests;
• investigate fraud, impersonation, misuse, accidents, no-shows, reports, and safety concerns;
• maintain document histories, verification decisions, lesson records, and audit trails;
• enforce our agreements and protect users, Drive Tutor, and the public;
• comply with tax, accounting, regulatory, court, law-enforcement, insurance, and other legal obligations; and
• diagnose errors, maintain security, measure service reliability, and improve the Platform.

Drive Tutor does not sell personal information, use it for targeted advertising, or send marketing SMS messages as part of the current Platform. If those practices change, we will update this Policy and obtain consent where required.

6. Consent and Other Permitted Processing

We collect, use, and disclose personal information with meaningful consent or as otherwise permitted or required by law. We identify important purposes at or before collection and seek express consent for sensitive verification information where appropriate.

A person may withdraw consent by contacting us, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already completed. It may prevent us from completing verification or providing features that require the information.

We may collect, use, preserve, or disclose information without consent where permitted or required by law, including for fraud prevention, debt or legal claims, emergencies, investigations, court orders, warrants, regulatory obligations, or safety matters.

7. How We Disclose Information

We may disclose information to:

• other Platform users as necessary for profiles, referrals, requests, accepted relationships, scheduling, lessons, and safety features;
• authorized employees, contractors, administrators, legal advisers, accountants, insurers, and auditors;
• service providers that operate the Platform or process information on our behalf;
• law-enforcement, courts, regulators, government institutions, emergency services, insurers, or investigative bodies where permitted or required by law;
• parties involved in an actual or proposed merger, financing, reorganization, sale, insolvency, or transfer of all or part of the business, subject to appropriate safeguards; and
• other parties with the person's direction or consent.

We do not disclose verification documents to learners or instructors merely because they are connected through the Platform.

8. Service Providers

Current providers may include:

• Supabase for authentication, database services, private file storage, server-side functions, and related infrastructure;
• Stripe for instructor subscription checkout, recurring charges, invoices, receipts, refunds, and subscription administration;
• Twilio Verify for transactional phone-number verification codes;
• Firebase Cloud Messaging for push notifications;
• Resend for transactional email;
• Vercel for website hosting and delivery;
• Apple and Google Play services for app distribution, device services, and platform delivery; and
• GetTerms for the website cookie-consent tool and policy delivery.

Each provider processes information under its own terms and privacy commitments. Provider configurations and subprocessors may change as the Platform evolves.

9. International Processing

Drive Tutor's primary Supabase project is hosted in Canada. Personal information may also be processed in the United States and other jurisdictions where Drive Tutor's providers or their subprocessors operate. Foreign authorities may be able to access information under the laws of those jurisdictions.

When using a provider outside Canada, we use contractual, technical, organizational, and access controls appropriate to the sensitivity of the information and the service being provided.

10. Retention

We retain information only as long as reasonably necessary for identified purposes, legal obligations, safety, fraud prevention, insurance matters, disputes, and enforcement. Normal periods include:

• active account and current profile information: while active, followed by deletion or anonymization after an approved deletion request, subject to exceptions;
• replaced profile photographs, identity selfies, and vehicle photographs: replaced as current images, with residual backups normally expiring within 90 days;
• learner identity and licence documents: up to 2 years after account closure or the last verification decision;
• guardian identity and consent records: until the later of 2 years after account closure or 2 years after the learner turns 18;
• instructor licences, insurance, background checks, municipal licences, and their versions: while active and for up to 7 years afterward;
• unsuccessful requests: up to 2 years after closure, expiry, or cancellation;
• lesson records, attendance, notes, and progress: 7 years after the lesson, or longer for records involving a minor as described in our retention schedule;
• safety reports, user reports, and investigations: 7 years after closure, or longer for records involving a minor;
• subscription and accounting records: 7 years after the relevant fiscal year;
• general support correspondence: 3 years after closure;
• notification delivery logs: 1 year;
• security, authentication, and fraud logs: up to 2 years;
• records of breaches of security safeguards: at least 2 years; and
• protected backups: normally rotated within 90 days.

Deletion may be suspended for a legal hold, accident, police or regulatory request, insurance matter, chargeback, tax matter, litigation, fraud investigation, or safety investigation. The detailed schedule is set out in Drive Tutor's Data Retention and Deletion Policy.

11. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These may include role-based access controls, private storage, row-level database policies, authentication controls, encrypted transmission, restricted administrative access, document-version records, logging, monitoring, and vendor security controls.

No electronic system is completely secure. Users must protect their passwords and verification codes and notify us if they suspect unauthorized access.

12. Privacy Breaches

Drive Tutor assesses suspected privacy breaches and, where required by PIPEDA, reports a breach posing a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notifies affected individuals. We maintain records of security-safeguard breaches for at least two years.

13. Access, Correction, Withdrawal, and Deletion

Subject to applicable law, a person may request:

• confirmation of whether we hold personal information about them;
• access to that information and information about its use and disclosure;
• correction of inaccurate or incomplete information;
• withdrawal of consent where processing depends on consent; or
• deletion of an account or information that is no longer required.

Requests should be sent to privacy@drivetutor.ca. We may verify the requester's identity before responding. We normally respond to access requests within 30 calendar days, subject to lawful extensions. Access will be provided at minimal or no cost; if a permitted cost is expected, we will disclose it before proceeding.

Some information cannot be immediately deleted because it must be retained for legal, tax, accounting, fraud-prevention, safety, insurance, dispute, record-integrity, or other permitted purposes. Where appropriate, we will explain the restriction.

If information is corrected and it is appropriate to do so, we may send the correction to relevant third parties. If a correction dispute cannot be resolved, we may record the unresolved challenge.

14. Communications and Choices

Account, verification, safety, subscription, lesson, and support communications are transactional and may be necessary to provide the Platform. Disabling push notifications does not prevent essential notices from being delivered by another available method.

Drive Tutor does not currently send marketing SMS messages or email newsletters. If optional marketing is introduced, we will provide the consent and unsubscribe mechanisms required by applicable law.

15. Cookies and Browser Storage

The website uses essential browser storage for authentication, security, checkout continuity, referral continuity, and session management. The GetTerms consent tool may also store a consent choice. Other cookies or similar technologies will be categorized and controlled through the cookie-consent tool where required.

Please review the Cookie Policy and the website's Manage Cookie Preferences control for current details.

16. Changes to This Policy

We may update this Policy when our services, providers, practices, or legal obligations change. We will post the revised date and provide additional notice or obtain renewed consent where required by law or where a change materially affects how personal information is handled.

17. Complaints and Escalation

Privacy complaints may be sent to the Privacy Officer. We target acknowledgment within 3 business days and a substantive response within 30 days. Complex, legal, or third-party-dependent matters may take longer, and we will provide status updates where appropriate.

If a concern is not resolved, a person may contact:

Office of the Privacy Commissioner of Canada

30 Victoria Street

Gatineau, Quebec K1A 1H3

Toll-free: 1-800-282-1376

https://www.priv.gc.ca/

18. Contact Us

Privacy Officer

Drive Tutor Inc.

120 Adelaide St. W, Suite 2500

Toronto, Ontario, Canada

Email: privacy@drivetutor.ca