Privacy Policy

1. What we collect

When you create an account we collect your name, email address, phone number (optional), licence stage and a password (stored only as a secure hash). When you book lessons we collect pickup addresses, booking history, payments and any ratings or comments you leave.

If you are a parent or guardian booking for a learner aged 14 to 17, we also collect that learner's name, date of birth, licence stage and their relationship to you. We collect this only from the adult who holds the account, never from the young person directly, and we use it solely to schedule their lessons and to confirm they meet Alberta's age requirements for a Class 7 or Class 5 GDL licence. Deleting your account deletes their record outright.

If you send us a message through the contact form, we keep your name, email address and the message itself so we can reply.

2. Why we collect it

We collect personal information for identified purposes only: to schedule and deliver driving lessons, process payments, track your skill progress toward your road test, and contact you about your bookings. We rely on your consent, given when you create an account, as required by the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

3. What we never do

We do not sell, rent or trade your personal information. We do not use it for advertising. Instructors see only what they need to teach you: your name, pickup address, licence stage and skill progress.

4. Storage and security

Your data is stored on servers located in Canada. Passwords are hashed with bcrypt, sessions are protected with signed, HTTP-only cookies, and access is restricted by role. We keep personal information only as long as needed for the purposes above, or as required by law (for example, CRA record-keeping requirements for payment records).

In the mobile app, your sign-in token is held in the device's own secure store — the iOS Keychain or the Android Keystore — and is available only while the device is unlocked. It is never written to ordinary app storage, and signing out or deleting your account removes it from the device.

5. Payments

Card payments for prepaid lesson packages are processed by Stripe. Your card details are entered on Stripe's own secure page and are never seen, handled or stored by us or by the mobile app — we receive only a confirmation that the payment succeeded, and we record the amount and the date. Stripe's handling of your payment information is governed by their privacy policy at stripe.com/en-ca/privacy.

6. Cookies

We use a single, strictly necessary session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

7. Your rights

You may request access to the personal information we hold about you, ask us to correct it, or withdraw consent and ask us to delete your account (subject to legal retention requirements). We respond to requests within 30 days.

8. Deleting your account

You can delete your account yourself at any time. In the mobile app, open Account and choose "Delete account". On the website, go to your account settings and choose "Delete account". You will be asked to type your email address to confirm, because the deletion cannot be undone.

Deleting your account immediately removes your name, email address, phone number, saved pickup and drop-off addresses, lesson notes, any messages you sent us through the contact form, and the records of any learners you have linked to your account. Any lesson still in the future is cancelled. You will no longer be able to sign in.

We keep a record of payments made, with your personal details removed from it, because Canadian tax law requires a business to retain its financial records for six years. That record cannot be traced back to you.

If you would rather we did it for you, email hello@ummahdrivers.ca with the subject line "Delete my account" and we will action it within 30 days.

9. Contact our privacy officer

For privacy questions or requests, email hello@ummahdrivers.ca with the subject line "Privacy". If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.