Privacy policy

Nextia AI, which operates DrivingOps ("DrivingOps", "we", "us"), provides management software for driving schools. This policy explains how we handle personal information on our marketing site, in our business communications, and in the DrivingOps platform.

We design our privacy program for applicable Canadian privacy law, including Quebec's private-sector privacy law as modernized by Law 25, PIPEDA where it applies, and substantially similar provincial laws.

1. Our role and the school's role

For business contacts, demo requests, administrator accounts, subscription billing, and operation of our website, DrivingOps generally determines why and how the information is processed.

For learner, parent, instructor, and staff records entered by a school, the school is normally the organization responsible for the information and DrivingOps acts as its service provider or processor under documented instructions. Individuals should normally direct requests to their school first; we assist the school in responding. See our data-processing summary.

2. Information we may collect

• Enquiries and contact details: name, email, school, role, province, optional phone number, language, and message content.
• Account and identity: name, email, identifier, role, school membership, language, account status, and authentication logs.
• School operations: profile, branches, staff, instructors, vehicles, availability, programs, services, schedules, rules, and reports.
• Learner records: identity, contact details, date of birth, language, enrolment, progress, attendance, notes, pickup addresses, permits, consent, and parent or guardian information where needed.
• Potentially sensitive information: identity documents, permits, strictly necessary accessibility or health notes, disciplinary information, and supporting documents.
• Billing and payments: invoices, taxes, balances, receipts, refunds, and payment status. Full payment-card numbers are handled by the payment provider and are not stored by DrivingOps.
• Communications: content, recipient, channel, language, template, delivery status, response, and consent or opt-out records.
• Support and security: support requests, attachments, IP address, device/browser data, audit events, diagnostics, and technical logs.

We collect this information from you, your school, authorized people, and integrations the school chooses to enable.

3. Why we use information

• respond to an enquiry, arrange a demo, or manage a business relationship;
• create and secure accounts, apply roles, and isolate tenants;
• provide setup, enrolment, scheduling, attendance, documents, billing, communications, portals, and reporting;
• provide support, diagnose problems, prevent fraud, and protect the service;
• meet tax, accounting, regulatory, contractual, and legal obligations;
• improve the product using aggregated or de-identified measurements where appropriate and permitted.

We do not sell personal information. We do not use learner records for behavioural advertising, and we do not use them to train third-party general-purpose models.

4. Consent and communications

We seek consent where required and provide relevant information at collection. A demo request authorizes us to respond to that request; it does not automatically subscribe the requester to promotional messages. Optional commercial communications rely on separate consent or another permission available under CASL and include an unsubscribe mechanism where required.

Schools are responsible for obtaining and documenting consent and authority needed for their learners, parents, instructors, and other recipients, especially for sensitive information and messaging channels.

5. Minors

DrivingOps is not intended to let a minor independently create a school account. Schools may process records about minor learners and must obtain parent or guardian authority where required by law, the program, or the sensitivity of the information. We restrict access by role and assist schools with requests involving those records.

6. AI, profiling, and automated decisions

Optional features may produce drafts, recommendations, priorities, or schedule proposals. They are intended to assist people, not replace their judgment. Schools must keep meaningful human review for important decisions. If DrivingOps implements a solely automated decision that has a significant effect, the notices and rights required by applicable law must be provided.

7. Disclosures and sub-processors

We disclose information only to providers needed for hosting, identity, support, payments, email, messaging, geocoding, or an enabled AI feature. They are subject to contractual confidentiality and data-protection duties. See our sub-processor list.

We may also disclose information where required by law, to protect rights or safety, in a properly controlled corporate transaction, or with consent.

8. Hosting and transfers

Core application workloads are designed for Canadian Microsoft Azure regions. The marketing website uses Cloudflare's global infrastructure. Some optional integrations, global services, and AI features may process limited data outside Quebec or Canada. Before a transfer covered by law, we assess privacy factors and put appropriate contractual safeguards in place.

9. Retention and deletion

We retain information for the purposes described, the customer relationship, and legal obligations. Schools configure or determine many retention periods for their records. At the end of service, data is exported, deleted, or anonymized in accordance with the agreement, documented schedules, backup cycles, and legal requirements. Backups are removed through their normal lifecycle rather than individually edited.

10. Your rights

Depending on applicable law, you may request:

• access to your information and an account of how it is handled;
• correction of inaccurate, incomplete, or ambiguous information;
• withdrawal of consent, subject to explained consequences;
• cessation of dissemination, de-indexing, deletion, or restriction where the law provides;
• portability of eligible computerized information in a structured, commonly used format;
• information about an applicable automated decision;
• review of a complaint by our privacy lead or a privacy regulator.

We may need to verify identity. For information managed by a school, contact that school first. For information controlled by DrivingOps, contact the Privacy Officer at hello@drivingops.ca.

11. Security and incidents

We apply safeguards proportionate to sensitivity, including encryption, role-based permissions, tenant isolation, secrets management, logging, and backups. No system can guarantee absolute security. See our Security overview.

We maintain an incident-response process. We document incidents and notify customer organizations, individuals, and regulators where law or contract requires, including when there is a real risk of significant harm or serious injury.

12. Cookies and website data

See our Cookie policy. The marketing-site code currently enables no advertising cookies and no non-essential analytics.

13. Privacy Officer and complaints

Our accountable privacy contact is the Privacy Officer, Nextia AI. Email hello@drivingops.ca. We will investigate and respond within the timeframe required by applicable law.

14. Changes

We will update the date above when this policy changes. Material changes will be brought to customers' attention by an appropriate method. Where law requires new consent, we will request it instead of treating continued use alone as consent.