Privacy Policy
In short. ROTOYA is for planning routes and proving deliveries. We collect only what that takes, we sell nothing, show no ads and use no advertising trackers. The app's data is hosted in Canada (Montréal).
Questions or requests: support@rotoya.com.
1. Who we are, and who is responsible
ROTOYA is operated by Bedros Nazarian and Azad Kallashian, doing business as ROTOYA, 553 70e Avenue, Laval, Quebec H7V 2R1 ("ROTOYA", "we"). This policy covers the website rotoya.com, the app at app.rotoya.com, and the tracking pages sent to customers.
Person in charge of the protection of personal information: Bedros Nazarian, Co-owner — support@rotoya.com, 553 70e Avenue, Laval, Quebec H7V 2R1.
2. Our role: your data and your customers' data
- ROTOYA users (businesses, dispatchers, drivers, self-employed workers): we are responsible for their account information.
- Our users' customers (the people and businesses delivered to or served): the business using ROTOYA decides what it enters and why. We process it on that business's behalf, as a service provider, under our Terms of Service, and for no other purpose. If you are a customer of a business that uses ROTOYA, please contact that business first; we will help it answer you.
3. What we collect
| Whose | Information | Source |
|---|---|---|
| Account holder and team members | Name, email, password (stored only in irreversibly encrypted form), company name, headquarters address, role, language, status (active, break, off), time of last activity in the app, day start and lunch break, reminder preferences | You, at sign-up and in Settings; the app, while in use |
| Customers delivered to or served | Name, address, phone, notes, appointment date and time, invoice or purchase order number, signer's name, handwritten on-screen signature, proof photos, arrival and completion times, estimated arrival time | The business using ROTOYA (typed, a pasted message, a photo of a document, an Excel file) |
| Phones that receive reminders | The browser's technical notification subscription address | Your browser, when you turn reminders on |
| Any visitor | Technical data: IP address, browser type, pages requested, in server logs; app error reports (error message, page without its parameters, version, browser) | Automatically, like any website |
| Paying subscribers | Billing details; card numbers are entered with our payment processor and never reach us | You, when subscribing |
We do not collect your GPS location. ROTOYA does not track phones: arrival times are calculated from the planned route and the stops the driver marks. The "Navigate" button opens your maps app, which follows its own rules.
4. Why we use it
- To create and secure your account, and link drivers to their business.
- To plan routes: find addresses on the map and work out stop order, distances and arrival times.
- To record proof of delivery (signature, photos, invoice) and produce the reports the user asks for.
- To send the appointment reminders the user turns on, and necessary emails (password reset, billing).
- To show a customer a tracking page, only when the business sends them the link.
- For support, security, preventing abuse and meeting our legal obligations.
We do not use information for advertising, and we do not sell or rent it. We make no decision about you based exclusively on automated processing.
Consent. By creating an account you consent to these uses. A business using ROTOYA is responsible for having the right to enter its customers' information. You can withdraw consent by closing your account (section 10); some features then stop being available.
5. Service providers and transfers outside Québec
We rely on providers bound by contract. Each receives only what its task needs. Some are outside Québec; before sharing information with them, we assess through a privacy impact assessment that it will be adequately protected, including through their contractual security and confidentiality commitments.
| Provider | Role | Information | Location |
|---|---|---|---|
| Supabase | Database, accounts, proof files | All app data | Canada (Montréal) |
| Google (Maps Platform) | Addresses on the map, address suggestions, routes | Stop addresses and coordinates; text typed into an address field. Never names, phone numbers, signatures or photos | United States and elsewhere |
| Anthropic | Artificial intelligence (section 6) | What you submit to it: a photo of a document, a pasted message, an Excel file, addresses to put in order | United States |
| Hostinger | App hosting; email (support@rotoya.com and account emails) | Technical logs; emails exchanged | Per its data centres |
| Netlify | Hosting of the rotoya.com website | Technical logs | United States and elsewhere |
| Notification services (Google, Apple, Mozilla) | Delivering reminders to phones | End-to-end encrypted notifications: these services cannot read their content | Depends on the browser |
| Stripe | Payments (paid plans) | Name, email, payment details | Canada, United States and elsewhere |
If we add a provider, for example to send text messages, we will update this table before using it. We may also disclose information where the law requires it.
6. Artificial intelligence
When you use photo scan, smart paste, Excel import or certain suggestions, the content you submit is sent to Anthropic to be read and turned into stops. Under its commercial terms, Anthropic does not use this content to train its models. The result is always shown to you for review before it is saved: check it, because AI can make mistakes. Do not submit information the route does not need.
7. Cookies and local storage
We use no advertising cookies and no audience-analytics tools. The app keeps what it needs to work in your browser's local storage: your sign-in session, language, theme and a few display preferences. Clearing it signs you out and restores the default preferences.
8. Retention and destruction
- Account and routes: while the account is open. A business can delete a stop or erase its data at any time.
- Closed account: data is destroyed within 30 days of the request; backup copies are overwritten on their normal cycle. Billing records are kept as long as tax law requires.
- Error reports: deleted after 90 days.
- Tracking links: stop working three days after the delivery date.
- Reminder subscriptions: removed when you turn reminders off or the browser cancels them.
9. Security and incidents
Encrypted connections (HTTPS), passwords never stored in readable form, access to data limited by rules enforced inside the database itself (a driver sees only their stops; a business never sees another's), proof files in private storage whose access follows the stops', and secret keys never exposed to the browser. If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people concerned, and we keep a register of incidents.
10. Your rights
You may ask to access your information, correct it, receive it in a structured, commonly used technological format, have its dissemination stopped or have it de-indexed where the law allows, and withdraw consent. Write to support@rotoya.com; we answer within 30 days and may ask you to confirm your identity. You may also file a complaint with the Commission d'accès à l'information du Québec.
11. Minors
ROTOYA is a work tool for people 18 and over. We do not knowingly collect information about minors under 14.
12. Changes
We will post any change on this page with its date. For an important change, we will notify you in the app or by email before it takes effect.