Privacy policy

StarOne is a technology platform that connects customers with nearby delivery drivers. This policy explains what personal information we collect, why, how long we keep it, and the choices you have. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

Who we are

StarOne operates gostarone.com and the StarOne customer and driver mobile applications. Our privacy contact is listed at the end of this policy. StarOne is the organisation accountable for the personal information described here.

What we collect, and why

Everyone with an account

• Name and email address — to create your account, sign you in, and contact you about a delivery. Your email address is also the identifier you sign in with.
• Phone number — so a customer and driver can reach each other about a delivery in progress.
• Profile photo, if you choose to upload one.
• Language, timezone and city — to show you prices, times and drivers relevant to where you are.
• Sign-in records — the date, IP address and browser or app of each sign-in attempt, successful or not. We keep these to detect someone trying to break into your account, and to answer you honestly if you ask "was that really me?".

If you sign in with Google or Apple

We receive your name, email address and a provider account identifier. We never receive your Google or Apple password. If you use Apple's Hide My Email, we receive only the relay address Apple generates and we treat that as your email address.

Customers

• Pickup and delivery addresses, including any addresses you save for reuse.
• Order records — what was requested, which driver accepted, and each status change from pickup to delivery, with times.
• Ratings and reviews you leave for a driver. These are shown publicly on that driver's listing alongside your first name.

Drivers

• Driving licence number and identity documents you upload for verification, plus vehicle and insurance details. These are reviewed by a StarOne administrator and are never shown to customers.
• Location while you are online — your device reports its position periodically so customers nearby can find you. Customers are shown your approximate distance, not your exact coordinates. Location reporting stops when you go offline.
• Subscription and payment records — your plan, invoices and payment status.

Everyone, automatically

• Device tokens, if you enable push notifications, so we can send them.
• Cookies — a session cookie that keeps you signed in, and, only if you accept them, analytics cookies. You can decline analytics cookies and the site works normally.
• Support tickets — anything you write to us, and any file you attach.

Payments

StarOne does not process delivery payments. What you pay a driver for a delivery is arranged directly between you and that driver, and we never see it.

Driver subscription payments are processed by Stripe. Card details are entered directly with Stripe and are never sent to or stored on StarOne's servers. We keep only the invoice record and the outcome. Stripe's own privacy policy governs what they do with that data.

Who we share it with

We do not sell personal information. We never have and we do not intend to. We share it only with:

• The other party to your delivery — a driver sees the customer's name, phone number and the pickup and drop-off addresses. A customer sees the driver's name, photo, vehicle, rating and phone number. Both need this to complete the job.
• Service providers who run parts of the platform — Stripe for subscription payments, Google Firebase for push notifications, our email provider for the messages we send you, and mapping and geocoding providers to turn an address into coordinates. Each receives only what it needs for that task.
• Law enforcement or a regulator, where we are legally required to, or where it is necessary to investigate fraud or a threat to someone's safety.

Where it is stored

StarOne's databases are hosted in Canada. Some service providers listed above process data outside Canada, including in the United States. Where that happens, the information is subject to the laws of that country, including lawful access requests by its authorities. We use providers that contractually commit to comparable protection.

How long we keep it

• Your account — for as long as it is open.
• Sign-in passcodes — minutes. They are deleted once used or expired.
• Order records — retained after account deletion in anonymised form, with your name and contact details removed, because we need them for tax and accounting records.
• Driver location history — kept briefly for operational reporting, then deleted.
• Invoices and payment records — six years, as Canadian tax law requires.
• Audit and sign-in logs — kept for a limited security window, then automatically deleted.

Deleting your account

You can request deletion from Account settings in the app or on the website. There is a short grace period during which you can change your mind by contacting support. After it passes, your personal information is irreversibly anonymised: your name, email, phone number, addresses, photo and documents are removed. Anonymised order and invoice records remain, as described above. Deletion cannot be undone once that grace period has ended.

Your rights under PIPEDA

You have the right to:

• Know what personal information we hold about you and what we do with it — this page, and you may ask for more detail.
• See it. Ask us for a copy. We will respond within 30 days.
• Correct it if it is wrong. Most of it you can edit yourself in Account settings.
• Delete it, as described above.
• Withdraw consent at any time, including consent to marketing email. Withdrawing consent necessary to provide the service means closing your account.
• Complain. Write to our privacy contact first. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

Marketing email and CASL

We send you two different kinds of email. Transactional messages — sign-in passcodes, order updates, receipts, and replies to your support tickets — are part of the service and are sent whenever they are needed. Commercial messages about offers or new features are sent only if you have expressly opted in, and every one carries an unsubscribe link that works in one click. We identify ourselves and give our mailing address in every commercial message, as CASL requires.

Keeping it secure

Traffic to StarOne is encrypted with TLS. Passwords are hashed, never stored in a readable form. Credentials such as payment and mail keys are encrypted at rest. Access to identity documents is restricted to administrators who need it, and every access is recorded in an audit log. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as the law requires.

Children

StarOne is not intended for anyone under 16 and we do not knowingly create accounts for them. If you believe a child has an account, contact us and we will remove it.

Changes to this policy

If we change this policy in a way that materially affects how we handle your information, we will tell you by email or in the app before the change takes effect. The date below shows when this version was published.

Contact us

Questions, access requests and complaints about privacy go to our privacy contact, whose address is shown on our contact page. You can also raise a support ticket from your account and mark it as a privacy request.