Draft for legal review. Not yet in force.

This policy explains how Dolle handles personal information, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Your role and ours

Each towing company using Dolle controls the personal information of its own customers and staff. Dolle processes that information on the company's behalf, as its service provider, and only to run the service.

What we collect

• Account details: names, email addresses and passwords (stored by our sign-in provider as secure hashes), roles and company memberships.
• Operations data entered by a company: customers' names and phone numbers, vehicles and plates, pickup and drop-off locations, notes, invoices and payments, drivers' details and licence dates, and trucks.
• Ask Dolle conversations, saved per person and company so they continue where they left off.
• Usage records: an audit trail of who changed what, and a record of each AI request (the feature, the person, tokens and cost).
• Technical logs needed to keep the service secure and working.

Why we use it

To provide dispatch, invoicing and the other features you use; to secure accounts and keep companies separate; to show you what the AI costs; and to support you. We do not sell personal information or use it for advertising.

Where it is stored and who processes it

• Hosting: Vercel runs the application.
• Database: Neon Postgres, hosted on Amazon Web Services in the United States (us-east-1). Sign-in data is held by Neon Auth in the same database.
• AI: when you use an AI feature, the relevant text and any photo you attach (for example a call transcript, a photo of a VIN plate, or invoice lines) is sent through the Vercel AI Gateway to a model provider, currently OpenAI, with Microsoft Azure as a fallback, to produce the answer.
• Maps: addresses typed or pasted into Dolle are looked up with OpenStreetMap's Nominatim service, and the maps you view load from OpenStreetMap's tile servers, which see your device's IP address and the areas shown. The OpenStreetMap Foundation is based in the United Kingdom.

Because these providers are outside Canada (mostly in the United States), information may be accessed by authorities there under their laws.

How long we keep it

Operations data is kept while the company's account exists. The audit trail is kept for the life of the company and can't be altered. An Owner can ask us to delete the company; we then delete its data, including the audit trail, within 30 days of the request. During the pilot this is done by our team on request, not by a button in the app.

How we protect it

Access needs a signed-in account and depends on the person's role; every request is checked against the company the person belongs to; data travels encrypted (HTTPS); AI use is limited per company and per person.

Access, correction and complaints

Customers of a towing company should contact that company first. Anyone may ask us what personal information we hold about them, or ask us to correct it, by writing to our privacy contact: to be named before launch. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Breaches

If a breach creates a real risk of significant harm, we will notify the affected companies, and help them notify individuals and the Privacy Commissioner, as PIPEDA requires.

Cookies

Dolle only sets the cookies it needs to work: your sign-in session and the company you're working in. Your light or dark theme is remembered in your browser's own storage, not in a cookie. We don't use advertising or tracking cookies.