PRIVACY · VERSION 2026-09-26
Privacy Policy
Effective September 26, 2026
This Policy explains how Graffiti Labs US, LLC, doing business as Pickupz, collects, uses, discloses, and safeguards personal information through the Pickupz apps, website, hauling marketplace, operations tools, and support services.
1. Scope and accountability
This Policy applies to customers, haulers, prospective haulers, landfill operators, support contacts, and public-site visitors. Pickupz is accountable for information under its control, including information processed by service providers on its behalf. Questions or access requests may be sent to our Privacy Officer at legal@graffitilabs.io.
2. Information we collect
| Category | Examples |
|---|---|
| Account and contact | Name, email, phone number, sign-in provider, role, profile image, service city, support identifiers. |
| Driver and vehicle | Invite code, licence and insurance documents and expiry dates, truck make/class/box, plate, truck photos, service radius, availability, ratings, payout readiness. |
| Identity verification | Verified phone, licence capture, fresh selfie, document text-check outcome, face-match similarity and quality signals, verification status, model version, review decision. See the Driver Identity Verification Consent. |
| Bookings and location | Pickup/delivery addresses and coordinates, favourite routes, item/load details and images, landfill selection, estimated and scale weight, route, ETA, precise live hauler location, arrival events, trip status. |
| Payment and transaction | Stripe customer and connected-account identifiers, payment state, payout state, amount, platform fee, refunds, disputes, back-charges, landfill payables. Pickupz does not store full card or bank numbers. |
| Communications | In-app trip messages, support conversations, disputes, ratings, feedback, notification preferences and delivery records. |
| Device and security | Device and push tokens, app/build version, locale, authentication records, App Check and integrity results, IP-derived security information, logs, crash and diagnostic data. |
| Website | Essential session, security, and authentication information. We do not currently use advertising cookies on the public site. |
3. Sources
We collect information directly from you and your device; from the other participant in a booking; from Apple, Google, Firebase, Google Maps/Routes, Stripe, Plaid when enabled, landfills, support staff, and fraud or identity-verification providers; and from public or legally accessible sources where appropriate.
4. Purposes
- Create and authenticate accounts and keep them secure.
- Verify drivers, documents, vehicles, insurance, eligibility, and service areas.
- Provide estimates, matching, dispatch, navigation, live tracking, arrival alerts, chat, completion, ratings, and support.
- Process customer payments, hauler payouts, refunds, disputes, taxes, and landfill billing.
- Prevent fraud, unauthorized account sharing, unsafe conduct, abuse, and prohibited loads.
- Investigate incidents, enforce agreements, meet legal obligations, and protect users and the public.
- Maintain, troubleshoot, measure, and improve reliability, safety, pricing, and user experience.
- Send transactional communications. Marketing is sent only with a lawful basis and an unsubscribe option.
5. Location and notifications
Customers may provide a location or place pins manually. Haulers provide location to find nearby requests, enforce arrival proximity, navigate, simulate routes in developer testing, and share live progress with the matched customer. During an active job, collection may continue in the background where the hauler has granted permission. We do not sell precise location. Time-sensitive notifications, Live Activities, and Apple Watch updates may display job status and ETA on a locked or shared device; device settings control this display.
6. Driver identity and automated checks
The iOS app uses Apple Vision to locate and align the licence portrait and recognize limited document text, and a bundled face-embedding model to compare the aligned licence portrait with a fresh in-app selfie. Raw text and face embeddings are processed on-device. Pickupz receives the submitted images, result category, raw similarity, quality signals, model identifier, and capture method. A sufficiently strong result may be approved automatically only when required phone, document, expiry, and name checks also pass. Lower or inconclusive results go to authorized human review and are not automatically rejected solely because of the score.
The current pilot comparison is not a guarantee of identity and does not replace lawful driver screening. If Plaid Identity Verification is offered, Plaid receives information directly in its flow under its privacy terms, and Pickupz receives verification identifiers and results. Identity processing is subject to the separate express consent.
7. When we disclose information
- Matched users: names, rating, truck/service details, necessary pickup/delivery information, chat, status, and live location during the job.
- Landfills: a limited QR pass, booking reference, estimated weight/fee, and confirmation data required for the dump.
- Processors: Google/Firebase/Google Cloud, Apple, Stripe, maps and routing providers, Plaid when enabled, communications, security, support, and professional advisers.
- Legal and safety: authorities or others when required by law or reasonably necessary to prevent harm, fraud, or abuse, establish or defend legal claims, or enforce agreements.
- Business transaction: a buyer, investor, lender, or adviser under appropriate confidentiality protections.
We do not sell personal information or share it for third-party behavioural advertising.
8. Cross-border processing
Pickupz and its providers may process information in Canada, the United States, and other jurisdictions where providers operate. Information there may be subject to lawful access by courts, law enforcement, or national-security authorities. We use contractual, access-control, and technical safeguards appropriate to the information and provider relationship.
9. Retention
We retain information only as long as reasonably needed for the purposes above and applicable legal, accounting, tax, safety, dispute, insurance, and fraud obligations. Typical factors include account activity, an open booking or dispute, limitation periods, and mandatory financial recordkeeping. Driver documents and verification images are restricted and reviewed for deletion when verification, safety, dispute, and legal retention needs end. On-device face embeddings are not uploaded as reusable biometric templates. Backups and de-identified records may persist for a limited period. When no longer required, information is deleted, anonymized, or securely isolated.
10. Safeguards
Measures include authenticated access, least-privilege staff roles, protected cloud storage, server-side authorization, app integrity checks, transport encryption, audit trails, device security controls, restricted admin tools, and incident response. No system can be guaranteed completely secure. Protect your device and notify support of suspected misuse.
11. Your choices and rights
Subject to applicable law, you may request access to or correction of your personal information, ask how it was used or disclosed, withdraw consent where processing depends on consent, object or complain, and request account deletion. Withdrawal does not affect prior lawful processing and may prevent driver eligibility or Platform use where information is necessary to provide the service.
Use Account → Legal, privacy & account deletion, in-app support, or email legal@graffitilabs.io. Do not email identity documents; we will provide a secure method. We may verify your identity before responding. Alberta residents may contact the Office of the Information and Privacy Commissioner of Alberta if a concern is not resolved.
12. Children
Pickupz is not intended for anyone under 18, and we do not knowingly create accounts for minors.
13. Changes
We may update this Policy as practices or laws change. The version and effective date appear above. If a change materially affects how personal information is collected, used, or disclosed, the app will present the updated notice and request a new acknowledgement or consent where required.
Contact
Privacy Officer · Graffiti Labs US, LLC, doing business as Pickupz
legal@graffitilabs.io