PRIVACY · VERSION 2026-10-03
Privacy Policy
Effective October 3, 2026
This Policy explains how Graffiti Labs US, LLC, doing business as Pickupz, collects, uses, discloses, and safeguards personal information through the Pickupz apps, website, hauling marketplace, operations tools, and support services.
1. Scope and accountability
This Policy applies to customers, haulers, prospective haulers, landfill operators, support contacts, and public-site visitors. Pickupz is accountable for information under its control, including information processed by service providers on its behalf. Questions or access requests may be sent to our Privacy Officer at legal@graffitilabs.io.
2. Information we collect
| Category | Examples |
|---|---|
| Account and contact | Name, email, phone number, sign-in provider, role, profile image, service city, support identifiers. |
| Driver and vehicle | Invite code, licence and insurance documents and expiry dates, truck make/class/box, plate, truck photos, service radius, availability, ratings, payout readiness. |
| Identity verification | Verified phone, licence capture, fresh selfie, document text-check outcome, face-match similarity and quality signals, verification status, model version, review decision. See the Driver Identity Verification Consent. |
| Bookings and location | Pickup/delivery addresses and coordinates, favourite routes, item/load details and images, landfill selection, estimated and scale weight, route, ETA, precise live hauler location, arrival events, trip status. |
| Payment and transaction | Stripe customer and connected-account identifiers, payment state, payout state, amount, platform fee, refunds, disputes, back-charges, landfill payables. Pickupz does not store full card or bank numbers. |
| Communications | In-app trip messages, support conversations, disputes, ratings, feedback, notification preferences and delivery records. |
| Device and security | Device and push tokens, app/build version, locale, authentication records, App Check and integrity results, IP-derived security information, logs, crash and diagnostic data. |
| Website | Essential session, security, and authentication information. We do not currently use advertising cookies on the public site. |
3. Sources
We collect information directly from you and your device; from the other participant in a booking; from Apple, Google, Firebase, Google Maps/Routes, Stripe, Didit, prior verification providers, landfills, support staff, and fraud or identity-verification providers; and from public or legally accessible sources where appropriate.
4. Purposes
- Create and authenticate accounts and keep them secure.
- Verify drivers, documents, vehicles, insurance, eligibility, and service areas.
- Provide estimates, matching, dispatch, navigation, live tracking, arrival alerts, chat, completion, ratings, and support.
- Process customer payments, hauler payouts, refunds, disputes, taxes, and landfill billing.
- Prevent fraud, unauthorized account sharing, unsafe conduct, abuse, and prohibited loads.
- Investigate incidents, enforce agreements, meet legal obligations, and protect users and the public.
- Maintain, troubleshoot, measure, and improve reliability, safety, pricing, and user experience.
- Send transactional communications. Marketing is sent only with a lawful basis and an unsubscribe option.
5. Location and notifications
Customers may provide a location or place pins manually. Haulers provide location to find nearby requests, enforce arrival proximity, navigate, simulate routes in developer testing, and share live progress with the matched customer. During an active job, collection may continue in the background where the hauler has granted permission. We do not sell precise location. Time-sensitive notifications, Live Activities, and Apple Watch updates may display job status and ETA on a locked or shared device; device settings control this display.
6. Driver identity and automated checks
Didit processes Canadian driver’s licence images, live-selfie capture and biometric face comparison in a hosted verification flow. Pickupz sends account-bound identity expectations and retrieves provider status and the verified selfie through its backend. Google Cloud Vision processes the separately uploaded insurance image for insured-name and labelled-expiry checks. Pickupz does not retain raw server OCR text, but retains a protected copy of the checked insurance image, document integrity evidence, expiry and result status. On-device text and face checks may provide supplementary guidance; those mobile scores cannot authorize new drivers alone.
Automatic approval requires server-confirmed licence, matching name, current licence, liveness, face match and matching unexpired insurance, plus required vehicle documents. Unreadable or ambiguous insurance goes to human review. OCR cannot prove that a policy has not been cancelled or establish complete coverage. Identity processing is not a guarantee and does not replace lawful driver screening. The verified live selfie is used as the marketplace profile photo so the matched customer can recognize the driver. Didit processes verification data under its privacy policy and applicable terms, including provider-side biometric processing and retention. Existing provider verification records remain valid unless re-verification is required. See the separate express consent.
7. When we disclose information
- Matched users: first name, verification-selfie profile photo, rating, truck/service details, vehicle plate, necessary pickup/delivery information, chat, status, and live location during the job.
- Landfills: a limited QR pass, booking reference, estimated weight/fee, and confirmation data required for the dump.
- Processors: Google/Firebase/Google Cloud including insurance OCR, Apple, Stripe, Didit, maps and routing providers, prior verification providers for existing records, communications, security, support, and professional advisers.
- Legal and safety: authorities or others when required by law or reasonably necessary to prevent harm, fraud, or abuse, establish or defend legal claims, or enforce agreements.
- Business transaction: a buyer, investor, lender, or adviser under appropriate confidentiality protections.
We do not sell personal information or share it for third-party behavioural advertising.
8. Cross-border processing
Pickupz and its providers may process information in Canada, the United States, and other jurisdictions where providers operate. Information there may be subject to lawful access by courts, law enforcement, or national-security authorities. We use contractual, access-control, and technical safeguards appropriate to the information and provider relationship.
9. Retention
We retain information only as long as reasonably needed for the purposes above and applicable legal, accounting, tax, safety, dispute, insurance, and fraud obligations. Typical factors include account activity, an open booking or dispute, limitation periods, and mandatory financial recordkeeping. Driver documents and verification images are restricted and reviewed for deletion when verification, safety, dispute, and legal retention needs end. On-device face embeddings are not uploaded as reusable biometric templates. Backups and de-identified records may persist for a limited period. When no longer required, information is deleted, anonymized, or securely isolated.
10. Safeguards
Measures include authenticated access, least-privilege staff roles, protected cloud storage, server-side authorization, app integrity checks, transport encryption, audit trails, device security controls, restricted admin tools, and incident response. No system can be guaranteed completely secure. Protect your device and notify support of suspected misuse.
11. Your choices and rights
Subject to applicable law, you may request access to or correction of your personal information, ask how it was used or disclosed, withdraw consent where processing depends on consent, object or complain, and request account deletion. Withdrawal does not affect prior lawful processing and may prevent driver eligibility or Platform use where information is necessary to provide the service.
Use Account → Legal, privacy & account deletion, in-app support, or email legal@graffitilabs.io. Do not email identity documents; we will provide a secure method. We may verify your identity before responding. Alberta residents may contact the Office of the Information and Privacy Commissioner of Alberta if a concern is not resolved.
12. Children
Pickupz is not intended for anyone under 18, and we do not knowingly create accounts for minors.
13. Changes
We may update this Policy as practices or laws change. The version and effective date appear above. If a change materially affects how personal information is collected, used, or disclosed, the app will present the updated notice and request a new acknowledgement or consent where required.
Contact
Privacy Officer · Graffiti Labs US, LLC, doing business as Pickupz
legal@graffitilabs.io