Privacy Policy

1. Who we are and what this covers

Cravee is run by 2634428 Alberta Inc. ("Cravee", "we", "us") of Beaverlodge, Alberta. This one policy covers everything Cravee runs:

• Cravee Fetch (fetch.cravee.ca): grocery Runs, Solo Fetches and restaurant orders.
• Cravee Delivery orders: restaurant deliveries, including the text messages our dispatch sends you and the tracking page those texts link to.
• The Cravee Driver app, used by the drivers who shop and deliver.

It applies to customers, to the restaurants and stores we work with (merchants) and their staff, and to drivers and people applying to drive.

2. What we collect and why

• Names, email addresses and phone numbers, so you can sign in, so the driver and merchant know whose order it is, and so we can reach you about it. If you sign in with Google, we get your name, email and profile picture from Google, never your password.
• Addresses and locations: your delivery address and the pin you confirm on the map, to price the delivery and get the driver to your door. If you tap “Use my location”, we read your phone's or computer's location once, only to find the address; we don't track it. For a rig, lease or farm site, the site's name, its land location (LSD), directions, where to meet and an on-site contact's phone number, which the driver calls on arrival. If you give someone else's number, let them know.
• Orders: shopping lists, notes for the merchant or driver, what you ordered, substitutions you approved and what you paid.
• Chat: messages between you and your driver about an order, and support chat with us.
• Photos: receipts the driver takes at the store, photos of items and substitutes, proof-of-delivery photos at your door, and a shopping list photo if you choose to scan one.
• Driver documents: a driver's licence, insurance, vehicle registration and proof they can work in Canada, to decide on an application and to keep drivers properly covered.
• Driver location during shifts: while a driver is on a delivery, their location is shared with the customer it's for and with our staff, so you can see they're on the way and we can help if something goes wrong. It isn't collected when they're off shift.
• Payments: card payments go through Stripe. We never see or store your card number, only the amount, whether it went through, and the card's last four digits. For payment at the door we record how you paid and how much.
• Contest entries: if you enter a contest, like the Haunted Grocery Run, your name, nickname, email, phone number if you give it, town and score, to run the contest and contact the winner. Your nickname, town and score are shown publicly on the contest leaderboard; your name, email and phone number never are. We send you deals and news by email only if you tick the box for it.
• Analytics and technical data: cookies that keep you signed in and remember your cart, error reports so we can fix problems, and Google Analytics, but only if you accept it when we ask. You can change your answer any time with "Analytics cookies" at the bottom of every page. Push notifications are off unless you turn them on.

We use this to run your order, pay drivers and merchants, keep the records the law requires, and keep the service safe. We don't sell personal information or share it for anyone else's advertising.

3. Who sees it

The merchant you order from and the driver delivering to you see your name, phone number, address and order: what they need to do their part, and nothing more. We also use these service providers:

• Supabase: Our database, sign-in and file storage. Cravee Fetch uses one project and the Cravee Driver platform another. Where: Cravee Fetch: United States (Ohio, us-east-2). Cravee Driver: Canada (Montréal, ca-central-1).
• Vercel: Hosts the Cravee Fetch website and runs its server code. Where: United States
• Google: Maps, address search (Places), distances and routes, sign-in with Google if you choose it, Analytics if you accept it, and encrypted backups of our databases in Cloud Storage. Where: Backups: Canada (Montréal). Other services: United States and elsewhere.
• Stripe: Card payments and refunds. Your card number goes to Stripe, never to us. Where: United States and elsewhere
• Twilio: The text messages about your order: driver updates, approvals and tracking links. Where: United States
• Resend: Order, receipt and account emails. Where: United States
• Chatwoot: The support chat on our site, and what you write in it. Where: United States
• OpenAI: Reads a photo of a shopping list you choose to scan and turns it into items. Where: United States
• Anthropic: AI assistance inside the Cravee Driver platform. Where: United States
• Sentry: Error reports, and recordings of a small share of website sessions so we can see what went wrong. Recordings hide all text and everything typed, and leave out images and video. Where: United States
• Hyperzod: Restaurant storefronts some Cravee Delivery orders are placed through. Where: Outside Canada
• Shipday: Dispatch and tracking for some deliveries by our own drivers. Where: United States
• Expo: Push notifications and updates for the Cravee Fetch and Cravee Driver apps. A notification passes through Expo to Apple or Google, which deliver it to your phone. Where: United States
• GitHub: Runs our backup job. Backups are encrypted on its runner, in the United States, before they are uploaded; GitHub never holds them unencrypted. Where: United States

Many of these store or process information outside Canada, mostly in the United States, where the government may be able to get at it under its own laws. Each is bound to use it only to provide its service to us.

4. How long we keep it

We keep things only as long as we need them. A job runs every day to remove what has passed its time:

Your account itself stays until you ask us to close it. Order records stay as long as we need them for accounting, without your name, phone or address once those are no longer needed.

5. Your rights

You can ask us to:

• show you the personal information we hold about you (access);
• correct it if it's wrong (correction);
• delete it, apart from what the law makes us keep (deletion);
• stop using it for anything that isn't needed for an order you've placed (withdrawing consent).

Email support@cravee.ca for any of these. We'll answer within 30 days. If you aren't happy with how we handle it, you can complain to the Office of the Information and Privacy Commissioner of Alberta.

6. Security

Information is encrypted on its way to and from us, and our backups are encrypted. Only the people who need it to run the service can get at it, and card numbers never reach our systems. If a breach ever puts you at real risk, we'll tell you and the Commissioner, as the law requires.

7. Children

Cravee isn't for children. You need to be old enough to enter a contract in Alberta to use it.

8. Changes

When we change this policy we update the date at the top. If a change matters for how we handle your information, we'll tell you directly.

9. Contact

Our Privacy Officer is Amaldev. Write to him at support@cravee.ca, or to 2634428 Alberta Inc. (Cravee), Beaverlodge, Alberta.