Privacy policy

MOVOS puts three-sided LED ad screens on delivery riders’ bags in Toronto. This policy explains what personal information we collect through movos.ca, why we collect it, who handles it, how long we keep it and what you can ask us to do. If anything here is unclear, ask us. How to reach us is under “Contact us” at the end.

Two other notices cover the screens:

The street privacy notice explains what MOVOS screens sense on the street.
The rider privacy notice explains what we collect from couriers who carry a MOVOS unit.

The short version

movos.ca sets no cookies and has no ad pixels.
Our analytics work without cookies and report totals, not individual visitors.
Most of the personal information we hold is what you send us through a form or by email.
Our forms ask only for what we need to handle your request.
Marketing messages need your separate consent, and you can unsubscribe at any time.
We don’t sell personal information.

Who we are

MOVOS is a company based in Toronto, Ontario. Our legal name is MOVOS Inc.

MOVOS is responsible for the personal information described in this policy, including information our service providers handle for us. Our privacy contact is listed under “Contact us” at the end of this policy.

What we collect

When you visit the site

You can browse movos.ca without telling us who you are.

movos.ca sets no cookies and has no advertising pixels. We don’t track you across other websites.

We use Vercel Web Analytics and Vercel Speed Insights to see which pages people visit and how quickly they load. Neither tool uses cookies, and both report aggregate figures, not profiles of individual visitors.

Web Analytics records each page view with the page address, the website that sent you, your approximate location (country, region and city, worked out from your connection), and your device type, operating system and browser. Instead of a cookie, it tells visits apart with a one-way hash made from your request, and it discards that hash after 24 hours.
Speed Insights records how quickly each page loaded, with the page address, your country, device type, operating system, browser and connection speed.
Neither tool keeps your IP address with what it records.
We also count how often some features are used, such as buttons, the campaign planner, the creative previewer and the steps of our forms. These counts record which feature was used, never what you typed.
If you arrive by scanning the QR code on a MOVOS unit, we remove the unit number from the page address before it reaches our analytics.

When your browser asks for a page, our hosting provider receives your IP address and basic technical details, such as your browser type. Every website receives these details to deliver pages. Vercel uses them to deliver the site and protect it from attacks, and keeps short-lived logs of requests to the site, which we use to find and fix problems.

movos.ca doesn’t ask your browser for access to your camera, microphone or location.

The creative previewer runs entirely in your browser. Files you add to it are never uploaded. We record only that the previewer was used.

If you start the rider application, your browser keeps your progress in session storage, so reloading the page doesn’t lose your answers. Session storage also holds where your visit started: the first page you opened on movos.ca, the website that sent you there and any campaign tags (UTM parameters) in that page’s address. We receive those only if you send a form. Session storage isn’t a cookie. It stays in your browser and is cleared when you close the tab.

When you fill in a form

Each form asks for the following.

Advertiser proposal: your name, work email and company. You can also give your role, website and phone number, a budget range, the zones and timing you have in mind, your campaign goal, a message and a plan from our campaign planner.
Rider application: your first and last name, mobile number, email and the area you ride in; your vehicle, whether it has a rear rack or box, and your bag type; your typical weekly hours, usual zones and shift times; and, if you choose, the delivery platforms you ride for. You confirm that you’re 18 or older, and you consent to being contacted about your application by SMS, phone or email. We don’t ask for your date of birth or any ID numbers.
Fleet inquiry: your company, name and email. You can also give your role and phone number, your fleet size, vehicle types, cities, depot locations, the bags or boxes you use now and a message.
General contact: your name, email, the topic and your message.

With every form, we also record:

whether you agreed to get updates, if the form offered them, with the version of the box’s wording, the date and time, and the page you were on;
where your visit started, as described above: your landing page, the website that referred you and any campaign tags;
the date and time you submitted.

Pages with a form use Cloudflare Turnstile to check that a person, not an automated script, is sending it. Turnstile runs only on pages with a form. To do its check, it reads technical signals from your browser and connection, including your IP address, your browser’s user agent and details of the encrypted connection. It doesn’t read what you type into the form. Cloudflare uses these signals to tell people from automated traffic, and also to improve its bot detection.

We also limit how often forms can be sent from one connection. Each time we accept a form, we store a one-way hash of your IP address with the time. The hash is made with a secret key, so it can’t be turned back into your address, and we don’t store your IP address with your submission. We delete these hashes after one day.

When you email us

If you email us, we receive your email address, your message and anything you attach.

How we use it

We use personal information to:

reply to you and follow up on your proposal request, application or inquiry;
review rider applications and fleet partner inquiries;
send you a confirmation email when you submit a form;
send you occasional updates, but only if you ticked the box to get them;
keep a record of your consent, so we can show we have it;
protect the site and our forms from spam and abuse;
understand, in aggregate, how the site is used and which channels bring inquiries, so we can improve it.

We won’t use your personal information for a new purpose without asking you first, unless the law requires or allows it. We don’t sell personal information, and we don’t use it to build advertising profiles.

When you send us a form or an email, you consent to us using what you send for the purposes above. You can withdraw your consent at any time by contacting us (see “Contact us” below). If you withdraw consent to information we need to handle your request, we may not be able to continue with it.

Marketing messages and Canada’s anti-spam law

Canada’s anti-spam legislation (CASL) sets rules for commercial email and texts. Here’s how we follow them.

We send updates only to people who say yes. When our forms offer updates, they ask with a separate box that starts unchecked: “Send me occasional updates from MOVOS. Unsubscribe anytime.”
We keep a record of your answer: whether you agreed, the version of the wording you saw, the date and time, and the page you were on.
You don’t need to tick the box for us to reply to your inquiry or application.
Every marketing message we send identifies MOVOS, includes our mailing address and gives you a way to unsubscribe.
You can unsubscribe at any time, using the unsubscribe option in any update or by contacting us (see “Contact us” below). We honour unsubscribe requests within 10 business days.

Who handles your information, and where

We use a small number of service providers to run the site. They handle personal information for us so they can provide their services, and we remain responsible for it.

Vercel hosts the site and runs the code that handles form submissions. That code runs in Vercel’s Montréal region, and Vercel delivers pages through its global network. Vercel also provides our analytics.
Supabase stores form submissions and consent records in a Postgres database in Montréal, in the AWS ca-central-1 region.
Resend sends the emails the site generates, such as notifications to our team and confirmation emails to you. Resend is based in the United States and sends our email from there.
Cloudflare provides Turnstile, the spam check on our forms. We use Cloudflare for nothing else.
Our email provider hosts the inbox that receives every email you send us and a copy of every form submission.

We don’t use any other service that handles personal information from the site. If we add one, such as a service for sending updates, we’ll list it here first.

Some of these providers process information outside Canada, for example in the United States. When that happens, the information is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to access it.

We share personal information only:

with the service providers listed above, so they can provide their services to us;
when the law requires it, for example to comply with a court order;
if MOVOS is sold or merges with another business, with the other party, under the protections the law requires.

How long we keep it

Form submissions and emails: 24 months after our last contact with you. If you become a client, rider or partner, we keep what we need while we work together, and after that for as long as our agreement or the law requires.
Consent and unsubscribe records: for as long as you get updates from us, and three years after that, so we can show we followed CASL.
Rate-limiting hashes: one day.
Request logs: Vercel keeps the logs we can see for one day.
Analytics: aggregate figures that don’t identify anyone. Web Analytics discards the hash that tells visits apart after 24 hours.

When we no longer need personal information, we delete it or make it anonymous. If the law requires us to keep something longer, or you’ve asked us for access to it, we keep it until that’s resolved.

How we protect it

We protect personal information with safeguards that suit how sensitive it is.

The site is served over an encrypted connection (HTTPS).
Form submissions go to a private database through the site’s server, never straight from your browser. Our database provider encrypts the database at rest.
We don’t store your IP address with your submission.
Only the people at MOVOS who need to see submissions to do their work can see them.

No system is perfectly secure. If a breach of our safeguards involving your personal information creates a real risk of significant harm to you, we’ll tell you and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

Your rights

Canada’s federal privacy law for businesses, the Personal Information Protection and Electronic Documents Act (PIPEDA), gives you the right to see and correct your personal information. You can ask us:

whether we hold personal information about you, and for a copy of it;
how we’ve used it and who we’ve shared it with;
to correct anything that’s inaccurate or incomplete;
to delete it, unless we need to keep it for a legal reason;
to stop sending you updates.

To make a request, contact us (see “Contact us” below). We may ask you to confirm your identity before we share or change anything. We’ll reply within 30 days, the time PIPEDA allows, and tell you if we need longer and why. There’s no charge. If we can’t give you some of the information, we’ll explain why, unless the law prevents us.

If you live in Quebec

Quebec’s private-sector privacy law, as updated by Law 25, gives people in Quebec further protections.

Person responsible: our Privacy Officer is responsible for protecting personal information at MOVOS. How to reach them is under “Contact us” below.
Tracking off by default: Quebec law requires any technology that can identify, locate or profile you to be off by default. movos.ca uses no such technology, so there’s nothing to switch on.
Portability: you can ask for the personal information you gave us in a structured, commonly used format.
Clear language: we’ve written this policy in plain language. Tell us if any part is unclear.
French: we’ll publish this policy in French before we market MOVOS in Quebec.
Complaints: you can also contact the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.

Children

movos.ca is meant for businesses and adults. It isn’t aimed at children, and we don’t knowingly collect personal information from children. You must be 18 or older to apply as a rider. If you think a child has sent us personal information, contact us (see “Contact us” below) and we’ll delete it.

Changes to this policy

We’ll update this policy when our practices change. The date on this page shows when it last changed. If a change affects how we use information we already hold, we’ll tell the people affected before it takes effect, and ask for consent again where the law requires.

Contact us

The person responsible for personal information at MOVOS is our Privacy Officer. To reach them, send a message through our contact form and choose Privacy as the topic. We’ll reply within two business days.

If you’re not satisfied with how we handle a privacy concern, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.