Version of 8 November 2026 · Quebec, Canada
Privacy policy
This policy explains which personal information ApproSATE collects, why, for how long, and how to exercise your rights under Quebec’s Act respecting the protection of personal information in the private sector (Law 25).
This document is not legal advice and does not replace a lawyer’s audit. It describes how the platform currently works.
1. Privacy officer
The privacy officer can be reached at contact@approsate.com. Access, rectification, consent withdrawal or deletion requests must be sent there, or exercised in My account → My data.
2. What we collect
- Clients and recipients: name, company, address, postal code, phone, email, portal credentials.
- Orders and deliveries: references, items, instructions, proof (photos, signatures), barcodes, statuses.
- Drivers and staff: name, email, phone, GPS during a delivery route, operations messages.
- Logs: email or SMS sends (even if not transmitted), consents, privacy requests.
3. Purposes
We use this information only to:
- plan and execute pickups, deliveries and returns;
- prove delivery (photo, signature);
- inform the customer (tracking, email, SMS);
- secure accounts and prevent abuse;
- meet legal obligations and handle incidents.
We do not use this data for targeted advertising.
4. Consent
Public tracking does not require an account: it checks the parcel number and postal code. Creating or using the customer portal requires accepting this policy. You can withdraw consent by closing the portal; completed deliveries may be kept for the periods below.
5. Retention (targets)
- Portal account: until closure or 24 months after the last delivery.
- Delivery files and proof: 24 months.
- GPS positions: 90 days.
- Notification logs: 12 months.
- Sign-in session: 12 hours (access token).
Automatic purge is not yet running. The periods above are targets. You can request early portal deletion; operational traces needed as proof of delivery may be kept.
6. Your rights
- be informed of collection;
- access your information;
- have it rectified;
- withdraw portal consent;
- ask to stop dissemination or, where applicable, de-indexation.
We reply within 30 days. If we refuse, we give reasons.
7. GPS, photos and signatures
Driver location is used for on-site arrival and an in-progress delivery route, not off-duty surveillance. Photos and signatures are proof of delivery, not identity documents. They are shown to the concerned customer and to operations.
8. Communications and processors
Transactional email is sent from ApproSATE mailboxes (noreply@approsate.com, notification@approsate.com) via our mail provider. Operations can pause outbound email in settings; while paused, messages are logged without SMTP delivery. Public and ops maps use Mapbox. The driver app may use Expo for push notifications. Any processing outside Quebec must go through a privacy impact assessment before production.
9. Incidents
A confidentiality incident with a risk of serious harm will be reported to the CAI and to the people concerned, as required by Law 25.
10. Session, cookies and maps
No advertising and no marketing pixels. On first visit we ask for your choice via a privacy banner:
- Essential: language preference and, after sign-in, the session token are stored in the browser (
localStorage). These are required for the site to work. - Maps (optional): public and operations maps use Mapbox, which may set technical cookies or load resources from Mapbox servers. Maps load only if you choose “Accept all” (or equivalent). Staff console maps follow the same preference on this browser.
The public contact form requires an explicit checkbox consent. We store the message and the consent timestamp/version in our database so we can reply and demonstrate consent under Law 25. Retention target for contact messages: 24 months.
11. Changes
When this policy changes in a material way, we update the version date on this page. Continued use of the portal after notice may require renewing consent where the law requires it.