Privacy Policy

This Privacy Policy explains how Inteligent Studio Incorporated ("Roadity," "we," "us," or "our") handles personal information through the Roadity mobile app, roadity.com, connected vehicle displays, and related support services. We are responsible for personal information under our control. Our privacy contact is the Privacy Officer, Inteligent Studio Incorporated, reachable at support@roadity.com. Please use “Privacy request” in the subject line.

Roadity helps learners prepare for driving tests with educational material, practice routes, maps, audio guidance, and subscriptions. Location-based guidance uses precise location; signed-in activity and purchases can be linked to your account. This policy applies alongside our Terms of Service. Reading or accepting the Terms does not replace any separate consent required for personal-information processing.

1. Information we collect and why

• Accounts and sign-in. Firebase Authentication assigns an identifier, including for guest accounts. When you use Apple or Google sign-in, we receive the identifier and available profile information, such as name, email address, profile image, and email-verification status. Apple may supply a private relay email address. We use this information to authenticate you, maintain your account, prevent abuse, and link access to purchases. We do not receive your Apple or Google account password.
• Location and navigation. With device permission, the app processes coordinates, location updates, and speed to display your position, follow a practice route, calculate guidance or deviations, and support connected car displays. Location used in a nearby-centre search can be sent to our server. Mapping and directions services receive the locations needed to answer their requests. On supported iOS devices, active guidance can continue in the background or through CarPlay. Precise location is sensitive information; allowing it can reveal your movements. Revoke permission in device settings to stop location access. Guidance and nearby-location features may then be unavailable.
• Approximate location and network information. Our servers receive IP addresses and request information. IPinfo processes IP addresses to estimate location for nearby test centres; session records can include IP address and city. This is separate from GPS permission, so disabling precise location does not hide your IP address.
• Preferences and learning activity. The app stores settings, language, selected centre, onboarding answers, lesson progress, route attempts, previews, and usage counters on your device. Related analytics events, including selected centre, lesson or route identifiers and navigation start/stop events, are transmitted separately. Local storage does not mean all associated activity remains on the device.
• Purchases. Apple or Google handles store checkout and payment credentials. Roadity and RevenueCat process account identifiers, available name and email, product and transaction identifiers, receipts or purchase tokens, purchase and expiry dates, renewal and refund events, entitlement status, and selected test-centre access. We use these records to validate, restore, and support subscriptions and prevent fraudulent access. We do not receive your full payment-card number from these store purchases.
• Analytics and diagnostics. Firebase Analytics collects app interactions, app-instance and device-related identifiers, technical information, and error events. We associate analytics with the Firebase user identifier when signed in. Events help us understand onboarding, lessons, route practice, failures, and feature usage. Website Google Analytics processes visits, page interactions, browser/device information, and online identifiers. Service logs also record requests, failures, and security events.
• Support and feedback. We collect what you submit, including email correspondence, ratings, feedback text, category, related route or centre, app version, platform, account association, and resolution records. Do not send passwords, full payment-card details, driver's licence images, or unnecessary information about other people.
• Notifications and website submissions. Where notifications are available and enabled, a device messaging token is used to deliver service messages. If you submit a website form, we process the fields and message you provide to handle that request. Marketing subscription requests are used for the updates you request.

2. Service providers and third-party services

We disclose information needed to operate the feature or service concerned. A provider used to prepare route content does not thereby receive your personal driving history. Providers may also process information independently when you use their own accounts, stores, maps, or embedded content.

• Google and Firebase: authentication, Google sign-in, app analytics, Remote Config, App Check, and supported Firebase Cloud Messaging delivery. These services process account, installation, device, interaction, security-verification, and messaging information relevant to their function. Google Maps provides maps and routing; YouTube embedded lessons can receive your IP address, device information, cookies, and viewing interactions when loaded. Google Fonts requests disclose network and browser information. See Google's Privacy Policy and Firebase privacy information.
• Apple: Sign in with Apple, App Store payments, MapKit directions, device integrity services, and CarPlay where supported. Apple processes sign-in, purchase, location, and device information relevant to the service. See Apple's privacy information.
• RevenueCat: subscription validation, purchase restoration, customer entitlements, and subscription lifecycle events, including account identifiers and available name/email. See RevenueCat's Privacy Policy.
• IPinfo: IP-address lookup for approximate location and nearby-centre results. See IPinfo's Privacy Policy.
• Cloudflare: website hosting, request delivery, website database and media storage through Workers, D1, and R2. This involves website request information and information stored in website forms or content. See Cloudflare's Privacy Policy.
• Mapbox and ElevenLabs: backend route preparation, map imagery, routing and speed-limit information, and generation of spoken route instructions. These integrations process route coordinates and instruction text used to create content; they are not a voice-recording feature. See Mapbox's Privacy Policy and ElevenLabs' Privacy Policy.
• Operational email, storage, and alerts: our backend supports Google mail or Postmark for email, local or S3-compatible storage for files, and Twilio and Telegram for operational alerts. The provider configured for a deployment processes the relevant message, recipient, file, or diagnostic information. Error reports can contain account or request information included in the underlying error. Notification integrations are for service operations and do not mean we disclose every customer's information to every provider. See Postmark, Twilio, and Telegram.

We may also disclose information to professional advisers subject to confidentiality, where legally required, to investigate fraud or protect rights and safety, or in connection with a merger, acquisition, financing, or sale of business assets subject to applicable privacy protections. A successor must handle transferred information consistently with applicable law, and we will provide notice where required. We do not sell personal information or provide your precise location to advertising buyers.

3. Cookies, storage, and analytics choices

The website uses a theme cookie to remember your display preference and Google Analytics cookies or similar identifiers to measure use. Administrative or authenticated features may also use session storage. The app uses local preferences and SDK storage for sign-in, settings, purchase state, and analytics. Embedded providers may use their own cookies.

In the current website implementation, Google Analytics loads when a page loads; there is no built-in analytics preference panel. Browser cookie controls, script-blocking tools, and Google's Analytics opt-out browser add-on can limit website analytics. Blocking cookies alone may not prevent all network requests. The app currently has no dedicated analytics opt-out switch. Contact our Privacy Officer to request withdrawal of consent or discuss your options. These statements describe available controls and do not replace consent that applicable law requires us to obtain.

4. Consent and your choices

We collect, use, and disclose personal information with consent where required, and otherwise only as permitted or required by applicable law. We explain sensitive or unexpected processing when seeking the relevant permission or consent. We use information for the purposes described here; a materially different purpose requiring consent will be presented separately before that use.

You can decline optional profile information, use available guest features, change device permissions, disable supported notifications, and withdraw consent by contacting us. Withdrawal does not invalidate earlier lawful processing and may prevent us from providing the feature that needs the information. Account access and subscription verification require some account and transaction information.

Commercial email is sent only with consent or another lawful basis under Canada's anti-spam rules. You may unsubscribe through the message or email us; requests will be acted on without delay and within 10 business days. Necessary replies, receipts, security notices, and other non-promotional service communications may still be sent.

5. International processing

Our providers may process and store information in Canada, the United States, and other countries where they or their subprocessors operate. Your information is not guaranteed to remain in Canada or Québec. Foreign courts, law-enforcement bodies, or other authorities may obtain lawful access under local laws. We remain accountable for information under our control and use contractual and other safeguards appropriate to the processing. Where Québec law applies, transfers outside Québec require the assessment and protections prescribed by that law. Contact us for information about service-provider processing outside Canada.

6. Retention and security

We retain personal information only as long as reasonably necessary for its stated purpose and applicable legal obligations. Account and entitlement information supports your ongoing service; transaction records may need to remain for tax, accounting, refunds, and disputes; support and security records may remain to resolve issues and investigate abuse. Retention depends on record type, account status, legal requirements, and unresolved claims. We do not represent that every record is automatically deleted after a single fixed period.

When information is no longer needed, it is deleted or anonymized in accordance with applicable law. Backups and provider systems may take additional time to cycle out deleted data; legally required records are retained only for the applicable purpose. Device preferences and downloaded content can remain until cleared or the app is removed, and device backups may preserve copies.

Safeguards include authenticated service access, access controls, and security checks appropriate to the information. No network or storage system is perfectly secure. If a breach triggers notification or reporting obligations, we will notify affected individuals and the appropriate authorities as required by law.

7. Access, correction, withdrawal, and deletion

Email support@roadity.com to request access to your personal information, an explanation of its use and disclosure, correction, withdrawal of consent, or deletion of your account or specific data. You do not need to reinstall the app. Our account deletion page explains what to send and what deletion means. Logging out and uninstalling do not delete server-side records or cancel a subscription.

We may ask for proportionate information to verify identity and authority before releasing or deleting records. Do not send a password. Under PIPEDA, access requests are generally answered within 30 days, subject to legally permitted extensions, and at no or minimal cost. We will explain any permitted extension, charge, or refusal and the applicable complaint options. Other applicable provincial deadlines and rights also apply.

Depending on applicable law, you may also request a portable copy of eligible computerized information, information about automated decisions and human review, or cessation of dissemination or de-indexing where the legal conditions are met. Subscription access is checked automatically against purchase and entitlement records; contact support if an access decision seems wrong.

8. Children and young learners

Roadity is intended for people aged 16 and older preparing for or practising lawful driving. It is not directed to children under 16. Users below the age of majority must involve a parent or legal guardian as described in the Terms. If we learn that we collected information from a child contrary to applicable consent requirements, we will take appropriate steps to delete it or obtain legally valid consent. A parent or guardian may contact our Privacy Officer about a child's information.

9. Canadian privacy rights and complaints

We handle requests under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including the private-sector privacy laws of Québec, Alberta, and British Columbia where they apply. Contact our Privacy Officer first so we can investigate and respond. You may also complain directly to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia, as appropriate. Nothing in our Terms limits these rights.

10. Changes to this policy

We will update the date on this page when the policy changes and provide additional notice of material changes through the app, website, or an available contact channel as appropriate. Where a change requires new consent, we will request it before carrying out that processing. A policy update does not itself authorize a new use of previously collected information.

Questions? support@roadity.com