Last updated: July 18, 2026
Introduction
At Vayo, protecting your personal information is paramount. This policy explains how we collect, use, disclose, and safeguard your data, in accordance with Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25).
1. Privacy Officer (Responsible for the Protection of Personal Information — RPRP)
The Privacy Officer ensures compliance with this policy. For any questions, access requests, or complaints regarding your data, please contact: Privacy Officer, privacy@vayotransfer.com.
2. Personal information we collect
We limit data collection to what is strictly necessary for the operation of the service: Identification data: name, email address, phone number (collected via email authentication, phone number with reCAPTCHA, Google account, or Apple account). Geolocation data: pickup and dropoff addresses and real-time GPS position. This collection requires your express consent on your device. For drivers, background location may be required even when the app is not in use. Financial data: transaction history. Secure processing is handled by Stripe; Vayo does not store any credit card numbers on its servers. Media data: camera and photo library access for drivers (uploading permits, selfies, vehicle documents, no-show proof). Technical and communications data: device tokens for sending notifications (Firebase Cloud Messaging) and correspondence with customer support.
3. How we use your information
Your data is used exclusively to: manage your user account and secure access; calculate routes and the guaranteed fixed fare for your trips; connect passengers with drivers; process payments and issue transactional receipts; ensure safety (trip tracking) and comply with legal obligations (CTQ records).
3.1. Payments
Your payments are processed by our PCI-DSS Level 1 certified payment processor, Stripe, Inc. When you pay for a trip, your card details (number, expiration date, security code) are entered into a Stripe-provided component and sent directly to Stripe without passing through our servers. ‘Vayo never stores your full card number or security code.’ We only retain, for receipt, support and billing purposes: your card brand (e.g. ‘VISA’), the last four digits, and an opaque identifier provided by Stripe. If you choose to by checking the designated box at checkout, your card is stored with Stripe so you don’t have to re-enter it on future trips. This storage is optional and requires your explicit consent. You may view and delete your saved cards at any time from the ‘Payment methods’ section of your profile in the app. When you delete your Vayo account, all saved cards are removed from Stripe and your Stripe customer identifier is deleted, in accordance with your right to erasure (section 28.1 of Quebec’s Act respecting the protection of personal information in the private sector, ‘Law 25’). For any questions related to your payment data, you may contact our Privacy Officer at privacy@vayotransfer.com.
4. Sharing information with third parties
Vayo never sells your personal information. We share it only with technology service providers bound by strict confidentiality obligations: Google Cloud / Firebase: secure database hosting (Firestore) and authentication management. Stripe: transaction processing. Google Maps Platform and Routes API: route calculation and map display. Brevo: secure transactional email delivery. Your data may be hosted on cloud servers located outside the province of Quebec by these providers.
5. Cookies and analytics trackers
Our platform uses basic cookies for website operation. The use of advanced trackers such as Google Analytics is strictly conditional on your prior consent. These tools are only activated if you click ‘Accept’ in our consent banner. You may revoke this choice at any time.
6. Retention, security, and your rights
Your data is protected by strict security rules limiting access. Retention periods are proportionate to the purposes: trip location data is retained for 30 days; account data and trip information (addresses, phone numbers) are retained for 6 years to meet CTQ and tax obligations; technical error logs are purged after 90 days. Under Law 25, you have the following rights: right of access and rectification: consult or correct your data; right to erasure: request permanent deletion of your account and data from our databases; right to withdraw consent: withdraw your consent to geolocation or trackers. To exercise these rights, contact our Privacy Officer. We will respond within a maximum of 30 days. If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca.