Privacy

This notice applies when you:

• Visit our website at towkey.com, or any website of ours that links to this notice.
• Download and use our mobile application (TowKey), or any other application of ours that links to this notice.
• Use TowKey. TowKey is a B2B SaaS platform for towing companies across Canada and the US, offering dispatch, fleet management and AI-powered business tools in a single product. Unlike competitors that bolt on third-party AI add-ons or gate essential features (like pre-trip inspections) behind higher-priced tiers, TowKey builds AI directly into the core platform at every price point. Its capabilities include real-time dispatch with live GPS tracking and Mapbox-powered maps; job and fleet management (job creation, assignment, driver coordination, run sheets and vehicle inspections); invoicing with PDF generation and automated delivery; AI voice-to-invoice, where drivers speak and AI fills in structured job and invoice fields; AI phone answering and dispatch, where calls are answered, transcribed and turned into pending jobs with automatic customer notification; automated customer communication by SMS, Google review requests and review-response drafting; driver and admin mobile apps for iOS and Android with Face ID login and real-time chat and notifications; and a multi-tenant architecture using row-level security, two-factor authentication and proposal-gated AI actions, so every consequential AI action requires human confirmation before it executes.
• Engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us at info@towkey.com.

Summary of key points

This summary provides key points from the notice. Use the list above to jump to the section you are looking for.

• What personal information do we process? When you visit, use or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use.
• Do we process sensitive personal information? Yes. Some information may be considered special or sensitive in certain jurisdictions. We process it when necessary with your consent or as otherwise permitted by law.
• Do we collect information from third parties? We do not collect any information from third parties.
• How do we process your information? To provide, improve and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.
• How do we keep your information safe? We have organisational and technical processes and procedures in place to protect it. No electronic transmission or storage technology can be guaranteed to be entirely secure.
• What are your rights? Depending on where you are located, the applicable privacy law may give you certain rights over your personal information.
• How do you exercise them? Email your request to info@towkey.com. We will consider and act upon it in accordance with applicable data protection laws.

1. What information do we collect?

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.

Personal information provided by you. What we collect depends on the context of your interactions with us, the choices you make, and the products and features you use. It may include: names, phone numbers, email addresses, usernames, passwords, billing addresses, debit or credit card numbers, job titles, contact preferences, contact or authentication data, mailing addresses, invoices, vehicle information, employee information, company name, tax information, towing licence, storage number.

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process financial data and precise geolocation.

Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and its security code. All payment data is handled and stored by Stripe; see Stripe’s privacy policy.

Social media login data. We may provide the option to register using an existing social media account. If you choose to register that way, we will collect certain profile information about you from that provider, as described in “How do we handle your social logins?” below.

Application data. If you use our applications, we may also collect the following if you grant access or permission:

• Geolocation information. We may request access to track location-based information from your mobile device, either continuously or while you are using the application, to provide location-based services. You can change our access in your device settings.
• Mobile device access. We may request access to certain features of your device, including the microphone, camera, SMS messages, social media accounts and other features. You can change our access in your device settings.
• Push notifications. We may request to send you push notifications about your account or certain features. You can turn these off in your device settings.

This information is primarily needed to maintain the security and operation of our applications, for troubleshooting, and for internal analytics and reporting.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to it.

Information automatically collected

In short: some information, such as your Internet Protocol (IP) address and browser and device characteristics, is collected automatically when you visit our Services.

This information does not reveal your specific identity but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. It is primarily needed to maintain security and operation, and for internal analytics and reporting.

Like many businesses, we also collect information through cookies and similar technologies. What we collect includes:

• Log and usage data. Service-related, diagnostic, usage and performance information our servers automatically collect and record in log files. This may include your IP address, device information, browser type and settings, information about your activity in the Services (date and time stamps, pages and files viewed, searches, and which features you use), and device event information such as system activity, error reports and hardware settings.
• Device data. Information about the computer, phone, tablet or other device you use to access the Services, which may include your IP address or proxy server, device and application identification numbers, location, browser type, hardware model, internet service provider or mobile carrier, operating system and system configuration information.
• Location data. Information about your device’s location, which can be precise or imprecise, depending on the type and settings of your device. You can opt out by refusing access or disabling the Location setting on your device, though you may then be unable to use certain aspects of the Services.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. How do we process your information?

In short: we process your information to provide, improve and administer our Services, to communicate with you, for security and fraud prevention, and to comply with law. We may also process it for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and manage user accounts, so you can create and log in to your account and keep it in working order.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries and offer support, and to solve issues with the requested service.
• To send administrative information, such as details about our products and services and changes to our terms and policies.
• To fulfil and manage your orders, payments, returns and exchanges made through the Services.
• To enable user-to-user communications, if you use any of our offerings that allow it.
• To request feedback, and to contact you about your use of our Services.
• To send you marketing and promotional communications, in accordance with your preferences. You can opt out at any time; see “What are your privacy rights?” below.
• To post testimonials, which may contain personal information.
• To protect our Services, including fraud monitoring and prevention.
• To evaluate and improve our Services, products, marketing and your experience.
• To identify usage trends, and to determine the effectiveness of our marketing and promotional campaigns.
• To comply with our legal obligations, respond to legal requests, and exercise, establish or defend our legal rights.

3. What legal bases do we rely on?

In short: we only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (express consent) to use it for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases we may be legally permitted under applicable law to process your information without your consent, including:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way.
• For investigations and fraud detection and prevention.
• For business transactions provided certain conditions are met.
• If it is contained in a witness statement and the collection is necessary to assess, process or settle an insurance claim.
• For identifying injured, ill or deceased persons and communicating with next of kin.
• If we have reasonable grounds to believe an individual has been, is, or may be the victim of financial abuse.
• If it is reasonable to expect that collection and use with consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records.
• If it was produced by an individual in the course of their employment, business or profession, and the collection is consistent with the purposes for which the information was produced.
• If the collection is solely for journalistic, artistic or literary purposes.
• If the information is publicly available and is specified by the regulations.
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

4. When and with whom do we share your personal information?

In short: we may share information in the specific situations described in this section and with the third parties named in it.

We may need to share your personal information in the following situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business to another company.
• When we use Google Maps Platform APIs. We may share your information with certain Google Maps Platform APIs, such as the Maps API and Places API. Google Maps uses GPS, Wi-Fi and cell towers to estimate your location. GPS is accurate to about 20 metres, while Wi-Fi and cell towers help improve accuracy when GPS signals are weak, such as indoors. This data helps Google Maps provide directions, but it is not always perfectly precise. We obtain and store your location on your device (cache). You may revoke your consent at any time by contacting us at the details at the end of this document.
• Other users. When you share personal information (for example by posting comments, contributions or other content to the Services) or otherwise interact with public areas of the Services, that information may be viewed by all users and may be made publicly available outside the Services in perpetuity. Other users will be able to view descriptions of your activity, communicate with you within our Services, and view your profile.

5. Do we use cookies and other tracking technologies?

In short: we may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies, such as web beacons and pixels, to gather information when you interact with our Services. Some of these help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements or to tailor advertisements to your interests. Those third parties use their technology to provide advertising about products and services tailored to your interests, which may appear either on our Services or on other websites.

To the extent these technologies are deemed a sale or sharing, which includes targeted advertising as defined under applicable law, you can opt out by submitting a request as described under “Do United States residents have specific privacy rights?” below.

Google Analytics

We may share your information with Google Analytics to track and analyse the use of the Services. To opt out of being tracked by Google Analytics, visit tools.google.com/dlpage/gaoptout. For more information on Google’s privacy practices, see the Google Privacy and Terms page.

6. Do we offer artificial intelligence-based products?

In short: we offer products, features and tools powered by artificial intelligence, machine learning and similar technologies.

As part of our Services we offer products, features and tools powered by artificial intelligence, machine learning and similar technologies (collectively, AI Products). These tools are designed to enhance your experience. The terms in this notice govern your use of the AI Products within our Services.

Use of AI technologies. We provide the AI Products through third-party service providers (AI Service Providers), including Anthropic. As outlined in this notice, your input, output and personal information will be shared with and processed by these providers to enable your use of our AI Products, for the purposes outlined in “When and with whom do we share your personal information?” You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products are designed for the following functions: AI applications, text analysis, AI document generation, AI bots, AI search and AI insights.

How we process your data using AI. All personal information processed using our AI Products is handled in line with this notice and our agreements with third parties.

7. How do we handle your social logins?

In short: if you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer the ability to register and log in using your third-party social media account details. Where you choose to do this, we will receive certain profile information about you from that provider. It varies by provider but often includes your name, email address, friends list and profile picture, as well as other information you choose to make public on that platform.

We will use the information we receive only for the purposes described in this notice or otherwise made clear to you on the relevant Services. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend you review their privacy notice to understand how they collect, use and share your personal information, and how you can set your privacy preferences on their sites and apps.

8. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfil the purposes outlined in this notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law, such as tax, accounting or other legal requirements. No purpose in this notice will require us to keep your personal information for longer than twenty four (24) months past the termination of the user’s account.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. If that is not possible, for example because it has been stored in backup archives, we will securely store it and isolate it from any further processing until deletion is possible.

9. How do we keep your information safe?

In short: we aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts, no electronic transmission over the internet or information storage technology can be guaranteed to be entirely secure, so we cannot promise or guarantee that hackers, cybercriminals or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal or modify your information. Although we will do our best to protect your personal information, transmission to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. Do we collect information from minors?

In short: we do not knowingly collect data from, or market to, children under 18 years of age or the equivalent age specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services you represent that you are at least 18, or the equivalent age specified by law in your jurisdiction, or that you are the parent or guardian of such a minor and consent to that minor dependent’s use of the Services. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under 18, contact us at info@towkey.com.

11. What are your privacy rights?

In short: depending on your state of residence in the US, or in some regions such as Canada, you have rights that allow you greater access to and control over your personal information. You may review, change or terminate your account at any time, depending on your country, province or state of residence.

In some regions, such as Canada, you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances you may also have the right to object to the processing of your personal information. You can make such a request by contacting us using the details in “How can you contact us about this notice?” below.

We will consider and act upon any request in accordance with applicable data protection laws.

Withdrawing your consent. If we are relying on your consent to process your personal information, which may be express or implied depending on the applicable law, you have the right to withdraw that consent at any time by contacting us using the details in “How can you contact us about this notice?” below. Withdrawing consent will not affect the lawfulness of processing carried out before its withdrawal, nor, where applicable law allows, processing conducted in reliance on lawful grounds other than consent.

Opting out of marketing and promotional communications. You can unsubscribe at any time by replying STOP or UNSUBSCRIBE to the SMS messages we send, or by contacting us using the details in “How can you contact us about this notice?” below. You will then be removed from the marketing lists. We may still communicate with you for service-related reasons necessary to the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with third parties.

Account information

If you would like to review or change the information in your account, or terminate your account, you can log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. We may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms or comply with applicable legal requirements.

Cookies and similar technologies. Most web browsers are set to accept cookies by default. If you prefer, you can usually set your browser to remove and reject cookies. If you choose to do so, it could affect certain features or services of our Services.

If you have questions or comments about your privacy rights, email us at info@towkey.com.

12. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems and applications include a Do-Not-Track (DNT) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in future, we will inform you about that practice in a revised version of this notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there is currently no industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.

13. Do United States residents have specific privacy rights?

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve (12) months, with illustrative examples of each. For a comprehensive inventory, see “What information do we collect?” above.

We only collect sensitive personal information as defined by applicable privacy laws, for the purposes allowed by law or with your consent. Sensitive personal information may be used, or disclosed to a service provider or contractor, for additional specified purposes. You may have the right to limit its use or disclosure. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

We may also collect other personal information outside these categories where you interact with us in person, online, or by phone or mail, in the context of receiving help through our customer support channels, participating in customer surveys or contests, and facilitating the delivery of our Services and responding to your inquiries.

We will use and retain the collected personal information as needed to provide the Services, and for sensitive personal information, for as long as the user has an account with us.

How we use and share personal information

We may disclose your personal information to our service providers pursuant to a written contract between us and each service provider. Learn more in “When and with whom do we share your personal information?” above.

We may use your personal information for our own business purposes, such as undertaking internal research for technological development and demonstration. This is not considered selling your personal information.

We have not disclosed, sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information belonging to website visitors, users or other consumers in the future.

Your rights

You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. They include:

• Right to know whether or not we are processing your personal data.
• Right to access your personal data.
• Right to correct inaccuracies in your personal data.
• Right to request the deletion of your personal data.
• Right to obtain a copy of the personal data you previously shared with us.
• Right to non-discrimination for exercising your rights.
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Depending on the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (Minnesota).
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (California, Delaware, Maryland).
• Right to obtain a list of specific third parties to which we have disclosed personal data (Minnesota, Oregon).
• Right to obtain a list of third parties to which we have sold personal data (Connecticut).
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (Connecticut, Minnesota).
• Right to limit use and disclosure of sensitive personal data (California).
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (Florida).

How to exercise your rights

To exercise these rights, email your request to info@towkey.com, or write to us at the postal address in section 15. Tell us which right you are exercising and enough about your account or your dealings with us that we can find you.

Under certain US state data protection laws you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof of valid authorisation to act on your behalf in accordance with applicable laws.

Request verification

Upon receiving your request we will need to verify your identity, to determine that you are the same person about whom we have information in our system. We will only use personal information provided in your request to verify your identity or authority to make it. If we cannot verify your identity from the information already maintained by us, we may ask you to provide additional information for verification and for security or fraud-prevention purposes.

If you submit the request through an authorised agent, we may need to collect additional information to verify your identity before processing it, and the agent will need to provide written and signed permission from you.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at info@towkey.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

14. Do we make updates to this notice?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this notice from time to time. The updated version will be indicated by a revised date at the top of this page. If we make material changes we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this notice frequently to be informed of how we are protecting your information.

15. How can you contact us about this notice?

If you have questions or comments about this notice, email us at info@towkey.com or contact us by post at:

TowKey Inc.
10-1338 Wellington Street West
Ottawa, Ontario K1Y 3B7
Canada

16. How can you review, update or delete the data we collect from you?

Based on the applicable laws of your country, or your state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law. To request to review, update or delete your personal information, email info@towkey.com and say what you would like us to do.