Privacy Policy

Draft for legal review · Last updated: August 17, 2026

This Privacy Policy explains how Sevens Square by Sevensync Inc. ("Sevensync", "we", or "us"), a federally incorporated Canadian company with its registered address at 3779 Ellesmere Road, Toronto, ON M1C 1H8, handles personal information when you use our website, portal, APIs, and related services.

Who is responsible for your data

Sevensync is the data controller for website visitors, account administration, billing contacts, and our direct business communications. When a customer uses Sevens Square to manage drivers, employees, customers, vehicles, devices, routes, or deliveries, that customer generally determines why and how that operational data is processed and acts as controller; Sevensync processes it on the customer's instructions as a processor. Contact the relevant customer organization first for rights requests concerning data it entered into the platform.

Privacy Officer

Our Privacy Officer is Rehnuma Mahjabeen. Contact r.mahjabeen@sevenssolution.com for privacy questions, complaints, or rights requests.

Personal information we process

• Account and organization information — name, work email, company, role, authentication records, MFA status, and organization memberships.
• Driver and workforce information — names, contact details, licence information, assignments, safety events, and performance information entered by a customer.
• Fleet, delivery, and location information — vehicle and device identifiers, telemetry, routes, precise location, customer names, destination addresses, fuel transactions, and operational events.
• Billing information — subscription status, billing identifiers, invoices, and payment information processed by our payment provider.
• Security and usage information — IP address, audit events, API activity, device and browser information, error logs, and interactions with portal features.
• Communications — support requests, demo inquiries, email correspondence, and AI Copilot prompts that users choose to submit.
• Cookie and advertising information — optional Google Ads measurement identifiers only where consent is required and has been granted, as described in our Cookie Policy.

Purposes and legal bases

• Contract — creating accounts, providing the platform, processing subscriptions, support, and customer-requested operations.
• Legitimate interests — securing the service, preventing fraud, maintaining audit trails, diagnosing faults, and improving reliability, balanced against individual rights.
• Legal obligations — tax, accounting, sanctions, regulatory, and lawful disclosure requirements.
• Consent — optional advertising measurement and any direct marketing that legally requires consent. Consent can be withdrawn without affecting prior lawful processing.

Service providers and sharing

We do not sell personal information. Depending on the features a customer enables, we may use:

• Hosting and infrastructure providers to run and secure the service.
• Stripe for subscription billing and payment processing.
• Amazon Web Services, including SES for infrastructure and transactional email.
• Google for Maps, route optimization, and consent-based advertising measurement.
• OpenAI to process AI Copilot requests when that feature is enabled.
• WEX and other customer-selected integrations to synchronize fuel and fleet information.

We may also disclose information to professional advisers, authorities where legally required, or in connection with a corporate transaction subject to appropriate safeguards. Customers should avoid submitting unnecessary personal or sensitive information in AI prompts.

International transfers

Sevensync is based in Canada and providers may process information in Canada, the United States, or other countries. Where GDPR transfer restrictions apply, we use an adequacy decision where available or contractual and organizational safeguards such as the European Commission's Standard Contractual Clauses. Contact the Privacy Officer for information about applicable safeguards.

Retention

• Account information is retained while an account is active. A verified deletion request is scheduled for deletion after a 30-day cancellation period, subject to legal obligations and customer-controller instructions.
• A one-way fingerprint of each normalized email that redeems a free trial is retained to enforce the one-trial-per-email rule and prevent promotion abuse. It is not used to send email.
• Security audit logs containing user and IP identifiers are retained for 30 days.
• Raw telemetry retention depends on the customer's plan and configured service, generally from 30 days to five years; a customer must select a justified period for any longer retention.
• Expired invitation and MFA challenge records are automatically removed.
• Billing, tax, dispute, and fraud-prevention records may be retained for the period required by applicable law.
• Direct inquiries are retained only as long as needed to respond and manage the resulting business relationship. The customer's email system may apply its own documented retention schedule.

Backup retention and legal-hold procedures must be confirmed before this draft is approved for publication.

Your rights

Depending on your location and the circumstances, you may have rights to access, correct, export, erase, restrict, or object to processing, and to withdraw consent. Portal users can export their personal account data and schedule account deletion under Settings. Requests can also be sent to the Privacy Officer. We may verify identity and may retain or restrict certain information where law or another person's rights require it.

If your information is controlled by a Sevens Square customer, we will assist that customer with a verified request. You may lodge a complaint with your local data protection authority. EU residents can find their authority through the European Data Protection Board, and UK residents may contact the Information Commissioner's Office.

Automated processing

The platform may produce route suggestions, safety scores, alerts, or AI-generated insights. These tools are intended to support human decisions. Sevensync does not use them to make solely automated decisions on its own behalf that produce legal or similarly significant effects about individuals.

Security

We use tenant isolation, access controls, mandatory MFA, encryption or hashing for credentials and secrets, monitoring, and retention controls. No system is completely secure; customers are responsible for access permissions, lawful data collection, and secure use of exported data.

Contact

Privacy requests: r.mahjabeen@sevenssolution.com
General inquiries: connect@sevenssolution.com