Privacy Policy

Who we are

Corsio (“we”) is a local delivery service based in Ottawa, Ontario. Partner businesses publish batches of deliveries; independent couriers pick up a whole batch and deliver it in route order. We run the Corsio courier app, the Corsio Partner app, the partner portal on this website and an internal dispatch app.

Our privacy officer is responsible for this policy and for how we handle personal information. Contact: cango@cangodelivery.ca.

Information about couriers

Account and application

• Login: email address and password (the password is handled by Firebase Authentication; we never see it). The same login can also be used for Corsio Partner.
• Contact details: first and last name, phone number.
• Personal information: legal first and last name, date of birth and home address.
• Driver’s licence: number, issuing province, class, expiry date and photos of the front and back.
• Vehicle: make, model, year, colour, licence plate, registration province, and photos of the vehicle registration and the insurance document.
• Insurance: insurer, policy number, expiry date, your confirmation that the policy covers deliveries, and an optional endorsement document.
• Work eligibility: citizen, permanent resident or permit holder, a document showing it, the permit’s expiry date where it applies, and, for study permits, your acknowledgement of the permit’s work-hour limits.
• A profile photo, and any additional document we ask for.
• Background-check consent and the time you gave it, the time you submitted your application and your confirmation that it is accurate.
• Review results: your application status (pending, approved, action required, rejected, suspended or deactivated), the messages we send you, the step we ask you to update, decision times and our reviewers’ internal notes. Automatic checks of uploaded files (for example a file that is not the type it claims to be) are recorded with your review.
• Agreements: which versions of the Terms of Service, this Privacy Policy and the Pay terms you accepted, when, and from which app version.

Deliveries and pay

• Accepted deliveries: the business, pickup, route distance and duration, the pay agreed when you accepted, the order codes and city of each stop, and what happened at each stop (delivered, couldn’t deliver with the reason, returned to the business or not found at pickup) with times.
• Pickup checks: how many packages were scanned, typed in or missing, and whether the business confirmed the handoff code.
• Distances: when you confirm a pickup or a stop, the app sends your position once so we can record how far from the saved address the action happened. We keep only that distance and whether it was more than 300 m, never your position.
• Proof of delivery: the photo you take of each delivered package, and a photo of a failed attempt if you add one.
• Earnings: for each delivery, the route pay, any minimum-pay top-up, the time counted for the minimum-pay guarantee, the pay period, whether it has been paid and the payment reference.
• Delivery audit trail: who did what and when (accepted, picked up, delivered, released by Corsio), without customer details, locations or notes.
• If you live outside our service area and join the waitlist: your email, city, province and the first three characters of your postal code.

On your phone and from the app

• Stored on your phone: whether new offers are read aloud, the packages you scanned, your progress through each drop-off’s steps, and delivery actions or proof photos waiting to upload (deleted from the phone once they are sent). Your navigation app choice (Google Maps or Waze) is saved with your profile.
• Crash reports (Firebase Crashlytics): the device model, Android version, app version, what the app was doing when it failed and a random account identifier. Crash reports never contain customer details.

Courier location

Corsio uses your location only while you are online, from the moment you tap GO until you go offline: to show you on the map, to check your distance to a pickup when you accept a delivery, to record how far pickups and deliveries happen from the saved addresses, to check, on your phone, that you have reached each drop-off address, and to measure your progress along the route.

While you’re online, Corsio keeps sharing your location even if you switch apps or turn off the screen. A notification shows while this is on. It stops when you go offline.

We keep only your latest position (with its accuracy, heading and speed), updated about every 15 seconds while you are still and more often while you move. It is deleted when you go offline, and automatically within about 15 minutes if the app stops updating it. We do not keep a history of where you have been.

Corsio’s operations team can see your first name, latest position, speed and heading on a live map while you are online, and during a delivery its route and stops, to support you, follow deliveries and keep everyone safe. This live map keeps no history: the line it draws behind you exists only on that Corsio screen while it is open.

Your profile photo is shown to you in the app’s menu, to Corsio’s team (with your deliveries and on the live map) and to a business while you deliver its batch. Customers never see it.

Businesses never see your location. A customer sees it only on their tracking page, and only while you have their package and they are 5 stops away or closer: your first name and your latest position, refreshed about every minute. A position more than 10 minutes old is not shown.

Information about partner businesses

• Login and contact: email, password (handled by Firebase Authentication), the contact person’s name and phone number.
• Business information: name, type, phone, address and pickup location, pickup contact and instructions, operating hours, logo and the verification documents you upload.
• Orders: the deliveries you publish, the labels and PDFs made from them, publishing and usage counts, and the status of each delivery.
• If you sign up on this website: your early-access request (email, business name, status and request time).

Information about our partners’ customers

When a business publishes a delivery, it gives us its customer’s name, phone number, delivery address, unit and delivery instructions. We check the address with Google Maps to find the route. While the delivery happens we add its status and times, the proof of delivery (a photo of the package where it was left), and, if it could not be delivered, the reason, the courier’s note and a photo of the attempt if the courier adds one.

In the app, the courier who accepted the batch sees the customer’s first name, phone number, address, unit and instructions, and only while that delivery is active. The app never sends the customer’s last name to the courier, and the courier’s copy of these details is deleted when the delivery is completed or released. The printed label that the business attaches to each package also shows the customer’s full name, phone number, address, unit and instructions. Its QR code holds only the six-digit order code.

Package tracking

A business can send its customer a tracking link: corsio.ca/tracking/ followed by a tracking number made of the batch code and the order code. Anyone who opens the link sees:

• the business’s name and pickup address;
• the street address and city of the delivery, its spot on a map, and the driving route from the business to it. The page never shows the customer’s name, phone number, unit or delivery instructions;
• the delivery’s status and times, how many stops the courier has before it, and an estimated delivery window;
• the courier’s first name once a courier accepts the batch and, only while the courier has the package and it is 5 stops away or closer, the courier’s location.

The tracking number works like a key: anyone who has it can open the page, so it should be shared only with the person receiving the delivery. Tracking numbers stop working 180 days after the order is published. To stop people from guessing tracking numbers, our servers count the lookups from each IP address for a few minutes, in memory only.

Why we use it

• To deliver: publish batches, offer them to nearby couriers, guide pickups and deliveries, and show businesses and their customers the progress.
• To keep deliveries safe and lawful: verify each courier’s identity, licence, insurance and right to work, check that documents have not expired, and prevent fraud.
• To pay couriers correctly, including the minimum-pay guarantee, and to keep the work and pay records that Ontario’s Digital Platform Workers’ Rights Act and tax rules require.
• To support you, handle disputes and investigate incidents.
• To keep the apps working (crash reports) and to meet our legal obligations.

We do not sell personal information, we do not use it for advertising, and this website has no analytics or advertising cookies.

Counting visits to this website

To know how many people visit, each page of this website tells our server, without cookies: which page it is (a tracking page counts only as “tracking”, never with its number), whether it is the first page of your visit, the name of the site that linked to you (for example google.com) and any campaign tag in the link. Our server adds these to daily totals: visits per day, views per page, visits from each kind of source, and visits from phones and from computers (worked out from the browser’s description, which is then discarded). It keeps nothing else: not your IP address, your browser or the full link. A note in your browser’s session storage, deleted when you close the tab, tells the first page of a visit from the next ones; it is never sent to us. Your IP address is used for a moment to stop floods of fake visits and is not stored.

Who sees what

• Businesses see about their courier: first name, profile photo, vehicle colour, make and model, and licence plate from the moment the courier accepts until the delivery is completed or released, so they hand the packages to the right person. They also see the pickup time and each delivery’s status and proof. After the delivery, only the courier’s first name stays on the batch.
• Couriers see: the business’s name, pickup address, instructions and pickup contact, and the customer details described above, only for deliveries they accepted.
• Anyone with a tracking link (normally the customer) sees what is listed under Package tracking: never the customer’s name, phone number, unit or instructions, and the courier’s location only from 5 stops away.
• Corsio staff see what they need to review applications, support couriers and businesses, and pay couriers.
• We may disclose information when the law requires it, or to protect someone’s safety.

Service providers and where data is stored

• Google Firebase and Google Cloud (database, file storage, server functions, sign-in): our database and server functions are in Google Cloud’s Montréal region, Canada (northamerica-northeast1). Uploaded files are stored in Google Cloud’s South Carolina region in the United States (us-east1): couriers’ verification documents and photos (driver’s licence, vehicle registration, insurance, work eligibility, profile photo), delivery proof photos, and businesses’ documents, logos and delivery label PDFs. The server function that checks newly uploaded files also runs there. Firebase Authentication may process login data outside Canada.
• Google Maps Platform: delivery addresses and route points are sent to Google to check addresses and compute routes, including the route shown on a tracking page. The tracking and Check pricing pages and the portal’s address suggestions also load Google Maps in your browser, so Google receives your IP address and the addresses you type there. Google may process them outside Canada.
• Firebase Crashlytics: crash reports from the apps, processed by Google, possibly outside Canada.
• Google Play delivers the apps and their updates.
• Google Fonts: this website loads its typeface (Inter) from Google Fonts, so your browser connects to Google, which receives your IP address, when it opens a page. Google may process it outside Canada.

When information is processed outside Canada, it is subject to the laws of that country, and authorities there may be able to access it.

How long we keep it

We are finishing a full retention schedule (for example for rejected applications and inactive accounts) and will publish it here before launch.

How we protect it

Access is limited by strict security rules: couriers and businesses can read only their own information, customer details reach a courier only for an active delivery, and many records can be written only by our servers. Proof photos and documents can’t be downloaded with a public link. Data is encrypted in transit and at rest by Google. If a breach creates a real risk of significant harm, we will tell the people affected and the Privacy Commissioner of Canada.

Your rights

You can ask to see the personal information we hold about you, to correct it, or to withdraw your consent (which may mean we can no longer offer you the service). Email cango@cangodelivery.ca from your account’s email address; we answer within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Deleting your account

Couriers can delete their account in the Corsio app (Account, then Delete account) or by email. See Delete your Corsio account for what is deleted and what we must keep.

Changes and contact

When we change this policy, we give it a new version and update the date above, and the Corsio app asks couriers to accept the new version. Questions: cango@cangodelivery.ca.