Privacy policy

Solutions PZO inc. ("we", "our", "PZO") operates a mobile app and a web dashboard for real-time positioning, accessible from the pzo-fleet.com website and the PZO mobile app. This privacy policy describes the types of personal information we collect, how we use, share, and protect it.

By using our services, you agree to the practices described in this policy. We comply with Quebec's Act respecting the protection of personal information in the private sector (Law 25) as well as applicable Canadian federal personal information protection laws.

2.1 Information provided by the user

• Email address
• First and last name
• Company or organization name
• Phone number (optional)
• Password (stored as an encrypted hash)
• Information from the website contact form (name, email, company, message and, if you provide them, your need, team size and interest)
• Messages sent with the "A problem or a suggestion for improvement?" button in Settings: your text and, if you attach one, the screenshot (we remove the location and other information hidden in the image), along with the app version and phone model, or the browser on the dashboard
• The PDF documents, maps and layers you import, and the points of interest you create, with their photos

2.2 Information collected automatically

• GPS positions: geographic coordinates (latitude, longitude), heading, speed, and accuracy. They are recorded only between the moment you tap "Start" in the mobile app and the moment you tap "Stop". Before "Start", while the map is open, the app sends your position to the server to show nearby vehicles and reports, without recording it. During tracking, these positions may continue to be collected in the background, with the screen locked or the app not in use. This data is used to (a) share your real-time location with authorized teammates and managers, (b) play voice proximity alerts about nearby vehicles to help driver vigilance, (c) compute your trip statistics, and (d) feed the anonymized "trail heat map" aggregate (Community layer included for everyone, Organization layer with the Pro plan). No data is shared with third parties for advertising purposes. You can stop the collection at any time by tapping "Stop" in the app, or by revoking the location permission in your system settings
• Vehicle data: vehicle identifier, type, color, load status
• Session data: navigation duration, distance traveled, connection timestamps
• Incident reports: incident type, location, photos (if provided by the user)
• Notification token: if you enable notifications, a push notification identifier (provided by Apple or Google depending on the device) so we can send you alerts

We use the collected information for the following purposes:

• Providing the real-time GPS tracking service for vehicles and field teams
• Computing and broadcasting proximity alerts between vehicles to help driver vigilance on roads in remote areas
• Enabling fleet management (administrator dashboard)
• Generating distance and driving time statistics
• Enabling the reporting and broadcasting of incidents on the road network
• Managing your account and your subscription
• Communicating with you about your account or the service (transactional emails)
• Improving and securing our services
• Road heat map: we compute an aggregate of the number of passages per road segment in the last 24 to 48 hours. This aggregate exists in two layers: (a) "Organization" layer, visible only to members of your paid organization — it reflects the passages of the vehicles you already manage through the "Trip History" feature, exposing no new data; (b) "Community" layer, visible to all users — this one applies k-anonymity (K=3), meaning a segment only appears if it has been crossed by at least 3 distinct vehicles in the window, making it impossible to identify an individual user. In both cases, what is displayed shows neither your identifier nor the time of your passage. To count distinct vehicles, the server internally keeps your vehicle's identifier with each passage: 48 hours for the passage map, and 60 days, to the day, for passability. This identifier is never shown. The individual data used for this computation is your usual GPS positions (already covered by purpose 1). The aggregated buckets are automatically deleted after 48 hours. We also keep counters per road and per month: the number of passages and of different vehicles, by vehicle type and by whether or not it belongs to an organization. These counters contain neither your identifier, nor your name, nor the time of your passage. After 60 days, we keep them only for roads used by at least 3 different vehicles in the month. If you revoke access to a manager (multi-organization subcontracting), the passages you contributed to their heat map are purged immediately on our side.
• Usual road speeds: from the positions already recorded during your trips, we calculate the usual speed of each road segment (based on logging trucks and pickups) and of each vehicle type. They are used to estimate, during a network outage, where a vehicle driving toward you is. The result contains neither your name nor your vehicle's identifier.
• Speed report: if your company has chosen its thresholds, its managers see your speeding events (at least two readings in a row above the road's threshold), counted over 12 months, and the gap between your truck and other trucks on the same roads, never named. They can receive them every Monday by email and export them.
• Crossings: PZO keeps the crossings of company vehicles to study crossing safety. No one sees them for now: no page or score is made from them. Your positions are also used to detect these crossings, without you being named.

We do not sell, rent, or exchange your personal information with third parties for commercial or advertising purposes.

Your information may be shared in the following cases:

• Within your organization: administrators and fleet managers of your organization can see the positions and vehicle data of their organization's members
• Organizations you authorize: managers of an organization you have given access to (subcontracting) see your position in real time, until you withdraw that access
• Other PZO users: within 17 km, other users on the road see your vehicle on the app map; farther away, only on the PZO website, and only a truck, a grader, a sander, a groomer or a free account driving on a forest road (or, for a groomer or a free account, on an official trail), never a parked vehicle or one stopped for more than 15 minutes; a free account appears there without a name; on the public map, also a company's pickup, ATV, side-by-side, snowmobile or RV, on a forest road or an official trail, anonymously (never heavy equipment). Free accounts never see your name. Voice alerts tell nearby drivers from any company your vehicle's type, whether it is loaded, and whether it is going up or down; Pro accounts may also hear your name if you entered one
• Payment provider: Stripe Inc. processes credit card payments. We do not store any credit card data on our servers
• Mapping: Mapbox Inc. provides the map tiles. Mapbox receives the displayed map area (which follows your vehicle), your IP address and an anonymous Mapbox identifier, without your name or your account
• Technical error reporting: we use Sentry to automatically receive application crash and error reports. Reports include a technical trace (file, line, error message) and may contain your internal identifier, your IP address and, on the dashboard, your email address. On the website, these reports are only sent with your consent. We send them neither passwords nor photos. This telemetry is limited to errors (no individual performance measurement). Sentry operates from the European Union.
• Push notifications: mobile app notifications are delivered through Apple (APNs) on iOS and Firebase Cloud Messaging (Google) on Android. A notification token and the text of the notification (for example the name of the person sharing a document with you, or the distance of a reported fire) are sent to these services to deliver alerts; no other personal data is shared. These tokens may be processed in the United States.
• Amazon Web Services (Canada): voice synthesis of the vehicle name you enter, and backup copies of our data, hosted in Canada
• Google Workspace: receiving contact form requests and sending our emails
• Government of Quebec: when you display aerial imagery in the app, the images come directly from its server, which receives your IP address and the area displayed
• Legal requirements: we may disclose information when required by law, a court order, or a legitimate request from a governmental authority

Transfers outside Quebec related to these services: Stripe and Mapbox process part of your data in the United States, as does Firebase (push notifications, Google). These transfers are necessary to perform the service you accepted (payment, mapping, notifications). Sentry operates from the European Union. See section 10 below for the terms of these transfers under article 17 of Law 25.

Your data is stored on a virtual private server at Hébergement OVH Inc. (OVHcloud), in the Beauharnois (Quebec, Canada) datacenter. All of your application data (positions, reports, layers, accounts) therefore stays on Canadian territory. The server is protected by industry-standard security measures:

• SSL/TLS encryption for all communications (HTTPS)
• Passwords hashed with the bcrypt algorithm
• JWT authentication with expiration
• Server access by SSH key
• Daily automatic database backups
• Rate limiting for protection against attacks

The database is a PostgreSQL instance. Uploaded files (photos, PDF maps, layers) are stored on the same server.

• GPS positions: raw positions (the point recorded at each moment) are deleted automatically after 30 days. PZO does keep, as long as your vehicle exists in PZO, the simplified track of your trips (used to improve alert accuracy), the start and end point of each trip, the place where you stopped navigation, and a summary of each day: the distance travelled, the time moving and stopped, the time of the first and last position, and the number of positions received. This summary is used for the dashboard statistics. These are erased with your vehicle or your account. Only a road PZO learned from your trips stays in its maps, without your name or your vehicle. For vehicles of a subscribed company, PZO also keeps for 12 months, per vehicle and per day, the time spent in each speed range, the maximum speed and the gap with other trucks on the same roads, as well as each speeding event (date, time, speed, threshold, place). This data is deleted with the vehicle or the account. For vehicles of a subscribed company, PZO also keeps for 12 months each crossing with another PZO vehicle: the date, time, place, distance, your speed at the crossing and 25 seconds before, the type of road, and whether you were loaded and going up or down. The other vehicle is never named. This data is deleted with the vehicle or the account.
• Loaded / empty status: each change is kept with the vehicle's position at that moment for 6 months, then deleted automatically (or sooner, with your vehicle or your account)
• Account data: kept as long as your account exists. A free account without sign-up is erased 60 days after you sign out, or no later than 13 months after you last used the app. When an account is deleted, its data is erased immediately; automatic backup copies are erased no later than 35 days after that
• Incident reports: kept for 2 months, then deleted automatically
• Shared documents (PDF): kept while your organization is active. You can delete them at any time from the dashboard. When an account or organization is closed, the associated documents are deleted along with the other account data.
• Points of interest and layers: kept while your account or organization exists; you can delete them individually at any time, and they are then erased immediately. A point of interest that reaches its expiry is not erased right away: a lightweight record (name, location, author, photo) is kept for 12 months in a history reserved for the organization's managers; the photo is deleted after 6 months, then the record at 12 months.
• Technical logs and error reports: server logs are used for technical diagnosis; they do not keep the history of your positions. The server deletes them automatically, with no fixed duration, oldest first. Error reports sent to Sentry, our error-tracking tool hosted in the European Union, are kept for Sentry's own retention period.
• Statistics: aggregated and anonymized data may be kept beyond the periods listed
• Recent-passage map and road passability: the passages recorded for the recently used roads map (heat map) are deleted after 48 hours. The last day your vehicle drove on a road, used to indicate that it is still passable, is kept for at most 60 days.
• Usual road speeds: each day's calculation keeps the vehicle identifier for 30 days (to count each vehicle only once per day, and to know whether at least two different vehicles drove on a segment), then it is deleted the following night. What only one vehicle has seen is deleted 30 days after its last pass; the speed of a segment, without any identifier, is kept for up to one year after the last pass
• Voice counters: for each driver and each day, the number of proximity voice announcements spoken, the number of announcements that had to wait for another one to finish, and the highest number of announcements spoken in one hour, nothing else (no position, no content). They are used to check that the voice is not too talkative. They are deleted after 90 days
• Proximity alert log: to check that each alert is right, PZO keeps for 30 days the log of the alerts sent to each vehicle (the vehicle announced, the distance, the side, the time), then deletes it
• Loaded/empty switches: when the app switches your truck to “loaded” or “empty” on its own, PZO keeps this change for 30 days (time, place, uphill or downhill) to check that it is rarely wrong, then deletes it.
• Trial diagnostics: during the trial, the accounts of participating companies also send what the voice announced, the battery, network outages and speed, the GPS, screen smoothness and touches on the map; they are used only to check and improve the alerts. They are deleted after 30 days
• Contact requests: kept in our database for 24 months after they are sent, then deleted automatically; a copy is also received in our email inbox
• "A problem or a suggestion for improvement?" messages: kept in our database for 24 months after they are sent, then deleted automatically, or sooner, with your account; a copy is also received in our email inbox

Under the Act respecting the protection of personal information in the private sector (Law 25), you have the following rights:

• Right of access: you can request a copy of the personal information we hold about you
• Right of rectification: you can request the correction of inaccurate or incomplete information
• Right of deletion: you can request the deletion of your personal information, subject to our legal retention obligations
• Right to data portability: you can request that your personal information be provided to you in a structured, commonly used technological format
• Right to withdraw consent: you can withdraw your consent to the processing of your information at any time, although this may limit your access to the service

To exercise any of these rights, three equivalent options:

• Self-service deletion: from the mobile app (Settings → Account → My data) or from our dedicated page — you stay in control, without having to write to us.
• Use our pre-filled contact form (recommended for the other rights), which automatically timestamps your request.
• Send an email to contact@pzo-fleet.com specifying the right you wish to exercise.

Response time: in accordance with article 32 of Law 25, we respond within a maximum of 30 calendar days from receipt of your request.

Required documents: to process your request, we may ask for reasonable proof of identity (e.g., confirmation that you are contacting us from the email address associated with your account). This verification is free.

If you disagree: if our response does not satisfy you, you may file a complaint with the Quebec Commission d'accès à l'information.

In accordance with article 12.1 of Law 25 and article 22 of the GDPR, we inform you that some PZO features rely on automated processing of your information:

• Proximity alerts: our engine continuously calculates (every 3 seconds) the road distance between nearby connected vehicles and triggers voice alerts at the distances chosen by the driver (from 2 to 15 km) as well as visual alerts based on proximity (warning under 400 m, danger under 150 m). Announcement distances can be adjusted from the mobile app. When a vehicle loses the network, PZO estimates its position on the road for at most 15 minutes, from its last position and the usual speed of the road. This estimated position is shown only to people who were already allowed to see this vehicle; the voice then says “approximately”.
• Visibility filtering: your position is sent only to your company and to nearby users (within 17 km); from farther away, only to the PZO website, and only if your vehicle is a truck, a grader, a sander, a groomer or a free account driving on a forest road (or, for a groomer or a free account, on an official trail); on the public map, also a company's pickup, ATV, side-by-side, snowmobile or RV, on a forest road or an official trail, anonymously. The filter is applied by the server before each send.
• GPS anomaly detection: we automatically detect low-precision GPS fixes (>100 m) or physically impossible jumps (implicit speed > 300 km/h) to exclude these points from distance calculations. No decision about your account results from this.

These processes have no legal effect on you and refuse no service. Only the speed report counts speeding events and compares your speed with that of other trucks: your company reads it and decides what to do with it; PZO decides nothing about you.

You may at any time disable voice alerts, uncheck “Visible from far away on the PZO website” (truck, grader, sander, groomer, free account, and a company's pickup, ATV, side-by-side, snowmobile or RV), tap “Stop” to no longer be visible, or stop using the service. For any other question about automated processing, contact our personal information protection officer.

In accordance with Law 25, Olivier Deon, president of Solutions PZO inc., acts as the person responsible for the protection of personal information. For any question or request relating to the protection of your information, please contact him:

Email : contact@pzo-fleet.com

The primary hosting of your data is located in Canada (OVH datacenter in Beauharnois, Quebec). Your application data (positions, reports, layers, accounts) is therefore not transferred outside Canada.

Some ancillary processing nonetheless involves providers located outside Quebec, as indicated in section 4:

• United States: Stripe (payments), Mapbox (map tiles), Apple and Google (push notifications), Google Workspace (emails and contact form)
• European Union: Sentry (technical error reporting)

These limited transfers are necessary to provide the service. We ensure they are accompanied by appropriate protection measures in accordance with article 17 of Law 25.

We reserve the right to modify this privacy policy at any time. In case of substantial modification, we will inform you by email or via a visible notice in the application. The date of the last update will always be shown at the top of this page.

For any question regarding this privacy policy or the processing of your personal information, please contact us:

Email : contact@pzo-fleet.com
Website : pzo-fleet.com

See also our Terms of service, our Cookie policy, and our Legal notice.