MapleDrive Privacy & Data-Sharing Policy

0. Plain-language summary

Your deliveries, messages, and tips are private to you. We only use combined, anonymized patterns from at least 5 drivers to power recommendations — never your individual numbers, and only if you opt in. You can turn this off anytime.

1. Data classes

• Private (per-driver — never shared, never shown to another user): a driver’s own messages composed or sent, individual delivery records, individual tip amounts, earnings exports or screenshots, OCR-extracted line items, account and contact information, device data, and geolocation traces.
• Derived-aggregate (may power cross-driver recommendations only after de-identification and the cohort/noise rules below): patterns such as “message phrasing X correlates with a higher tip rate at restaurant-type Y,” per-restaurant tip-rate bands, time-of-day / day-of-week lift, and message-length or emoji effects.

2. What counts as aggregated / anonymized

An output is “aggregated” only if it (a) combines at least K distinct contributing drivers and (b) carries no field that can re-identify a single driver, delivery, customer, or exact tip. Aggregates are statistics (rates, bands, ranks) — never row-level pass-through. De-identification is irreversible: source driver IDs are stripped before the aggregate is computed, not merely hidden at display time.

3. Minimum-cohort (K-anonymity) threshold

• Default floor K = 5 distinct drivers per cell before any aggregate is computed or shown. Cells below K are suppressed (shown as “not enough data yet”) — never rounded up or back-filled.
• For monetary outputs (tip $ averages / bands), additional protection: report banded ranges (e.g. $3–5) rather than exact means, and apply differential-privacy-style noise to the published statistic so no single driver’s contribution is recoverable. (Banded ranges + DP-style noise on tip $ outputs are confirmed policy; the epsilon budget starts small/privacy-favouring and is finalized at legal review.)
• Complementary suppression: if suppressing one sub-K cell would let its value be inferred from row or column totals, suppress the next-smallest cell too.

4. Never shared / never crosses a tenant boundary

• Raw or row-level driver data of any kind.
• Individual tip amounts, or a named/identifiable driver’s earnings.
• Verbatim message text attributable to a driver (only de-identified phrasing-pattern features feed the model).
• Customer or recipient PII, exact addresses, or order contents.
• Any cohort below K, or any output that re-identifies via combination (quasi-identifier join).

5. Consent: opt-in by default

Contributing your data into the cross-driver aggregate pool is opt-in. You may use MapleDrive’s private features (compose messages, track your own tips) without ever contributing to aggregates. A clear, separate consent toggle — “Help improve recommendations by contributing my anonymized patterns” — enrols you in the pool; it is off by default.

Why (PIPEDA): PIPEDA requires meaningful consent proportional to sensitivity. Tip and earnings data is financial and reasonably sensitive, and using it to power recommendations for other drivers is a secondary purpose beyond the primary purpose (your own tooling). Sensitive data plus a secondary purpose calls for express, opt-in consent rather than bundled or opt-out consent. Consent is granular, revocable, and not a condition of using the core product.

Withdrawal: turning the toggle off stops all future contribution. Any already-published aggregate that no longer meets the K threshold after a withdrawal is recomputed or suppressed on the next aggregation cycle.

6. Retention

Aggregate inputs and derived statistics are held under our standard 7-year retention. Withdrawal removes a driver from future aggregation cycles. You may request access to, correction of, or deletion of your personal information at any time by contacting our Privacy Officer (below); verified requests are actioned within 30 days, subject to overriding legal retention obligations.

7. Data sovereignty

Aggregation compute and storage stay on Canadian-hosted infrastructure. White-label instances aggregate only within their own country and tenant boundary — there is no cross-border pooling and no pooling across white-label deployments.

8. Accountability & legal review

This draft is the pre-review artifact. Under our general legal posture, formal counsel review is deferred to 1,000 clients or the MapleTriage IRAP grant; however, the parent requirement (#215) explicitly requires legal sign-off before any cross-driver data crosses a boundary (before child #8 ships). That child-ship gate overrides the general deferral (confirmed by the Privacy Officer): the first cross-driver aggregate ship is the trigger for at least a focused legal pass on this policy, regardless of client count or IRAP status.