Privacy Policy

Last updated: February 2026

Bolid Technologies Inc. ("Bolid," "we," "our") is committed to protecting your personal information in accordance with Quebec's Act to modernize legislative provisions as regards the protection of personal information (Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy describes what information we collect, why we collect it, how we use it, how long we retain it, and what your rights are.

1. Privacy Officer

In accordance with section 3.1 of Law 25, the person responsible for the protection of personal information at Bolid is:

David Courchesne, President
Bolid Technologies inc.
Email : privacy@bolid.io

Any question, access request, or complaint regarding your personal information may be directed to this person.

2. Information We Collect

2.1 Identification Information

When you use Bolid, we may collect your name and email address in order to identify you within the platform and enable communication between trip participants.

2.2 Precise Location Data (GPS)

Bolid uses your device's GPS to record your shared trips (carpooling, vehicle lending). Location data is collected only when you actively start a trip by pressing the "Start" button. The application does not request or use your location in the background or when no trip is in progress.

The application is fully functional without granting location access. You can manage your vehicles, view your trip history, and use the BolidCost™ cost calculator without GPS authorization. Only starting a new trip requires access to your location.

Location data is used to:

• Calculate the distance traveled during a shared trip
• Generate a cryptographically verifiable trip proof (SHA-256 signature)
• Calculate cost sharing between participants via BolidCost™
• Estimate CO₂ emissions avoided through sharing

Important: Bolid never stores your raw GPS coordinates on its servers. Only derived data (total distance, generalized departure and arrival points) is retained.

2.3 Anonymous Installation Identifier

When the application is first opened, a unique anonymous identifier (UUID) is created and stored locally on your device. This identifier associates your trip data and vehicles with your installation without being linked to your personal identity (name, email).

No personal information is associated with this identifier. You can reset it at any time through the application settings (Settings → Clear Subscription Data).

2.4 Usage Data

We store the following usage data server-side:

• Your trip history (dates, distances, calculated costs)
• Cost sharing between participants
• Your vehicle information (make, model, year, trim)
• Driver and passenger names associated with a trip

2.5 Employment Information

If you use Bolid through an employer program, your organization may share limited information about you (name, professional email, employee group) to grant you access to the program.

3. Purposes of Collection

Your information is collected and used exclusively for the following purposes:

• Providing Bolid's shared mobility services
• Calculating travel costs and fair sharing between participants
• Generating cryptographic trip proofs
• Calculating CO₂ emissions avoided
• Producing aggregated and anonymized reports for participating employers
• Communicating with you about your account and trips
• Improving the quality and security of our services

No data is sold to third parties. No data is used for advertising or profiling purposes.

4. Consent

Your consent is required for the collection and use of your personal information. Consent is obtained as follows:

• Location data: when you press "Start a trip," your device explicitly requests permission to access your location. You may deny this permission; the application remains fully functional for all other features (vehicle management, history, BolidCost™ calculator). Only starting a new trip will be disabled.
• Identification data: when you create your account or register for an employer program.

You may withdraw your consent at any time (see section 6 below). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.1 Android-Specific Permissions

On Android, optimal trip tracking may require two separate permissions: location access and disabling battery optimization for the application. The application guides you through configuring these settings when you start a trip. These permissions are optional and can be revoked at any time in your device settings.

5. Data Retention

We retain your personal information only as long as necessary for the purposes described above.

At the end of the retention period, data is either permanently deleted or irreversibly anonymized so that it can no longer identify an individual.

6. Your Rights

Under Law 25 and PIPEDA, you have the following rights:

Right of access — You may request to view the personal information we hold about you.

Right of rectification — You may request the correction of inaccurate or incomplete information.

Right of erasure — You may request the deletion of your personal information when it is no longer necessary for the purposes for which it was collected.

Right to data portability — You may request to receive your personal information in a structured, commonly used format, or to have it transferred to another service provider.

Right to withdraw consent — You may withdraw your consent at any time by disabling permissions in your device settings (for location) or by contacting us by email (for other data).

To exercise any of these rights, contact our privacy officer at privacy@bolid.io. We will acknowledge receipt of your request and process it within a maximum of 30 days.

7. Security

We implement technical and organizational security measures to protect your personal information, including:

• Data encryption at rest and in transit (TLS)
• SHA-256 and HMAC-SHA256 cryptographic signatures to ensure trip data integrity
• Access to personal information restricted to authorized personnel only
• Hosting on certified cloud infrastructure (see section 8)
• No raw GPS coordinates transmitted to or stored on our servers

8. Hosting and Data Transfers

Your personal information is hosted on Microsoft Azure servers located in Canada East (Quebec).

The database is Azure Cosmos DB, hosted in the same Canadian region. Microsoft acts as a subcontractor for hosting and is subject to contractual confidentiality and security obligations compliant with Law 25 and PIPEDA.

Your personal information is not transferred outside of Canada. Should this change, a Privacy Impact Assessment (PIA) would be conducted in accordance with section 17 of Law 25 and you would be notified.

9. Privacy Breach

In the event of a privacy breach presenting a risk of serious harm, Bolid commits to:

• Notifying affected individuals as soon as possible
• Reporting the breach to the Commission d'accès à l'information du Québec (CAI) in accordance with section 3.5 of Law 25
• Maintaining a registry of privacy breaches

10. Complaints

If you believe your rights have not been respected after contacting our privacy officer, you may also file a complaint with:

• Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada (OPC) — www.priv.gc.ca

11. Changes to This Policy

We may update this policy from time to time. Any material changes will be communicated through an in-app notification or by email. The date of the last update appears at the top of this document.

Contact

For any questions about this policy or your personal information:

privacy@bolid.io