Privacy Policy

C-Cab (https://c-cab.co) is operated by AiM (Artificial Intelligence Media) in Calgary, Alberta, Canada. Our privacy officer is Luke Reiten, who answers questions and requests at luke@aimediacorp.net.

Each participating church is separately responsible for how its coordinator and volunteers use what they see inside C-Cab for their own ministry.

Everyone: your name, email address, phone number, a password (stored only as a one-way hash, never readable), the church you choose, and a log of the messages we send you about your rides and account.

Riders: your pickup address and the map coordinates we derive from it, how many people are riding, any mobility notes you choose to type (a walker, a wheelchair, help to the door), your ride requests and history, and the ratings you give and receive. If you book for someone else, we hold their name, phone number and pickup address — you must have their permission first.

Volunteer drivers: your vehicle description and seat count, the approval status set by your church, your drives and ratings, optional photos of your driver's licence and proof of insurance if you upload them for your coordinator to review, and your live location only while you have turned on sharing during a ride you are driving. Sharing stops the moment you end it or the ride completes.

Church coordinators: your contact details, your church's details, and the status of your church's membership. Card details are entered on Stripe's own pages and never touch our servers.

Automatically: our hosting provider keeps standard server logs (IP address, browser type, time of request) for security, and we set one essential sign-in cookie. We run no analytics, no advertising trackers and no fingerprinting of any kind.

To coordinate rides inside your church: to show your matched driver your name, phone number and pickup address for that ride; to show you your driver's name, vehicle and position; to keep your coordinator informed and to escalate a ride nobody has claimed; to send you messages about your own rides and account; to bill churches for membership; to keep C-Cab secure; and to meet our legal obligations.

We do not use your information for any other purpose without asking you first.

Your matched driver sees only what they need for that ride. Your church's coordinator sees the riders and drivers of their own church. C-Cab's operator can see records to provide support, look into a safety concern, or keep the service running. Other churches never see your information.

We do not sell, rent or trade personal information, and we show no advertising.

We rely on a small number of providers to run C-Cab. Alberta's PIPA asks us to tell you which of them may hold your information outside Canada, and for what:

Netlify — hosting and delivery of the site and app (United States). Turso — our database, hosted on Amazon Web Services in Ohio (United States). Stripe — church membership payments and receipts (United States; churches only). Twilio — text messages (United States; when texting is switched on). The OpenStreetMap Foundation — map images, and the address lookup that turns a typed pickup address into map coordinates (United Kingdom and European Union). Google Maps, reached through Composio — travel-time estimates between a pickup address and the church (United States).

Information held by these providers may be accessed under the laws of those countries. Each provider is bound by its terms to protect the information and to use it only to provide its service to us. Questions about our practices with providers outside Canada go to our privacy officer at luke@aimediacorp.net.

Nobody is profiled, scored or automatically judged by C-Cab. Volunteers decide which rides to accept; coordinators and volunteers are people. C-Cab contains no AI chatbot and does not feed your information into AI systems.

By giving us a phone number you agree to receive text messages about your own rides and account — a request, an acceptance, a reminder, a cancellation. These are service messages, not marketing, and we never send marketing texts without asking you separately. Reply STOP to any text to stop them, though you may then miss ride updates.

Email from us is limited to your account and, for churches, billing.

Your account details stay while your account is active. Ride records stay as part of your church's records; once you delete your account they no longer carry your name, contact details or address.

Signed agreements — the Rider Release & Waiver, the Volunteer Driver Agreement and the Participating Church Agreement — are kept, with the name that signed them, for as long as needed to establish the parties' legal rights, generally up to ten years (the longest limitation period in Alberta).

Uploaded licence and insurance photos are removed when your account is deleted or when your coordinator no longer needs them. Provider server logs are kept for a short, provider-defined period.

You can see and download everything we hold about you at any time from Account & privacy (Download my data). You can correct your details on your profile. You can delete your account yourself from the same page — no phone call needed. You can withdraw consent to texts by replying STOP.

If you think we have something wrong, tell our privacy officer; we respond within 45 days as PIPA requires. If you are not satisfied, you can complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or, for matters under federal law, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Your name, email, phone number, address, notes, uploaded documents and sign-in sessions are erased and you are signed out everywhere. Upcoming rides you requested are cancelled and your driver is told; rides you had accepted as a volunteer go back to your church's team.

Past rides remain as anonymous entries so your church's history and your former driver's ride count stay accurate. Because a church needs at least one coordinator, a lone coordinator should add another first or email us to close the church's account together with theirs.

C-Cab accounts are for adults (18 or over). A parent, guardian or family member can book a ride for someone else from their own account and is responsible for that person's information and care during the ride.

Connections are encrypted (HTTPS), passwords are hashed, access is limited by role, sign-in is locked after repeated failures, and our servers send modern security headers. No system is perfect. If a breach creates a real risk of significant harm to you, we will notify you and the Information and Privacy Commissioner of Alberta as PIPA requires.

We set a single essential sign-in cookie and nothing else. The details are in our Cookie Policy.

We post any change to this policy here with a new date, and tell church coordinators about material changes.

Privacy officer: Luke Reiten, AiM (Artificial Intelligence Media), Calgary, Alberta, Canada — luke@aimediacorp.net.