Skip to content

Privacy Policy

Optimize Everything
Winnipeg, Manitoba, Canada
Version 2026-06-01 · Effective September 9, 2026

This Privacy Policy explains how Optimize Everything (“we,” “us,” or “our”) collects, uses, shares, and retains personal information when you use our websites, applications, and APIs (the “Services”), including opteverything.com and app.opteverything.com.

We do not sell personal information and we do not share personal information for third-party advertising or cross-context behavioural advertising. We honour Global Privacy Control (GPC) and similar opt-out signals.

1. Who we are

Optimize Everything is based in Winnipeg, Manitoba. We operate a cost-sharing carpool and multimodal trip marketplace. Contact: info@opteverything.com.

2. Information we collect

We collect the following categories of personal information:

  • Account and identity. Name, email address, phone number, password (stored as a hash), and account settings.
  • Verification materials. Documents or images you submit for identity or partner-signup verification. Card numbers are never stored on our systems.
  • Precise location. GPS pings, trip endpoints, and route geometry while you are on an active trip or shortly before a scheduled pickup, if you have granted location consent.
  • Trip and contract data. Ride and operator contracts, orders, bids, legs, schedules, ratings, and reports you file.
  • Payment data. We collect a token from our payment processor (Braintree) and display last-four digits. Full card numbers stay in the processor’s vault.
  • Communications. Email and SMS we send you (verification codes, password reset, account reclaim, service notices) and messages you send us, including bug reports.
  • Device and diagnostics. App version, screen, and recent steps if you file a bug report and have granted that notice. Website usage data needed to operate the site (including HubSpot cookies on this marketing site).
  • Consents. A dated, versioned record of privacy, terms, location, training, and marketing choices.

3. How we use information

  • Create and secure your account, and verify your email and phone.
  • Match riders and operators, run auctions, build trips, and settle money.
  • Show a counterparty your location only when you share an active or imminent trip with them.
  • Detect fraud, resolve disputes, and keep an audit trail.
  • Send transactional SMS and email you asked for (codes, trip changes, receipts).
  • Send marketing only if you opt in. You can turn that off in the app.
  • Improve routing and matching using de-identified trip data if you have not withdrawn training consent (see section 6).
  • Comply with law, tax, and payment-network rules.

4. Consent and legal bases

At signup you accept this Privacy Policy and our Terms of Service. We record the policy version and the time. We collect precise location only if you separately grant location consent, and only inside the trip collection window (an in-progress leg, or up to 10 minutes before its scheduled start). Marketing is off unless you turn it on. You can withdraw location, training, or marketing consent in the app. Withdrawing privacy or terms acceptance means closing the account.

Where a privacy statute requires a legal basis, we rely on: your consent; performance of the contract you form with us; our legitimate interests in operating a safe marketplace; and legal obligations (including tax and ledger retention).

5. Location

Precise location is sensitive. We collect it only with consent and only when it is needed to run the trip. We keep identity-linked location for 90 days, then erase it. Before erasure we may extract a de-identified training record (section 6). We never sell location data. Counterparties see your position only when they need it for a shared trip.

6. De-identified training data

To improve routing and matching we may derive a training record from a trip before identity-linked location is erased. That record drops your name, account, and other identifiers, replaces them with a random token that cannot be reversed to you, trims the start and end of the route near home or work, and generalizes sparse times and places. We do not join that corpus back to your account. Erasing your account removes the identity-linked copy. You can withdraw training consent so we do not extract a new record from your trips.

7. Payments

Card charges, holds, refunds, and operator payouts are processed by Braintree. We do not store full card numbers. We keep a ledger of money movement. Platform balances and ride credits are not withdrawable to a bank. We do not take custody of end-user funds for remittance to someone else; settlement is handled by the processor where a payout is due.

8. SMS and email

We send transactional text messages through Brevo (sender name oeverything) and email through our email provider. Typical messages are verification codes, password reset codes, account-reclaim codes, and trip notices. These are not marketing. Marketing messages require a separate opt-in.

9. Who we share information with

We share personal information only with service providers who process it for us, and only as needed to run the Services:

  • Braintree — payments and payouts.
  • Brevo — transactional SMS.
  • Our email provider — transactional email.
  • Google Cloud — hosting, file storage for verification attachments, and scheduled jobs.
  • HubSpot — this marketing website and related forms.
  • Mapping, transit, and routing providers — to price and plan a trip you requested.
  • Partner ride platforms — only when you choose a partner booking as part of a trip.

We may disclose information if required by law, to protect people from harm, or as part of a merger or sale of the business, under this same policy. Other riders or operators on your trip see the information needed to complete that trip (name, ratings, and location in the collection window).

We do not sell personal information. We do not share it for third-party ads.

10. Retention

  • Account profile: for the life of the account, then erased or pseudonymized on deletion.
  • Identity-linked location and route traces: 90 days, then erased.
  • Verification images: until verification is finished plus a short hold, then deleted.
  • Payment ledger and tax records: kept for the statutory minimum (typically six to seven years), with identity fields pseudonymized after account erasure.
  • Consent and audit records: kept as an append-only history so we can show what was agreed and when.
  • De-identified training records: kept without identifiers.

11. Your rights

Depending on where you live (including Canada, Manitoba / Law 25-grade treatment we apply everywhere, PIPEDA, and US state privacy laws such as Illinois and Virginia), you may:

  • Access and download the personal information we hold (data export in the app).
  • Correct inaccurate information.
  • Delete your account (erasure). We pseudonymize your profile, purge location, and keep only records we must keep (money and tax).
  • Withdraw location, training, or marketing consent.
  • Opt out of sale or sharing — we already do not sell or share, and we honour GPC.
  • Reclaim an erased account that still belongs to your phone number, using a one-time code we send to that number.

To exercise these rights, use the in-app Privacy screens or email info@opteverything.com. We aim to respond within 30 days. You may also complain to your privacy regulator (for Manitoba, the Ombudsman; for Canada, the OPC; for Quebec residents, the CAI).

12. Children

The Services are for adults. We do not knowingly collect personal information from children under 13 (or the higher age required in your jurisdiction for this kind of service).

13. Security

We use access controls, encryption in transit, hashed credentials, and least-privilege access to production data. No method of transmission or storage is perfectly secure. If a breach creates a real risk of significant harm, we will notify the relevant authority and affected people, aiming for the 72-hour authority clock used under Law 25 and GDPR-grade practice.

14. International transfers

We are based in Canada. Some processors (including Braintree and SMS delivery) may process data in the United States or other countries. When Canadian personal information leaves Canada, we use contracts and processor terms that require appropriate protection.

15. Cookies

This marketing website uses cookies and similar tools, including HubSpot, to operate the site and understand visits. The product app uses tokens you sign in with, not advertising cookies. You can control cookies in your browser.

16. Changes

If we change this policy we will publish the new version here and update the version string the app records. A material change will ask you to accept the new version before you continue.

17. Contact

Optimize Everything
Winnipeg, Manitoba, Canada
info@opteverything.com
Privacy Policy: https://opteverything.com/privacy-policy
Terms of Service: https://opteverything.com/terms