Privacy Policy
This policy explains how A&A Terra Inc ("we"), operator of the Terra Drive platform, handles personal information of drivers, restaurant users, and customers who receive deliveries.
1. What we collect
| Who | What | Why |
|---|---|---|
| Drivers | Name, email, phone, password (stored only as a salted hash), home city, chosen zones, vehicle details, insurance proof image and expiry, signature records, language setting | Account, onboarding, safety, contract records |
| Drivers | Location only while online or on a delivery: about every 5 seconds while an offer is showing or a delivery is active, otherwise when you move or about every 25 seconds | Offering nearby deliveries, live tracking, proof of delivery, mileage log |
| Drivers | Delivery photos at dropoff (drivers are told to photograph the order at the door, not people) — a photo may show the customer's door or entrance | Proof of delivery and dispute handling |
| Drivers | Identity check result and verified name (from Stripe Identity). Your ID document and selfie images are kept by Stripe, never on our servers | Confirming you are who you say you are; locking a Founding Driver spot |
| Drivers | Background check result status (from the consumer reporting agency); a staff-recorded NSOPW (nsopw.gov) lookup result; automated document-review flags | Eligibility, with your separate written FCRA authorization. Flags are reviewed by a person; we never use people-search sites |
| Drivers | Background-check payment and refund records (non-Founding Drivers) | Charging the up-front check fee and refunding it after 20 deliveries |
| Drivers | Payout and tax info | Collected and stored by Stripe, not by us. We never store your SSN, TIN, or bank account number. |
| Restaurants | Business name, address, contact, users, API keys (stored only as hashes), webhook settings | Account and integrations |
| Customers | Name, phone, delivery address, notes, order items, tip; payment card data is entered on Stripe's page and never touches our servers | Completing and supporting the delivery |
| Everyone | Device/browser data, IP address, logs | Security, fraud prevention, troubleshooting |
Biometric information (identity check). Stripe Identity, acting for us, compares your selfie with the photo on your ID using facial-recognition technology. This is biometric processing. We ask for your consent on the identity screen before it starts; Stripe keeps the images and any face data under its own retention rules, and we receive only the result (verified / not verified) and your verified name. We do not receive or store your face geometry, selfie, or ID images on our servers. [Counsel to confirm the consent wording meets Texas Bus. & Com. Code § 503.001 (CUBI) and any other state biometric law before launch.]
In demo mode we do not collect SSNs or ID images at all, and the identity check is simulated.
Cookies. We use one strictly necessary session cookie to keep you signed in, and your browser stores small settings (such as language). We do not use advertising or cross-site tracking cookies.
2. How we use it
To run deliveries; pay people; verify eligibility and safety; prevent fraud; provide support; send service messages; meet legal, tax, and accounting obligations (including issuing 1099 forms through Stripe); and improve the service. We do not sell personal information and do not use it for cross-context behavioral advertising.
3. Who we share it with
- Restaurants: the driver's first name, vehicle description, and live location during an active delivery.
- Customers: the driver's first name, vehicle, and live location during their delivery; drivers see a masked customer phone number.
- Service providers: Stripe (payments, payouts, tax forms, identity check), the background-check consumer reporting agency ([name — to be added, e.g. Checkr]), SMS provider (if enabled), hosting provider, map tiles (OpenStreetMap) and geocoding (Nominatim — receives addresses only, not names). Pages also load fonts from Google Fonts and the map library from cdnjs; like any website resource, those providers receive your IP address and browser details when your browser fetches the file.
- Legal: when required by law, subpoena, or to protect safety and rights.
- Business transfers: in a merger or acquisition, under this policy's protections.
We never ask drivers for data from other delivery apps and never collect it.
4. Location
Driver location is collected only while the driver is online in the app (and during an active delivery). Customers' tracking links stop showing driver location after delivery. Drivers can see and export their own mileage log. If a driver allows notifications, new offers can wake the phone through the browser's push service; the push itself carries no personal data — the app asks our server what to show. Drivers who did not opt in to texts get zone-live and approval notices by email.
5. Retention
| Data | Kept for |
|---|---|
| Live GPS points | 90 days, then reduced to per-delivery and per-day mileage summaries [automatic deletion job to be built before launch] |
| Delivery records, ledger, payouts, tax summaries | 7 years (tax and accounting) |
| Proof photos | 1 year, or longer if part of an open dispute [automatic deletion job to be built before launch] |
| Insurance documents | Life of the account + 1 year |
| Background-check records | As required by FCRA and state law; then deleted |
| Closed accounts | Personal data deleted or de-identified within 90 days, except records we must keep by law |
[Counsel to confirm retention periods — see Legal Checklist.]
6. Security
Passwords are hashed with scrypt; sessions use secure HttpOnly cookies; API keys are stored hashed; uploads are served only to authorized users; payments run on Stripe. No system is perfectly secure; we will notify affected people of a breach as required by law (including Ohio Rev. Code § 1349.19 and Tex. Bus. & Com. Code § 521.053).
7. Your choices and rights
You can view and update your account information in the app, export your earnings and mileage data, opt out of marketing texts (reply STOP) and emails, and ask us to delete your account. Residents of states with consumer privacy laws (including the Texas Data Privacy and Security Act) may request access, correction, deletion, and a copy of their data, and may appeal a denial. Email [email protected]. We will not discriminate against you for exercising your rights.
8. Children
The service is not for anyone under 18. We do not knowingly collect children's data.
9. Changes
We will post updates here and notify active users of material changes.
10. Contact
A&A Terra Inc · [registered business address — to be added] · [email protected]
A&A Terra Inc · All legal documents