Legal document
Privacy Policy
§2.1 Our approach
Tector is built so that we hold as little identifying information about you as possible, and so that Operators receive less still.
You register with a pseudonym. Your legal name is not required. Payment card details are handled by Stripe and are never received or stored by Tector.
§2.2 What we collect
You give us:
- A pseudonym (display name) and account credentials
- Billing profile details — where you choose to add them — including company name, address, and tax identifiers for invoicing
- Booking details: dates, times, durations, pickup and destination locations, itineraries, descriptions, and stated service preferences
- Ratings, support tickets, and any incident report or response you file
We generate:
- A permanent internal account number
- Booking, transaction, and document records
- Authentication and access logs
We do not collect:
- Your payment card number, CVV, or bank details
- Continuous location data. Location is recorded for pickup and destination points and for personnel check-in and check-out only. Tector does not track engagements in real time.
§2.3 What Operators see
An Operator receiving your booking sees your pseudonym, your stated service requirements, your itinerary and description, and your pickup and destination locations. An Operator does not receive your billing profile, your company details, your payment information, or your legal name.
Anything further you disclose to an Operator directly is outside Tector's control and is governed by that Operator's own privacy practices.
§2.4 Why we process it
Broadly: to operate your account, to match and dispatch bookings, to process payments and produce invoices, to maintain safety and platform integrity, to document incidents, and to comply with legal and tax obligations.
§2.5 Who we share it with
- Operators — as described in §2.3
- Stripe — for payment processing and payouts
- Service providers — hosting, mapping and routing, error monitoring, push notification delivery
- Legal — where required by law, subpoena, or court order, or to protect rights, safety, or property
We do not sell personal information.
§2.6 Deletion — and what survives it
You may delete individual items of information, individual billing profiles, or your entire account, from within the app or by written request.
How to delete your account. Open your account settings in the Tector app and choose to delete your account; the app lists what will be removed and what will be kept before you confirm. If you do not have the app, follow the written route on Account and data deletion. In both cases, financial records of completed bookings and any incident report naming you are kept as described below, and everything else listed here is deleted.
When you delete your account, we permanently delete: billing profiles, payment method links, service preferences, display name history, support tickets, ratings you authored, and device identifiers.
We retain, after account deletion:
(a) Financial records of completed bookings, as required for tax and accounting purposes, for the period required by law.
(b) Incident reports. Where an incident report has been filed naming you, that report — including your pseudonym and account number as they stood at the time, and the account of what occurred — is retained in a separate, encrypted, immutable record. This record is not deleted when you delete your account.
We retain incident reports because they exist to protect both Clients and Operators, and a record that can be erased by one party is of no protective value to the other.
Incident reports are retained for two years from creation, after which they are purged, unless the record is subject to a legal hold arising from actual or reasonably anticipated legal proceedings, in which case retention continues until the hold is lifted.
Purges are reviewed and approved by a named person; we retain a record of that approval.
See also: account and data deletion — the request path.
§2.7 Security
- Two-factor authentication is optional and is not required to use Tector. If you turn it on for your account, we require it at every sign-in so that a password alone cannot open your account.
- Internal access is tiered. Reaching sensitive records — including billing and company details — requires additional re-authentication, is time-limited, and is logged against the specific case it was accessed for.
- Incident records are encrypted at rest and are technically immutable.
- Sessions expire automatically.
No system is perfectly secure. We describe our measures accurately and do not promise an absolute outcome.
§2.8 Your rights
You may ask what we hold about you, and ask us to correct it. You may delete individual items of information, individual billing profiles, or your whole account — §2.6 sets out what deletion removes and what survives it, and Account and data deletion is the request path. You may ask for your information in a structured, commonly used format.
Write to privacy@tector.app to exercise any of these. We will not treat you differently for doing so.
If you are a Delaware resident, you additionally have, under the Delaware Personal Data Privacy Act, the right to opt out of the processing of your personal data for targeted advertising, for sale, or for profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you.
We will respond to a verifiable request under this section within forty-five (45) days of receipt. Where reasonably necessary considering the complexity and number of requests, we may extend that period by an additional forty-five (45) days, and will notify you of any extension, and the reason for it, before the initial 45-day period expires. There is no charge for a request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline to act, with an explanation. If we decline a request, we will explain why in writing, and you may appeal that decision by writing to privacy@tector.app; we will decide the appeal within forty-five (45) days of receipt, extendable by a further sixty (60) days where reasonably necessary. If we deny your appeal, we will provide you, within five (5) business days, with a means to submit a complaint to the Delaware Department of Justice.
§2.9 Children
The platform is not for use by anyone under 18. We do not knowingly collect information from minors.
§2.10 Changes
A material change to this notice is published as a new version on a new date. The version in force when you used the platform governs that use, and earlier versions are retained.
§2.11 Contact
Write to privacy@tector.app. Tector is operated by TNAADO Labs Inc., a Delaware corporation based in Miami, Florida.
§2.12 Canada — PIPEDA and Quebec's Law 25
This section applies in addition to the rest of this notice, wherever you are a Client or Operator located in Canada.
(a) The federal and provincial baseline. Personal information we handle in the course of commercial activity in Canada is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Alberta and British Columbia have each enacted their own private-sector privacy statute, which applies instead of PIPEDA to activity conducted wholly within that province. Where a standard elsewhere in this notice is less protective than the one that applies to you, the more protective standard governs.
(b) Quebec — Law 25. Quebec's Act respecting the protection of personal information in the private sector, substantially amended by Law 25, is stricter than PIPEDA and stricter than any US state statute referenced elsewhere in this notice. For Quebec residents:
- We have designated a person responsible for the protection of personal information, who receives privacy questions and complaints and can be reached at the address in §2.11.
- Consent is explicit and granular. Agreeing to one use of your information — receiving a booking confirmation, for example — is never treated as consent to a different one, such as marketing.
- We maintain a confidentiality-incident register and will notify the Commission d'accès à l'information and any affected individual where an incident presents a risk of serious injury.
- You may request your personal information in a structured, commonly used technological format, and ask that it be transmitted to another organization where that is technically feasible.
- You have the right described in (c), below, regarding a decision made exclusively by automated processing.
(c) The matching algorithm is automated decision-making. When you submit a request, Tector's matching engine — without a person making a decision about your specific request — determines which Operators are notified. It uses:
- the service type you requested (vehicle, protector, or both);
- the jurisdiction of your pickup and destination, because an Operator can only be offered work it is licensed to perform there;
- the requirements and preferences you stated in your request; and
- which Operators have indicated availability.
It does not use your race, ethnicity, religion, gender, disability, immigration status, credit history, or criminal record — Tector does not collect these for this purpose — and it does not score or profile you against your past activity on the platform.
Because this is a decision made exclusively by automated processing, you may ask us for the personal information used to reach it and for the principal factors and parameters that produced that outcome. You may ask us to correct the stated requirements or preferences that fed into it, and you may put your case to a person at Tector able to review the decision, not only to the system that made it.
(d) Cross-border transfer. Tector's database is hosted in the United States (us-east-1). Personal information collected from Canadian Clients and Operators — including from Quebec — is accordingly processed and stored in the United States, not in Canada.
Before making a transfer of this kind, Law 25 requires an assessment of the privacy factors involved: the sensitivity of the information, the purposes for which it is used, the safeguards that apply to it, and the legal framework in the destination jurisdiction, including whether that framework is recognized as offering protection equivalent to Law 25's own principles.
(e) Exercising your Canadian rights. To exercise any right in this section — access, correction, portability, or a question about an automated decision — write to the address in §2.11 Contact. Quebec residents may also complain to the Commission d'accès à l'information du Québec. Residents of other provinces may complain to the Office of the Privacy Commissioner of Canada, or, in Alberta or British Columbia, to that province's own Information and Privacy Commissioner.