Privacy Policy

1. Who we are and what this policy covers

OttaDesk is operated by Ashir Raza, a sole proprietor established in Quebec, Canada, operating as OttaDesk. This policy explains how personal information is handled in the OttaDesk service and on this website.

OttaDesk is used by driving schools. When a school enters information about its students, the school decides what is collected and why — we process that information on the school's behalf, to provide the service. If you are a student and want your information corrected or deleted, your driving school is usually the fastest place to start, though you can also contact us directly using the details in section 11.

2. Information we collect

From driving schools and their staff

• Name, email address, and password (stored only as a cryptographic hash);
• School name, business phone number, contact email, and business hours;
• Instructor details such as name, contact details, vehicle, and availability;
• Language preference and basic account activity.

About students, entered by school staff

• Name and mobile phone number;
• Email address, where the school records one;
• Date of birth, used to determine whether parental consent is required;
• Lesson and booking history, including scheduled, completed, and cancelled lessons;
• Progress against Quebec licensing requirements, such as completed theory modules, in-car lessons, and exam status;
• Account balance and remaining prepaid hours;
• Text messages exchanged between the student and the school through the service;
• Documents the school uploads to a student's file, such as proof of identity or parental consent forms.

Students do not create OttaDesk accounts and do not enter information themselves. Their information reaches OttaDesk because school staff enter it, or because the student sends a text message to the school's number.

3. Text messaging: phone numbers and consent

This section describes our SMS program in detail, because it is the part of the service that involves the most sensitive information.

Why we collect phone numbers

A student's mobile phone number is collected for one purpose: so their driving school can communicate with them about their lessons by text message. Specifically, we use it to send:

• Booking confirmations — confirming a lesson has been scheduled;
• Lesson reminders — reminding a student of an upcoming lesson;
• Rescheduling notifications — telling a student when a lesson has been moved or cancelled;
• Replies to messages the student sends to the school.

These messages are transactional. We do not send marketing or promotional text messages, and we do not permit schools to use OttaDesk to send them.

How consent is obtained

Phone numbers are collected by driving school staff directly from students, normally during enrolment. Schools are required, under our Terms of Service, to tell each student that the school will send lesson-related text messages and to obtain the student's consent before entering their number into OttaDesk. Where a student is a minor, the school is required to obtain consent from a parent or guardian.

Message frequency and cost

Message frequency varies and depends on a student's lesson activity — typically a message around each booking, reminder, and change. Message and data rates may apply, according to your agreement with your mobile carrier. OttaDesk does not charge students for text messages.

How to opt out or get help

• Reply STOP to any message to stop receiving text messages. You will get a confirmation, and no further messages will be sent to that number. You can also ask your driving school directly to stop texting you.
• Reply HELP to any message for assistance, or email support@ottadesk.com.

Carriers are not liable for delayed or undelivered messages. Opting out may mean your school can no longer confirm or remind you about lessons by text; they can arrange another way to reach you.

We do not sell your phone number

We do not sell, rent, or trade phone numbers or any other personal information to third parties, for marketing or any other purpose. We do not share phone numbers with third parties except with the telecommunications provider that delivers the message on our behalf, as described in section 5. Phone numbers and SMS consent are never shared with third parties for their own marketing purposes.

4. How we use information

We use personal information to:

• Operate the service — scheduling lessons, sending the messages described above, and maintaining student records for the school;
• Authenticate users and keep accounts secure;
• Categorise incoming student messages so school staff can respond to them efficiently;
• Provide support when a school or student contacts us;
• Diagnose faults, monitor reliability, and protect against abuse;
• Meet legal obligations.

We do not use student information to build advertising profiles, and we do not make automated decisions that produce legal or similarly significant effects for a student.

5. Who we share information with

We share personal information only with service providers that help us run OttaDesk, and only to the extent they need it:

• Twilio — our telecommunications provider. Twilio receives the recipient's phone number and message content in order to deliver SMS messages.
• Hosting and database providers — our application and PostgreSQL database are hosted with cloud infrastructure providers, including Supabase, who store the data on our behalf.
• AI processing — the text of incoming student messages may be processed by a third-party AI provider to categorise the message (for example, as a booking request or a cancellation) so staff can triage their inbox.

These providers are bound to use the information only to provide their service to us. Some of them process or store data outside Quebec, including in the United States, which means it may be subject to the laws of that jurisdiction.

We may also disclose information where required by law, or to establish, exercise, or defend legal claims. If the business is ever transferred to another owner, information may transfer with it; we would give notice before that happened.

6. Where information is stored and how it is protected

Information is stored in a PostgreSQL database hosted by Supabase, with uploaded documents held in object storage. We use measures appropriate to the sensitivity of the information, including encryption in transit (HTTPS), hashed passwords, access controls that limit each school to its own data, and audit logging of administrative actions.

No system is perfectly secure, and we cannot guarantee absolute security. If a confidentiality incident occurs that presents a risk of serious injury, we will notify affected individuals and the Commission d'accès à l'information as required under Quebec law.

7. How long we keep information

We keep personal information for as long as the school's account is active and the information is needed to provide the service. When a school closes its account, we retain its data for 30 days so it can be exported, then delete it, except where we must keep something longer to meet a legal obligation or to resolve a dispute.

A record that a phone number has opted out of messaging is kept after opt-out — that record is what prevents further messages being sent to that number.

8. Your rights

Under Quebec's privacy legislation, and other laws that may apply to you, you have the right to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Withdraw consent, including consent to receive text messages;
• Request deletion of your information, subject to any legal obligation we have to keep it;
• Request a copy of the information you provided, in a structured, commonly used technological format;
• Complain to the Commission d'accès à l'information du Québec if you believe your rights have not been respected.

To exercise any of these rights, contact us at support@ottadesk.com. If the information was entered by a driving school, we may need to direct your request to that school, and we will tell you if so. We respond within the timeframe required by applicable law — normally 30 days.

9. Students under the age of majority

Driving students are frequently minors. OttaDesk records a student's date of birth so that schools can determine whether parental consent is required, and supports storing a parental consent form on the student's file.

Where a student is a minor under applicable law, the driving school is responsible for obtaining consent from a parent or guardian before collecting the student's information or sending them text messages. A parent or guardian may contact us, or the school, to access, correct, or delete their child's information, or to stop messages being sent.

10. Changes to this policy

We may update this policy from time to time. If we make a material change to how we handle personal information, we will give reasonable notice before it takes effect. The effective date at the top of this page always shows the current version.

11. Contact us