Privacy Policy
Version 1.0 · Effective 11 September 2026
St. Stephen Go is a local food ordering and delivery service operating in St. Stephen, New Brunswick and the surrounding Calais border area. This page explains what we collect, why we collect it, who else sees it, and what you can ask us to do with it.
Who we are
St. Stephen Go operates the website at ssgo.ca and the ordering, restaurant and driver applications served from it. We are the organisation responsible for the personal information described here. You can reach us at pardeep@ssgo.ca about anything on this page.
What we collect
What we hold depends on how you use the service. We collect only what an order actually requires, and we do not sell personal information to anyone, for any purpose.
If you order food
- Your identity. Your name and email address, taken either from Google when you choose to sign in with Google, or from the email address you give us when you request a sign-in link.
- Delivery addresses. The addresses you enter or save, including the coordinates we derive from them so a driver can be routed to your door.
- Orders and receipts. What you ordered, from which restaurant, the price breakdown, taxes, any tip, the fulfilment method, and the timestamps of each step.
- Messages. Anything you send through an order thread to the restaurant or your driver.
- Payment records. The amount, the currency, the status, and a reference issued by our payment processor. We never see or store your full card number, expiry or security code — those go directly to Stripe and never reach our servers.
- Notifications. If you allow them, a push subscription issued by your browser so we can tell you when an order changes state.
If you drive
- Everything above, plus the following.
- Location while you are working. Your device location is recorded during an active delivery so the customer and our dispatch can see where the order is, and so the route can be reconstructed if something goes wrong. This is the most sensitive thing we hold and it is treated as such — see below.
- Documents you upload. Licence, insurance and any other document we ask for in order to let you drive. These are visible only to you and to St. Stephen Go staff who review them. They are not public and they are not shared with restaurants or customers.
- Work records. Deliveries offered, accepted, declined and completed, and what you earned on each.
If you work for a partner restaurant
- Your name, email address, and which restaurant you belong to, so the right person can accept orders and manage a menu.
- A record of actions taken on orders, so a disputed order can be traced to the account that acted on it.
Everyone
- A session cookie that keeps you signed in. It is httpOnly, which means page scripts cannot read it. We do not use advertising or cross-site tracking cookies.
- Access records. When a staff account opens customer, driver or order data, we record who did it and when, so that access to your information can be audited rather than taken on trust.
Driver location, specifically
Location is collected while you are on an active delivery. It is used to show the customer where their order is, to route you, and to settle disputes about what happened on a delivery. It is not used to monitor drivers outside of work, and it is not sold or shared for advertising.
Being straight with you: our retention schedule for precise driver location is still in draft, and automated deletion is not yet switched on. That means location history is currently kept until we set that period, or until you ask us to remove it. We would rather say so plainly than publish a number we are not yet enforcing.
Why we collect it
- To take, price, route, deliver and settle your order.
- To let you, the restaurant and the driver talk to each other.
- To take payment and issue receipts.
- To confirm drivers are licensed and insured before they carry an order.
- To meet tax, accounting and record-keeping obligations, and to resolve disputes and investigate problems.
- To keep accounts and the service secure.
Where the law requires your consent — notably for driver location and for push notifications — we ask for it, we record that you gave it, and you can withdraw it.
Who else sees it
People involved in your order see the part they need. A restaurant sees the order and your name. A driver sees the pickup, the delivery address and your name. Neither sees your payment details.
We also use service providers who process information on our behalf, under contract, for the purposes below and nothing else:
- Stripe — payment processing. Card details go to Stripe directly.
- Google — sign-in with Google, address autocomplete, maps and distance calculation.
- Resend — sending transactional email such as sign-in links and receipts.
- Cloudflare — hosting, the database, and access control for staff tools.
- Stadia Maps and OpenStreetMap — map imagery.
- Your browser or device maker — delivering push notifications you have allowed.
Some of these providers operate outside Canada, which means your information may be processed in another country and be subject to that country's laws. We will also disclose information where we are legally required to.
How long we keep it
Order, payment and receipt records are kept for as long as we need them for accounting, tax and dispute purposes. Account information is kept while your account is open.
Our formal retention schedule is still being finalised and automated deletion is not yet running. Until it is, the practical position is that we keep records and delete them on request, as described below. This page will be updated with specific periods once they are set.
Your rights
Under Canadian privacy law you can ask us to do all of the following, and we will not charge you for it:
- Tell you what personal information we hold about you.
- Give you a copy of it.
- Correct anything that is wrong.
- Delete your account and the information attached to it, except records we are legally required to keep, such as completed financial records.
- Withdraw a consent you gave us, including consent to location collection or push notifications.
Email pardeep@ssgo.ca and say what you want. We will confirm who you are before acting, so that nobody else can make a request in your name, and we will respond within 30 days.
Children
This service is not intended for children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will remove it.
Security
Traffic to and from the site is encrypted. Staff tools sit behind separate access control, and staff access to customer, driver and order data is logged. No system is perfect; if we discover a breach affecting your information, we will tell you and the relevant authorities as the law requires.
Changes to this policy
If we change this policy we will update the version and effective date at the top of this page. If a change materially affects how we use information you have already given us, we will tell you directly rather than relying on you to notice this page.
Complaints
Please raise anything with us first at pardeep@ssgo.ca — most things are faster to fix directly.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.