Privacy

Your students' data, treated with care.

Last updated: June 6, 2026

copilotBC ("we", "us", "our") is committed to protecting personal information. This Privacy Policy explains what we collect, why, where it lives, and the rights you and the students in your records have. We handle personal information in accordance with British Columbia's Personal Information Protection Act (PIPA) and Canada's PIPEDA where it applies.

Who we are, and our two roles

copilotBC is the business name under which Shandria Caroline Kyla Slade, a sole proprietor located in British Columbia, Canada, carries on business. You can reach us about privacy at privacy@copilotbc.ca.

copilotBC is a tool for BC driving instructors. The instructor is our direct customer. The instructor's students (and, where applicable, their parents or guardians) are not our direct customers, but their personal information is processed through copilotBC on the instructor's behalf.

• For an instructor's own account information, copilotBC is the organization responsible for that information.
• For student records an instructor enters, the instructor is responsible for that information and for obtaining the consents required under PIPA; copilotBC processes it on the instructor's behalf to provide the Service.

What we collect

• Instructor account data: name, email address, instructor/licence identifiers you enter, and subscription status. Payments are processed by Stripe (see below) — we never see or store your full card number. Instructors who enable lesson payouts also complete Stripe's identity/banking verification directly with Stripe; copilotBC stores only the Stripe account reference and whether payouts are enabled.
• Student records the instructor enters: student name, contact details, parent/guardian contact (for minors), licence class (e.g. "Class 7L"), lesson dates and notes, readiness assessments, signatures captured for lesson sign-off, and instructor reports. We do not ask for medical information or government ID numbers beyond licence class.
• Operational data: sync timestamps, device type and user-agent for offline reconciliation and security, and error logs.
• Voice notes (optional): if you use voice notes, audio is transcribed on your device and is not sent to us for transcription. The audio clips themselves are stored only in the instructor's own browser, on the instructor's device (in IndexedDB) and are never uploaded to copilotBC — only the accepted text transcription, if you choose to keep it, reaches the lesson record. Each clip is deleted individually by the instructor; clips are not deleted automatically, so how long an audio clip is kept is the instructor's responsibility as the holder of the records.

Why we collect it

We use this information only to provide and operate the Service: to run your account, store and sync your records, generate reports and exports based on ICBC/BC formats, process your subscription, keep the Service secure, and respond to support requests. We do not sell personal information, and we do not use student records for advertising.

Where it lives

Data is stored in Google Cloud Firestore in the Toronto (northamerica-northeast2) region. Your records stay in Canada, with one exception: the optional AI assistance feature (off by default). If — and only if — an instructor turns it on, limited, de-identified lesson text is sent to a third-party AI provider in the United States to tidy transcripts and draft reports; with AI off, nothing leaves Canada. Backups are kept within the same region. The Service is delivered over encrypted (HTTPS) connections.

Service providers we rely on

• Google Cloud / Firebase — hosting, authentication, and the Firestore database (Canadian region).
• Stripe — our payments processor. Stripe handles checkout, card processing, subscription billing, and (for instructors who enable lesson payouts) identity and banking verification through Stripe Connect. Card details go directly to Stripe and never touch copilotBC's systems. Stripe is subject to its own privacy policy (available at stripe.com/privacy) and may process payment data outside Canada.
• AI provider (optional, off by default) — only if an instructor enables AI assistance, limited de-identified lesson text is sent to a third-party AI provider in the United States to clean up transcripts and draft reports. The text is not used to train the provider's models.

These providers are bound to process information only as needed to provide their services to us.

Who can see your data

• The instructor who entered the data.
• A student or their parent/guardian, only for the specific report or sign-off link the instructor chooses to share with them.
• copilotBC operators, only as needed to maintain the Service or respond to a support request you raise.

How long we keep it

We retain instructor account data while the account is active. Student training records are retained to help instructors meet BC record-keeping expectations (ICBC's Motor Vehicle Act Regulations contemplate retaining instruction records for six years). Instructors can export a student's full data dossier (JSON) at any time from that student's page, and can archive and request deletion of records subject to that retention period. When you close your account, we delete or de-identify data that we are not required to retain.

Self-enrollment submissions: when a prospective student fills in a self-enrollment form an instructor sent them, that submission waits for the instructor to accept or decline it. If a submission is never accepted or declined, it is automatically deleted 30 days after it was submitted, so pending intake details are not kept indefinitely.

Cookies & local storage

copilotBC sets no cookies of its own and uses no advertising or cross-site tracking technologies — on this website or in the app. That's why you don't see a cookie banner. This website uses Cloudflare Web Analytics, a privacy-first measurement tool that counts page views in aggregate without cookies, local storage, or any personal identifiers — it tells us how many people visited a page, never who. The app itself contains no analytics at all. The app stores your settings and a copy of recent records in your browser's local storage so it works offline; that data stays on your device and is cleared when you sign out. Two third-party services are the only other exceptions: the app uses Google reCAPTCHA to verify that requests come from the genuine app (an anti-abuse security check — Google may set a cookie such as _GRECAPTCHA for its risk analysis, governed by Google's privacy policy), and when you pay you are redirected to Stripe's own checkout page (checkout.stripe.com), where Stripe may set its own fraud-prevention cookies under Stripe's privacy policy. Both serve security purposes only — neither is used for advertising or cross-site tracking by us.

Security

We protect personal information with measures including encrypted connections, server-side access rules that isolate each instructor's data, email verification on accounts, app-integrity checks, and input validation. No system is perfectly secure, but we work to safeguard your information and to limit access to only what is necessary.

Your rights

Under PIPA, individuals have the right to access the personal information held about them, to request corrections, and to ask questions about how it is used. If you are a student or parent, the instructor who holds your record is your first point of contact. For requests about an instructor account, or to reach us directly, email privacy@copilotbc.ca — we'll respond within 30 days as PIPA requires.

Children's information

Many driving students are minors. copilotBC is used by the instructor, not directly by students. Where a student is under 19, the instructor is responsible for obtaining consent from a parent or guardian before entering the student's personal information.

Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date above and, for material changes, notify you in the app or by email.

Contact

Privacy questions or requests: privacy@copilotbc.ca.