Your students' data, treated with care.

Who we are, and our two roles

copilotBC is the business name under which Shandria Caroline Kyla Slade, a sole proprietor located in British Columbia, Canada, carries on business. You can reach us about privacy at [email protected].

copilotBC is a tool for BC driving schools. The school — which in BC always has at least one licensed instructor, and may have several — is our direct customer. Its students (and, where applicable, their parents or guardians) are not our direct customers, but their personal information is processed through copilotBC on the school's behalf.

• For an instructor's own account information, copilotBC is the organization responsible for that information.
• For student records entered in the app, the driving school is responsible for that information and for obtaining the consents required under PIPA; copilotBC processes it on the school's behalf to provide the Service. Where a school runs more than one instructor, the school's records are visible to the people who run it as well as to the instructor who entered them.

What we collect

• Instructor account data: name, email address, instructor/licence identifiers you enter, and subscription status. Payments are processed by Stripe (see below) — we never see or store your full card number. Instructors who enable lesson payouts also complete Stripe's identity/banking verification directly with Stripe; copilotBC stores only the Stripe account reference and whether payouts are enabled.
• Student records the instructor enters: the student's full legal name, date of birth, mailing address, phone and email, parent/guardian contact (for minors), licence details (BC driver's licence number and class, e.g. "Class 7L", and the transmission they train on), and training records: lesson dates, start and end times, duration, focus, fee charged, instructor notes, per-skill marks and notes, odometer readings, whether a lesson was driven at night, parent-supervised practice hours, readiness assessments, signatures captured for lesson sign-off, and instructor reports. We do not ask for medical information or any government ID beyond the driver's licence details the record requires.
• Signature evidence: when a lesson is signed off electronically, a server timestamp and the user-agent string of the browser or app used to sign are recorded with the signature.
• Lesson distance: in the copilotBC apps for Android and iPhone this is on unless the instructor turns it off, and on the web it is not available at all. The app measures only the total kilometres driven during a lesson as a cross-check for mileage/tax tracking. The lesson's position, route and coordinates are never stored and never sent to us. The live position is processed on the instructor's device and discarded.
• Tap to Pay (the Android app, and the iPhone app where it is available): when an instructor takes a card on their own phone, Stripe's Terminal software uses the phone's precise location at the moment of the sale and sends it to Stripe, which checks where the payment happens to prevent fraud. copilotBC does not store it. On Android, Stripe's software also holds permission to read the phone's state, and may read device identifiers, for the same security checks.
• Operational data: sync timestamps, device type and user-agent for offline reconciliation and security; an audit log of changes to the account's records and of session events, kept with the account for record-keeping and security; and a log of each email we send (who it went to, what kind of email it was and when, without the message itself), deleted after 30 days, with the reason when an email fails to send. When the app waits too long for the database, it sends us a short technical report: how long it waited, which part of the app was open, the app version and the browser type. The report carries no name, email address or account ID, and we delete it after 30 days. The app sends no other crash reports or error logs. Any other error shown on screen stays on the device.
• Device identifiers: when someone turns on notifications, we store the push token for that device (on the web, the browser's push subscription address) under their account, so alerts reach it. In the copilotBC apps for Android and iPhone, Google's Firebase Cloud Messaging also uses a Firebase Installation ID for that install of the app. Every copy of the app also obtains short-lived App Check tokens, which are sent with its requests to Firebase to show they come from the genuine app (see "Cookies & local storage" below). None of these is used for advertising or to track anyone.
• Help assistant: the question an instructor types into the in-app help assistant is sent to Google's Gemini API to be answered (see "Service providers" below), and copilotBC does not store the conversation. If the instructor taps Report this answer, or sends a feature request from the assistant, an email goes to our support inbox through ZeptoMail. It carries the question and answer or the request, an excerpt of that chat, and the instructor's name and email address, so we can follow up.
• School documents: an instructor or a school may upload its own policy document and disclosure document as PDF files. We store them with that instructor's or school's records and show them to that instructor's students, who read and sign them when they enrol.
• Voice notes (optional, off by default, and only with the student's agreement): a lesson is not recorded unless two separate things are true — the instructor has turned the feature on, and that particular student has agreed to be recorded. Students are asked once, when they enrol, in a document of their own, and saying no is a complete answer: it changes nothing about their lessons, booking, reports or record, and they are not asked again. A student (or their parent or guardian) can withdraw at any time from My account in the student portal. Where a student has agreed: audio is transcribed on the instructor's device and is not sent to us for transcription; the clips themselves are stored only in on-device storage (the browser's, or the app's), on the instructor's device and are never uploaded to copilotBC; only the text transcription the instructor chooses to keep reaches the lesson record. Clips are deleted automatically after a window the instructor sets, up to a maximum of 90 days, and can be deleted sooner by hand. Two limits we want to state plainly rather than bury: withdrawing agreement deletes the audio, not the training record — written notes already saved are part of that record, which BC's driver-training rules require be kept for six years; and because the audio lives on the instructor's own device and nowhere else, deletion happens the next time that instructor opens the app, with the confirmed date shown in the student's portal.

Why we collect it

British Columbia's Motor Vehicle Act Regulations, Division 27, require licensed driving instructors to keep a record of every student and every lesson. The student information above is what that regulation describes, so that the instructor can produce a training record aligned with what Division 27 calls for on request.

We use this information only to provide and operate the Service: to run your account, store and sync your records, generate reports and exports based on ICBC/BC formats, process your subscription, keep the Service secure, and respond to support requests. We do not sell personal information, and we do not use student records for advertising.

Where it lives

Your records database is stored in Google Cloud Firestore in the Toronto (northamerica-northeast2) region. We do not take or hold separate backup copies of it ourselves; its durability is Google Cloud's. A few operational pieces of the Service do involve processing outside Canada. Two of them reach Google's Gemini API in the United States, and they are separate: the optional AI assistance feature (off by default) sends lesson text to tidy transcripts and draft reports, if and only if an instructor turns it on (see "AI assistance" below for what is sent); and the in-app help assistant sends the question an instructor types, so it can be answered from our published help pages, with no student record, lesson or report attached. The third is the delivery of transactional emails and some serverless processing (via ZeptoMail and Cloudflare, see below), which route recipient email addresses and lesson details through infrastructure that may sit outside Canada. Two more, Google Fonts and Hugging Face, serve the typefaces and the on-device speech model the app downloads; they receive only the IP address of the device that asks, and may sit outside Canada. The records database itself stays in the Canadian region. The Service is delivered over encrypted (HTTPS) connections.

AI assistance (optional, off by default)

copilotBC includes an optional AI feature that an instructor can turn on in Settings. It tidies up dictated voice-note transcripts, and it drafts a first version of the end-of-lesson report for the instructor to review and edit. It is off by default, the instructor must accept a specific consent notice before it is turned on, and it can be turned off again at any time. When it is on, the relevant text is sent to Google's Gemini API in the United States, by way of a server we operate that holds the provider key.

• For report drafting, the student's name is replaced with a placeholder before the text is sent and put back on the instructor's device afterwards. The student's contact details are not sent.
• For voice-note cleanup, the spoken words are sent as transcribed, so a name spoken aloud can be included in that text.
• When the feature is off, no training-record text is sent to any AI provider.

Service providers we rely on

• Google Cloud / Firebase — hosting, authentication (including Google Sign-In, if you choose it), and the Firestore database (Canadian region).
• Apple — Sign in with Apple, if you choose it to sign in. Apple shares the email address on your Apple account with us, which can be a private relay address Apple creates, and may share your name. Apple is subject to its own privacy policy.
• Stripe — our payments processor. Stripe handles checkout, card processing, subscription billing, payments a student or parent makes to their instructor, and (for instructors who enable lesson payouts) identity and banking verification through Stripe Connect. Card details go directly to Stripe and never touch copilotBC's systems. In the apps, Tap to Pay uses Stripe Terminal on the instructor's phone (see Tap to Pay above). Stripe is subject to its own privacy policy (available at stripe.com/privacy) and may process payment data outside Canada.
• Google (Gemini API) — AI assistance (optional, off by default) and in-app help — two separate uses, both reaching Google's Gemini API in the United States. Only if an instructor enables AI assistance, lesson text is sent to clean up transcripts and draft reports, as described under "AI assistance" above. Separately, when an instructor uses the help assistant inside the app, the question they type is sent so it can be answered from our published help pages. That one carries only what the instructor types, and no student record, lesson or report is attached to it. If the instructor reports an answer or sends a feature request from the assistant, an excerpt of that chat is emailed to our support inbox (see "Help assistant" above).
• ZeptoMail (Zoho Corporation) — our transactional email provider. ZeptoMail delivers every email copilotBC sends: the account, security and service emails to instructors and school owners, the lesson and enrolment emails to the students and parents/guardians whose contact details the instructor enters, including lesson confirmed, lesson cancelled, reminders and any payment-request links, and support tickets to our own support inbox. Each kind is listed under "Email & notifications" below. To send a message, it processes the recipient's email address, name, and the lesson details contained in that message; ZeptoMail is subject to Zoho's own privacy policy and may process this information outside Canada (in the United States).
• Google Fonts — this website and the app load their typefaces from Google Fonts, and an email client may do the same when it opens an email from us. Google receives the IP address of the device making the request, as with any web request, and no account or record data. Google Fonts is subject to Google's privacy policy.
• Hugging Face — the app downloads the speech-recognition model that turns voice notes into text on the device from Hugging Face, either when a voice note is first recorded or ahead of time over Wi-Fi in the installed app. The download sends only what any web request sends, such as the device's IP address. No audio, transcript or record goes with it. Hugging Face is subject to its own privacy policy.
• Cloudflare — serverless Cloudflare Workers power scheduled lesson reminders, push-notification payloads, our transactional email dispatch pipeline, and our payment (Stripe) endpoints, so some personal data (such as email addresses, lesson details, notification text, and payment metadata) passes through Cloudflare's global edge network in transit and processing, which may be outside Canada. Cloudflare also provides the cookieless, aggregate Web Analytics on this website (see below). It is subject to its own privacy policy.
• Push notification services — when someone turns on notifications, the notification text (for example a lesson reminder with the time, the student's name and the lesson focus) is delivered through the push service for their device: Google's Firebase Cloud Messaging for the copilotBC apps for Android and iPhone, which hands the message to Apple's push service on iPhone, or the push service run by the maker of the web browser. On the web the notification content is encrypted so that only the receiving device can read it. These services may process this information outside Canada.
• An instructor's own calendar provider (Google, Apple or Microsoft) — optional, off by default, and chosen by the instructor rather than by copilotBC. An instructor may create a read-only calendar link and subscribe to it from the calendar app on their phone, so their lessons appear beside the rest of their day. A new link carries the date, the time and the length of each lesson and nothing else. If the instructor also turns on the separate student-details setting, the link additionally carries the student's name and the pickup address for each lesson, and the calendar provider then fetches and stores its own copy on its servers, which may be outside Canada. The link is per instructor, is revocable at any time, and can be replaced, though replacing it does not remove entries the provider has already stored.
• Google Calendar — optional, off by default, and only if an instructor connects it in Settings. copilotBC then reads the busy and free times on the instructor's main Google calendar to block those times on their booking page. It never reads event titles, details or guests. We store those busy times and an encrypted access token. Disconnecting in Settings deletes both.

These providers are bound to process information only as needed to provide their services to us. We choose providers that protect personal information to a standard at least equal to this policy.

Who can see your data

• The instructor who entered the data.
• Other people at the driving school that holds the record: the people who run the school, and any other instructor there who teaches that student. A school owner's access is read-only, and it exists only where the instructor has accepted a seat at that school — an owner cannot reach the records of an instructor who has not.
• A student or their parent/guardian, for the specific report or sign-off link the instructor chooses to share with them, and through a student portal account if they have one.
• copilotBC operators, only as needed to maintain the Service or respond to a support request you raise.
• ICBC — only when the instructor uses the DTC205 consent form to book a road test on a student's behalf; the limited information listed on that form is disclosed to ICBC.

Email & notifications

copilotBC sends email on your behalf. Instructors receive account and service emails — email verification, password reset, and subscription or service notices. Instructors and school owners also receive a security alert when a recovery code is used to remove a second sign-in step, notices when a school's seats change, a notice when a self-enrolment submission is waiting for review, notices before a document or credential on file (such as a licence) expires, and, if the instructor turns it on, a daily digest listing the emails copilotBC sent for them. Students and their parents/guardians receive automatic transactional lesson notifications — when a lesson is confirmed or cancelled, and lesson reminders — along with any payment-request links the instructor sends. They also receive the lesson reports and progress summaries the instructor sends, consent and signature requests, enrolment invitations and reminders about enrolment documents still to sign, and, for a lesson package, the package terms before purchase and the written package agreement. When an instructor reports a help-assistant answer, sends a feature request or asks to close their account, a support ticket is emailed to our own support inbox. These are transactional, relationship messages tied to a specific booking, enrolment or account, not marketing, so there is no marketing opt-out; they are part of using the Service. The instructor is responsible for having the consent required under PIPA and Canada's anti-spam law (CASL) to add the student and parent/guardian contacts they enter. These emails are delivered through our email provider, ZeptoMail (Zoho Corporation), described above.

How long we keep it

We retain instructor account data while the account is active. Student training records are retained to help instructors meet BC record-keeping expectations (ICBC's Motor Vehicle Act Regulations contemplate retaining instruction records for six years), so they are kept for six years after the last lesson date, or longer where tax law requires. PIPA separately requires information used to make a decision about someone to be kept for at least one year. We follow the longer of the two, then securely destroy or anonymize the records. Instructors can export a student's full data dossier (JSON) at any time from that student's page, and can archive and request deletion of records subject to that retention period. When you close your account, we delete or de-identify data that we are not required to retain. An instructor can close their account in the app on Android or iPhone, or at app.copilotbc.ca (Settings → Advanced → Delete my account). Students and parents delete theirs from My account → Delete this account. Anyone who cannot sign in can email [email protected]. Step-by-step instructions are at copilotbc.ca/delete-account.html. In the app the sign-in closes immediately, and any other device still signed in loses access within the hour; for an instructor, the plan is cancelled at the same time, future lessons are cancelled, open booking requests are declined, and the students and parents on file are emailed to say so. By email we close it by hand and confirm by email. Either way, the training records held under the account stay for the six-year retention period, then are deleted.

Self-enrollment submissions: when a prospective student fills in a self-enrollment form an instructor sent them, that submission waits for the instructor to accept or decline it. If a submission is never accepted or declined, it is automatically deleted once it is more than 30 days old, so pending intake details are not kept indefinitely. The deletion is made by the instructor's copy of copilotBC the next time the instructor opens the app after that point. No server deletes it on the 30th day itself, so a submission can stay longer while the instructor does not open the app.

Cookies & local storage

copilotBC sets no cookies of its own and uses no advertising or cross-site tracking technologies — on this website or in the app. That's why you don't see a cookie banner. This website uses Cloudflare Web Analytics, a privacy-first measurement tool that counts page views in aggregate without cookies, local storage, or any personal identifiers — it tells us how many people visited a page, never who. The app itself contains no analytics at all. The app stores your settings and a copy of recent records in your browser's local storage so it works offline; that data stays on your device and is cleared when you sign out. Two third-party services are the only other exceptions: the app on the web uses Google reCAPTCHA to verify that requests come from the genuine app (an anti-abuse security check — Google may set a cookie such as _GRECAPTCHA for its risk analysis, governed by Google's privacy policy), and when you pay you are redirected to Stripe's own checkout page (checkout.stripe.com), where Stripe may set its own fraud-prevention cookies under Stripe's privacy policy. Both serve security purposes only — neither is used for advertising or cross-site tracking by us. The copilotBC apps for Android and iPhone make the same genuine-app check without reCAPTCHA and without cookies: on Android through Google Play Integrity, and on iPhone through Apple's App Attest. Each gives the app a short-lived token, sent with its requests to Firebase, that confirms the request comes from the genuine app. These checks are governed by Google's and Apple's own privacy policies.

Security

We protect personal information with measures including encrypted connections, server-side access rules that isolate each instructor's data, email verification on accounts, app-integrity checks, and input validation. No system is perfectly secure, but we work to safeguard your information and to limit access to only what is necessary.

So the app works without a connection, a copy of recent records is also kept on the instructor's device and synced when it is back online. If you believe a breach has affected your information, contact us at [email protected]; we will investigate and notify affected individuals and the OIPC where required.

Your rights

Under PIPA, individuals have the right to access the personal information held about them, to request corrections, and to ask questions about how it is used. If you are a student or parent, the instructor who holds your record is your first point of contact: they can produce a copy of your information within 30 days using the export on your student record. Where a correction concerns an instructor's opinion, such as a performance note, your requested correction is added as an annotation beside the note rather than overwriting it. For requests about an instructor account, or to reach us directly, email [email protected] — we'll respond within 30 days as PIPA requires. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

Children's information

Many driving students are minors. Students and parents can use copilotBC directly through a student portal account, on the web or in the copilotBC apps. Where a student is under 19, the instructor may also record a parent or guardian's email and/or phone, so the instructor can reach them and share training records. Under BC's privacy law the test here is capability, not age. A student who is able to understand what they are agreeing to gives their own consent, and holds their own access and correction rights, whatever their age. A parent or guardian may consent for a student, or use the rights above on the student's behalf, only where the student is not capable of doing so themselves. That is the test set by s.2(2) of the Personal Information Protection Act Regulation.

Student accounts are for people 16 or older. When someone creates a student account, we ask for their date of birth to check this, and we do not keep it. That is separate from the date of birth an instructor records on a student's training record, which is kept as part of that record.

A parent or guardian of a student under 19 is still asked to sign at enrolment, and that is a separate thing. They are agreeing to the fees and to the instructor's policies, as the person arranging and paying for the lessons, which is a matter of contract. It does not replace the student's own consent: the student signs their own enrolment consent alongside them, and ICBC's road test consent form is signed by the student alone, whatever their age.

Where a parent or guardian follows a student's progress in the student portal, that is because the student agreed to share it, or because that parent enrolled the student and arranges their lessons. It is not a separate right the parent holds over the student's record.

Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date above and, for material changes, notify instructors in the app or by email.

Contact

Privacy questions or requests: [email protected].