Effective Date: April 1, 2026 • Version 1.0
Jimamu Inc. ("Jimamu," "we," "our," or "us") is a federally incorporated Canadian company that operates the Caro peer-to-peer delivery platform (the "Platform" or "Caro"). We are the data controller responsible for the personal information collected through the Caro mobile application, website, and related services.
Privacy Officer: Jimamu Inc.
Mailing Address: 2505 116 St NW, Canada
Email: info@thecaro.app
General Legal: info@thecaro.app
We will respond to all privacy inquiries within 30 calendar days.
This Privacy Policy applies to all individuals who interact with the Caro Platform, including:
This Policy covers data collected through the Caro mobile application (iOS and Android), the Caro web interface, communications with our support team, and any integrations with third-party services enabled by us. It does not govern the privacy practices of third parties whose links may appear on the Platform.
We are committed to compliance with all applicable privacy and data protection laws, including:
We apply the highest applicable standard from the above frameworks to all users, regardless of location, as a matter of policy.
Background location is collected from Riders only while their status is set to "Online." We do not collect Rider location data when the app is closed or when the Rider is set to "Offline."
We process personal information only for specific, legitimate purposes. For each purpose, we identify the applicable legal basis:
We use your information to create and maintain your account, match Customers with available Riders, facilitate package pickup and delivery, process payments and disburse Rider earnings, and provide in-app navigation and real-time delivery tracking.
Legal Basis: Performance of a contract with you.
We use information to verify the identity of Riders, detect and prevent fraudulent activity and abuse, monitor for prohibited items or suspicious delivery requests, and ensure the safety of both parties during a transaction.
Legal Basis: Legitimate interests; compliance with legal obligations.
We process financial and identity data to issue Canadian tax documents (T4A and other applicable forms), comply with anti-money-laundering (AML) and know-your-customer (KYC) obligations, respond to lawful requests from government authorities or courts, and satisfy customs and import/export reporting requirements for international deliveries.
Legal Basis: Legal obligation.
We use your account data, transaction history, and package photographs to investigate and resolve disputes relating to lost, damaged, or undelivered packages, respond to support inquiries, and enforce our policies.
Legal Basis: Legitimate interests; performance of a contract.
We use aggregated, de-identified data to understand how the Platform is used, identify technical issues, improve matching algorithms, and develop new features.
Legal Basis: Legitimate interests; consent (where required).
With your consent, we may send promotional emails, push notifications, or in-app messages about new features, promotions, or service updates. You may opt out at any time through your account settings.
Legal Basis: Consent.
Jimamu does not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information only in the following circumstances:
We engage trusted third-party vendors under strict data processing agreements (DPAs), including payment processors, identity verification providers, cloud infrastructure providers, customer support software providers, analytics platforms (using de-identified data only), and SMS/push notification services.
We may disclose your information to government agencies, law enforcement, tax authorities (including the CRA), or courts when required by applicable law, to enforce our Terms, prevent imminent harm, or for customs clearance in international deliveries.
In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the successor entity. We will provide notice before your information becomes subject to a materially different privacy policy.
We may share your information for any other purpose with your explicit, prior consent.
Caro operates internationally. Your personal information may be transferred to, stored in, and processed in countries other than the country in which you reside, including Canada, the United States, and other jurisdictions where our service providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), adequacy decisions, binding corporate rules, or your explicit consent where no other mechanism applies.
You may disable location permissions through your device's operating system settings at any time. Disabling location access will prevent core delivery functionality from operating correctly.
We implement administrative, technical, and physical safeguards including:
No method of electronic transmission or storage is 100% secure. In the event of a breach affecting your rights and freedoms, we will notify you and applicable authorities as required by law.
We retain personal information only for as long as necessary. Our retention schedule:
| Data Type | Retention Period |
|---|---|
| Account data (active accounts) | Duration of account relationship + 2 years |
| Financial records and transaction history | Minimum 7 years (Canadian tax law) |
| Identity verification documents (Rider IDs, SIN) | Duration of Rider relationship + 7 years |
| Delivery records (package photos, logs) | 3 years for dispute resolution |
| Support communications | 2 years from date of resolution |
| Device logs and analytics data | 13 months (then aggregated/de-identified) |
Upon account deletion, we will delete or anonymize your personal information within 90 days, except where retention is required by law or for outstanding disputes or legal proceedings.
Depending on your location and applicable law, you have the following rights:
To exercise any of these rights, contact us at privacy@caroapp.com. We will respond within 30 days. If you are dissatisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).
The Caro Platform is not directed to children under the age of 18. We do not knowingly collect personal information from individuals under 18 years of age. If you believe a minor has provided us with personal information, please contact us at privacy@caroapp.com.
Our website and app may use cookies, pixel tags, SDKs, and similar tracking technologies to:
You can manage cookie preferences through your browser settings. Our mobile application relies on SDK-level tracking, which can be managed through your device's privacy settings.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification, email, or prominent notice on our website at least 14 days before the change takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.
If you have questions about this policy or wish to exercise your rights, contact our Privacy Officer:
Email: info@thecaro.app
Privacy Requests: privacy@caroapp.com
Address: 2505 116 St NW, Canada
Response Time: Within 30 calendar days