Privacy Policy

Glovebox is an independent reminder and document-storage service operated from Jamaica. We are not a government agency and are not affiliated with TAJ, the ITA, the Insurance Association of Jamaica, or any insurer. Contact: help@gloveboxjm.com.

We collect only what we need to run the service:

• Account details — your name, email address, and (for email sign-ups) a securely hashed password. If you choose to sign in with Google, we receive your name, email address and Google profile identifier from Google instead of a password (see “Signing in with Google” below).
• Driver & licence details — your TRN, date of birth, driver’s-licence issue date and control number, used to look up your traffic tickets and set renewal reminders.
• Vehicle & document details — plate, chassis, make/model, and your registration (eMVRC), fitness (e-Fitness), insurance and licence records, including certificate numbers, dates and any PDF certificates we retrieve for you.
• GoJ notification emails you share with us — if you forward or paste a TAJ eMVRC or ITA e-Fitness email, we read only the certificate number, masked chassis and expiry date from it to update the matching vehicle.
• Traffic-ticket data — outstanding tickets and demerit points associated with your licence.
• Device & usage data — push-notification tokens and basic technical logs needed to deliver notifications and keep the app working.
• Preferences — your notification settings and quiet hours.

We do not collect payment card numbers directly — subscription payments are handled by our payment processor.

• Store your vehicle documents and show your road-legal status.
• Retrieve your records from Jamaica’s official systems on your behalf (see below).
• Remind you — by in-app notice, push and email — before a document expires or a ticket is due.
• Check your traffic tickets and demerit standing.
• Operate households and fleets you choose to join, and provide support.

We do not sell your personal information, and we do not use it for third-party advertising.

When you ask us to, Glovebox acts as your agent and uses the details you provide to fetch your own records from the third-party systems that hold them: the GoJ’s CGDS certificate portal (your registration eMVRC, issued by TAJ, and your e-Fitness certificate, issued by the ITA), the insurance industry’s cover-verification platform (CoverVault/EpicVault, operated for the Insurance Association of Jamaica), and the GoJ traffic-ticket portal (tickets and demerit standing). We only ever look up records that belong to you or to a driver you manage, and we never enumerate or access anyone else’s data. These sources set their own availability and may change without notice; they also have their own terms and privacy notices, and may log the lookups we make on your instruction. Figures are indicative — always verify officially with TAJ, the ITA or your insurer.

You can create or access your Glovebox account using Sign in with Google. If you do, Google shares your basic profile information — your name, email address and Google account identifier — with us to create or log you into your account. We never receive or store your Google password.

We use this information solely to authenticate you and operate your Glovebox account. Glovebox’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or share it with third parties except the service providers below that help us run Glovebox. Google’s own handling of your information is governed by Google’s Privacy Policy. You can revoke Glovebox’s access at any time in your Google Account permissions.

We share limited data with vetted sub-processors strictly to run Glovebox. Each acts only on our instructions under a data-processing agreement, and none may use your data for their own purposes:

• Neon (Postgres) (United States (AWS)) — Primary application database — accounts, vehicles, documents, monitoring records (PII fields encrypted at rest by Glovebox). Safeguard: Standard Contractual Clauses + encryption at rest & in transit.
• Vercel (United States / global edge) — Application hosting, edge network, and serverless compute for the web app + API. Safeguard: Standard Contractual Clauses (Vercel DPA).
• Resend (United States) — Transactional email delivery (verification, password reset, renewal reminders, lapse alerts). Safeguard: Standard Contractual Clauses (Resend DPA).
• EpicVault / CoverVault (IAJ) (Jamaica) — Insurance-cover verification by plate/chassis for monitored vehicles. Safeguard: Domestic processing — no cross-border transfer.

If you sign in with Google, Google also authenticates you (covered above). We may disclose information if required by law.

Some sub-processors are hosted in the United States. Transfers of personal data outside Jamaica are made under the Data Protection Act 2020, safeguarded by Standard Contractual Clauses in each vendor's data-processing agreement, with encryption in transit and at rest. Sensitive fields (TRN, date of birth) are encrypted by Glovebox before storage so processors never hold them in plaintext.

Sensitive identifiers — including your TRN, date of birth and licence control number — are encrypted at rest. Passwords are stored only as salted hashes, never in plain text. Access is restricted, connections are encrypted in transit, and we follow least-privilege practices. No system is perfectly secure, but we take reasonable steps to safeguard your information.

If you join a household or fleet, the owner and managers of that group can see the licence status, tickets and demerit points of members and managed drivers, to keep everyone road-legal. Only join a group you trust. You can leave a household at any time from the app.

We keep your information while your account is active. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we must retain limited records to meet legal obligations. To close your account and request deletion, email help@gloveboxjm.com.

You may request access to, correction of, or deletion of your personal information, and you can adjust or turn off notifications in the app at any time. To exercise these rights, contact help@gloveboxjm.com. We handle requests in line with Jamaica’s Data Protection Act.

Glovebox is intended for licensed drivers and is not directed at children under 16. We do not knowingly collect data from children.

We may update this policy as the service evolves. We’ll post the new version here and update the date above; significant changes will be notified in the app or by email.

Questions or requests about your privacy: help@gloveboxjm.com.