Privacy Policy

FleetKoin is a fleet operations console sold to transport businesses. That makes two different relationships, and this policy treats them differently.

• Data your firm records in the console — drivers, customers, vendors, trips, expenses, documents. Your firm decides what to record and why. Under India’s Digital Personal Data Protection Act, 2023, your firm is the Data Fiduciary for that material and we are its Data Processor. We process it only to run the console for you, on your instructions.
• Data about your account with us — the name, work email and phone number of the people you give logins to, and your billing particulars. We decide how to use this, so for it we are the Data Fiduciary.

We hold the following, and nothing beyond it:

• Account data — user name, work email, phone number, role, and a one-way hash of the password. We never store passwords in a readable form.
• Company data — legal and trade name, GSTIN, PAN, registered address, contact email and phone.
• Operational data your firm enters — driver names, phone numbers, licence numbers and expiry dates; customer and vendor contacts, GSTIN, PAN and, where you record them for payment, bank particulars; loads, trips, routes, expenses, settlements, invoices and receipts.
• Documents you upload — permits, fitness and insurance certificates, licences, proof of delivery, bills and receipts, together with the file name, type and upload time.
• Technical data — an audit record of significant changes made in the console (what changed, by which user, when), and standard server logs containing IP address, browser and timestamps.

We do not run advertising, we do not sell data to anyone, and we do not use your operational data to build products for other customers.

• To run the console — showing your trucks, trips, money and papers to the people you have given logins to.
• To authenticate users and keep one firm's data out of another firm's console.
• To keep an audit trail, so a disputed figure can be traced to who entered or changed it.
• To provide support when you ask for it, and to keep backups against loss.
• To bill you, and to meet our own tax and accounting obligations.
• To tell you about service matters — outages, security notices, material changes to this policy or the terms.

For account data, our lawful basis is the performance of our contract with you and our legitimate interest in running and securing the service. For operational data we act on your firm’s instructions; the lawful basis for collecting it from the people concerned is your firm’s to establish.

• Data is held in a managed PostgreSQL database and, for uploads, in a private object store. Both are hosted in India where our provider offers it.
• The document store is private. Files are never publicly addressable — the console mints a short-lived signed link each time an authorised user opens one.
• Traffic runs over TLS. Passwords are stored only as bcrypt hashes.
• Access is scoped by company and by role: a login can only reach its own firm's data, and only the parts its role permits.
• Access to production systems by our staff is limited to those who need it to operate or support the service.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

We share data only with service providers who help us run FleetKoin, and only as far as their work requires. These are our hosting and database provider, our object storage provider, and — if and when enabled for your account — an email delivery provider and a payment gateway. Each is bound to protect the data and to use it for no other purpose.

Beyond that we disclose data only where the law compels us, or to establish or defend a legal claim. We will tell you before doing so unless we are prohibited from telling you.

Your data stays for as long as your account is open. When it closes, you may export your data for 30 days; after that we delete or irreversibly anonymise it within 90 days, except where we must keep records longer to meet tax, accounting or other legal obligations. Backups age out on their own cycle and are overwritten within 90 days.

Under the DPDP Act you may ask for a summary of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, and nominate someone to exercise these rights if you cannot. You may also withdraw consent where consent is what we rely on.

If you are a driver, customer or vendor whose details sit in a transport firm’s console, that firm decides what is held about you — please approach the firm first. Tell us and we will point you to the right one and assist them in answering you.

To exercise a right, or to complain about how we have handled your data, write to our Grievance Officer, Grievance Officer, at privacy@example.com. We answer within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

FleetKoin sets one cookie: a signed, encrypted session cookie that keeps you logged in. It is strictly necessary for the console to work and carries no advertising or cross-site tracking. We run no third-party analytics or advertising trackers, which is why you are not being asked to accept anything.

FleetKoin is a business tool and is not directed at children. We do not knowingly collect the personal data of anyone under 18. If you believe a child’s data has reached the console, tell us and we will remove it.

We may update this policy as the service changes. The date at the top of the page always reflects the current version. If a change materially affects your rights we will tell account administrators by email before it takes effect.