Privacy Policy

1. Information We Collect

We collect the following categories of information:

Account and Registration Data

When you create an account, we collect your name, email address, company name, phone number, and billing information. This information is necessary to provide the Service and process payments.

Usage and Platform Data

We collect data about how you use the Service, including log data (IP addresses, browser type, pages visited, timestamps), feature usage, API calls, webhook sends, and billable resource counts. This helps us improve the Service, bill accurately, and detect issues.

Customer Data

We process data that you submit to the Service in the course of your operations — including order details, driver information, vehicle data, customer contacts, and delivery records. This data belongs to you and is processed on your behalf.

Location Data

Our mobile applications access and collect precise location (GPS) and approximate location from a driver’s device while the driver is signed in and set to Online, including while the app is in the background or closed. Our website and web console do not collect precise location. Section 2 sets out exactly what location data we access, when we access it, how we use it, who it is shared with, and how you can control or revoke it.

Device Data

When you use our mobile applications, we collect device identifiers, operating system and app version, device model, network connection type, device language and region, battery level and charging state, and push notification tokens. We use this to deliver notifications, diagnose crashes, and support devices in the field.

Camera and Photos

With your permission, the driver app uses your device camera to scan QR codes, capture proof-of-delivery photos, and take a profile picture, and accesses your photo library so you can upload or save those images. Signatures you draw for proof of delivery are captured as images and attached to the order record. These permissions are optional, are requested only at the point of use, and can be revoked at any time in your device settings; declining them disables only the related feature.

Account Authentication Data

The driver app supports signing in with a phone number and one-time code, or with Apple, Google, or Facebook. If you use a social sign-in, that provider confirms your identity to us and shares basic profile information such as your name and email address; your credentials are never seen by Fleetbase. We use these providers for authentication only, not for advertising. Session tokens are stored in your device’s secure keychain or keystore.

Communications Data

If you contact us via email, chat, or our support system, we retain records of those communications to help resolve your enquiries and improve our support.

2. Location Data and Mobile Applications

Our mobile applications — including Fleetbase Navigator, our driver application for iOS and Android — access and collect location data. This section explains what we collect, when we collect it, why we collect it, and how you can control it.

What location data we access and collect

• Precise location (GPS) — latitude, longitude, altitude, heading, speed, and timestamp, read from your device’s location services at high accuracy.
• Approximate location — derived from network, Wi-Fi, or cell signals where precise location is unavailable or has not been granted.
• Background location — location collected while the app is not on screen, the device is locked, or the app has been closed, as described below.
• Motion and activity data — the device’s detected activity type (for example still, walking, or in a vehicle) and whether the device is currently moving. This is used to decide when to record a location point and to distinguish driving from stops.
• Device battery status — battery level and whether the device is charging, sent alongside each location point so dispatchers can tell when a driver’s device is about to lose power.

A location point is recorded when the device moves more than approximately 10 metres, and the app additionally refreshes location on a periodic background check roughly every 5 minutes while you are Online. Each point is transmitted over an encrypted connection to your organisation’s Fleetbase instance and is also cached on the device so the app works through poor connectivity.

When we collect it

Location collection is controlled by the Online / Offline switch in the driver app. We collect location whenever all three of the following are true: you are signed in to the app, you have set yourself to Online, and you have granted location permission. Collection is not limited to times when you have an assigned order — if you are Online, location is collected even when you have no active trip.

Collection stops as soon as you set yourself to Offline, sign out, or revoke location permission in your device settings. We do not collect location while you are Offline or signed out.

Background and closed-app collection. While you are Online, the app continues to collect location when it is in the background, when the screen is locked, and after the app has been closed or removed from the recent-apps list, so that live tracking, ETAs, and route history remain accurate. Collection also resumes automatically after your device restarts if you were Online when it shut down. On Android this runs as a foreground service, which the system displays as a persistent notification while location is being collected; on iOS the system location indicator is shown. This is why the app asks for “Allow all the time” (Android) and “Always” (iOS) location access rather than while-in-use access only.

How we use it

• Show the driver’s live position to their dispatcher and fleet operator in the operational console.
• Provide navigation and routing to pickup and drop-off locations.
• Calculate ETAs, distance travelled, route history, and trip actualisation.
• Timestamp and verify operational events — arrival, pickup, boarding, drop-off, proof of delivery, and zone or geofence entry and exit.
• Support safety, incident investigation, and dispute resolution.
• Produce operational and performance reporting for the fleet operator.
• Use motion and activity signals to record location efficiently and preserve device battery, and surface battery status so dispatchers know when a driver’s device may go offline.

We do not use location data for advertising, and we do not sell it.

Who it is shared with

Location collected through our mobile applications is Customer Data. The app transmits it directly to the Fleetbase instance operated by the organisation that issued your driver account — normally your employer or contracting organisation — where it is available to that organisation’s authorised users and integrations. Where that organisation self-hosts Fleetbase, your location data goes to their infrastructure and is not received by Fleetbase at all.

We do not transmit location data to any third-party advertising or analytics service, and the driver app contains no advertising SDK. Location is otherwise shared only with the infrastructure, mapping, and routing providers used to deliver these features — including Google Maps for in-app maps and directions — and with authorities where we are legally required to do so, as set out in section 5. If you choose to open a route in an external navigation app such as Google Maps or Waze, the destination is handed to that app and is then governed by that app’s own privacy policy.

Retention

Location points and trip history are retained for as long as the fleet operator’s account is active, subject to any retention period that operator configures, and are then deleted in accordance with section 6.

Your choices and how to revoke access

Going Offline is the primary control. Setting yourself to Offline in the app stops location collection immediately, including background collection, without changing any device permission. Signing out has the same effect.

Location permission is requested at runtime, and you can grant, limit, or revoke it at any time in your device settings — on Android under Settings → Apps → Fleetbase Navigator → Permissions → Location, and on iOS under Settings → Privacy & Security → Location Services → Fleetbase Navigator. The app checks your permission each time it returns to the foreground and stops tracking if the permission has been withdrawn. Revoking location access will prevent the app from performing live tracking, navigation, and trip updates, and your fleet operator may require it as a condition of using the app for work. Because your fleet operator controls this data, please direct access, correction, and deletion requests to them in the first instance; see section 9 for your rights and our contact details.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Track trips in real time, navigate drivers, calculate ETAs, and record route history using location data collected by our mobile applications (see section 2).
• Process transactions and send billing-related communications.
• Respond to your enquiries and provide customer support.
• Send product updates, security notices, and administrative messages.
• Monitor and analyse usage patterns to improve the Service.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.
• Send marketing communications where you have given consent (you may opt out at any time).

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing your personal data are:

• Contract performance — processing necessary to provide the Service under our agreement with you.
• Legitimate interests — improving the Service, preventing fraud, and communicating about relevant updates.
• Legal obligation — complying with applicable laws and regulations.
• Consent — for marketing communications and optional cookies.

5. How We Share Your Information

We do not sell your personal data, and we do not share it for advertising purposes. We may share your information with:

• Service providers — trusted third parties who assist us in operating the Service (e.g. cloud infrastructure providers, payment processors, email service providers). These parties are contractually bound to protect your data.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
• Legal requirements — when required by law, court order, or government authority, or to protect the rights, property, or safety of Fleetbase, our customers, or the public.
• Your fleet operator — if you use our mobile applications as a driver, the operational data you generate, including location and trip history, is made available to the organisation that issued your account and its authorised users and integrations (see section 2).

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. After account termination, we retain Customer Data for up to 30 days to allow you to export it, after which it is securely deleted. We may retain certain data for longer periods where required by law or for legitimate business purposes (e.g. billing records for 7 years as required by Singapore accounting regulations). Location and trip history collected through our mobile applications is retained on the same basis, subject to any shorter retention period configured by the fleet operator.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+).
• Role-based access controls limiting data access to authorised personnel.
• Regular security audits and vulnerability assessments.
• Multi-factor authentication for internal systems.
• Incident response procedures for security breaches.

While we take reasonable steps to protect your data, no security system is impenetrable. In the event of a data breach affecting your personal data, we will notify you as required by applicable law.

8. International Data Transfers

Fleetbase is headquartered in Singapore. Your data may be processed in Singapore and in other countries where our service providers operate. When transferring data from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data receives an adequate level of protection.

9. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data (subject to legal retention obligations).
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us at hello@fleetbase.io. We will respond within 30 days. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website to improve your experience, analyse traffic, and personalise content. You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our website. We do not use cookies to track you across third-party websites for advertising purposes.

We use PostHog for first-party product analytics: pageviews, button clicks, and aggregate usage patterns help us understand which parts of the site are useful and which are not. PostHog cookies (prefixed ph_) are stored on the .fleetbase.io domain. We never capture form field values, and session replays mask all input fields by default. Visitors in the EU, EEA, UK, and Switzerland are asked to opt in before any data is captured. You can withdraw consent at any time by clearing the fb_consent cookie or contacting us at hello@fleetbase.io. We honor the Global Privacy Control (Sec-GPC) signal globally.

We also use Google Analytics 4 on the marketing website for SEO attribution (Google Search Console) and Google Ads conversion tracking. GA4 cookies (_ga, _ga_*) are stored on the fleetbase.io domain. The GA4 loader script and data-collection requests are proxied through our own origin (/gtm/* and /g/collect) so no third-party hostnames are contacted by your browser. Google Analytics is governed by Google’s privacy policy. Visitors in opt-in jurisdictions are placed under Google’s Consent Mode v2 default-denied state until they accept; even after acceptance, IP addresses are anonymised and we only forward conversion events (such as trial signups and demo requests), not the full event firehose. GA4 is not loaded on console.fleetbase.io.

We use Ahrefs Web Analytics to cross-reference site traffic with our Ahrefs SEO data (organic landing pages, referring domains, content performance). Ahrefs Web Analytics is cookieless and does not use fingerprinting or any cross-site identifiers — it does not set any cookies on your browser and does not require consent under GDPR. The script is served from analytics.ahrefs.com; only anonymous, aggregated pageview data is collected. Ahrefs’ processing is governed by the Ahrefs privacy policy.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at hello@fleetbase.io and we will take steps to delete it.

12. Third-Party Services

The Service may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with Fleetbase.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer: