1. Who is responsible for your data
Fleet Cost, 52 Buffel Str, Hoedspruit, 1380, South Africa is the Responsible Party under the Protection of Personal Information Act, 2013 (POPIA), and the Data Controller under the EU General Data Protection Regulation (GDPR) where it applies. You can reach our privacy contact at hpbza@icloud.com.
2. What we collect
Account & billing information — name, email, password (stored as a bcrypt hash), company name, phone number, subscription and payment metadata.
Fleet data — vehicle, driver, supplier, cost, incident, licence and document data that you or your team members upload to your tenant.
Technical data — IP address, browser + device metadata, log lines, error traces and security events (used to keep the Service up and safe).
Communications — emails you send us, support tickets, and delivery receipts for the emails we send you (verification, password reset, digests).
3. Why we process it & our lawful basis
- To provide the Service — contract with you (POPIA s.11(1)(b) / GDPR Art 6(1)(b)).
- To send transactional emails (verification, password reset, service alerts, daily digests you opted into) — contract and, where applicable, your consent.
- To keep the Service secure & prevent abuse — legitimate interest (POPIA s.11(1)(f) / GDPR Art 6(1)(f)).
- To meet legal obligations — tax, accounting, statutory record-keeping (POPIA s.11(1)(c) / GDPR Art 6(1)(c)).
- To improve the product — aggregate, non-personal analytics; legitimate interest.
4. Who we share it with
We only share personal information with vetted operators (Operators under POPIA / Processors under GDPR) acting under written contract:
- Emergent — hosting, application platform, database, object storage.
- Resend — transactional email delivery.
- Stripe (when payments are enabled) — card processing.
- Government, regulators or courts, only when compelled by valid legal process.
We do not sell personal information. We do not use your fleet data to train AI models for other customers.
5. Where your data lives & cross-border transfers
We host in cloud regions selected by Emergent. Personal information may be transferred outside South Africa or the EEA when we use these Operators. Where we do, we rely on contractual safeguards (POPIA s.72 conditions / GDPR Art 46 Standard Contractual Clauses) to protect your data to an equivalent level.
6. How long we keep it
- While your account is active.
- Customer Data for 30 days after account closure so you can export it.
- Billing and tax records for 5 years, or longer if required by law.
- Security logs for up to 12 months.
- Backups purge on rolling 30-day cycles.
7. Your rights
Under POPIA (and GDPR where it applies) you can, subject to limits and verification:
- Access the personal information we hold about you and get a copy.
- Correct or update inaccurate information.
- Ask us to delete information we no longer need to keep.
- Object to processing based on legitimate interest.
- Withdraw consent for any processing that relies on it (e.g. optional emails).
- Port your data to another service in a machine-readable format.
- Complain to the South African Information Regulator (inforeg@justice.gov.za) or your local EU supervisory authority.
Send requests to hpbza@icloud.com and we’ll respond within 30 days.
8. Security
We hash passwords with bcrypt, store auth tokens in httpOnly cookies over TLS, rate-limit login and verification attempts, and isolate every tenant’s data server-side. No system is perfect — if you spot a security issue, please email hpbza@icloud.com.
9. Cookies
We use strictly-necessary cookies to keep you logged in (an httpOnly access-token cookie) and a small localStorage flag for user preferences (e.g. “exclude private vehicles” on Reports). We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent the Service from working.
10. Children
FleetCost.App is not intended for anyone under 18. Do not create an account or upload personal information about minors.
11. Changes to this Policy
We may update this Policy. Material changes are announced at least 14 days ahead by email to account owners. The “Effective date” at the top of this page always reflects the current version.
12. Contact & Information Officer
For any privacy question, POPIA request, or GDPR data-subject request, contact us at hpbza@icloud.com or 52 Buffel Str, Hoedspruit, 1380, South Africa. The Information Officer for Fleet Cost is the account owner listed on our registration with the Information Regulator.