This Privacy Policy explains how FLOTA (“FLOTA”, “we”, “us”) collects, uses, stores and shares information when you use our fleet management platform, including the FLOTA web dashboard (app.flota.me), the FLOTA mobile apps for iOS and Android, and related services (together, the “Service”).
FLOTA is a business-to-business (B2B) service provided to transport operators and fleet businesses (“Customers”). If you are a driver or employee of a Customer, that Customer is the controller of your data and this policy describes how we process it on their behalf.
01Who we are
The Service is operated by the FLOTA team. For any privacy questions or requests, you can reach us at sales@flota.me.
02Data we collect
Account & identity data
- Name, email address, and role within a Customer organisation.
- Authentication data — passwords are stored only as secure hashes; we never store them in plain text.
- The organisation (tenant) you belong to and its settings.
Vehicle & telemetry data
Because FLOTA is a fleet-tracking platform, we process operational data reported by GPS tracking hardware installed in Customer vehicles, including:
- Location data — GPS position, heading, speed and movement of Customer vehicles.
- Vehicle telemetry — ignition status, fuel level, odometer, engine and sensor data reported by the tracking device.
- Trips, routes, geofence events, and alerts derived from this data.
- Vehicle identifiers such as plate, make and model, and the tracking device identifiers.
This vehicle and location data relates to Customer assets and operations. Where it can be associated with an identifiable driver, it constitutes personal data and is processed on behalf of, and under the instructions of, the Customer.
Device & usage data
- Push notification device tokens (for iOS and Android), used only to deliver alerts you have enabled.
- Login events, including IP address, browser/user-agent and timestamps, used for security, audit and abuse prevention.
- Basic technical data required to operate and secure the Service.
Communications
- Information you provide when you contact us (e.g. via sales@flota.me or a contact form).
03How we use data
- To provide the Service — live tracking, trips, fuel intelligence, reports, alerts and remote vehicle commands.
- To authenticate users and keep accounts and tenant data secure and isolated.
- To send operational alerts you or your organisation have enabled (via in-app, email, Telegram and push notifications).
- To protect the Service against fraud, abuse and unauthorised access (rate limiting, CAPTCHA on web sign-in, audit logging).
- To provide support and respond to enquiries.
- To comply with legal obligations.
04Legal bases (GDPR)
Where the GDPR applies, we rely on the following legal bases:
- Performance of a contract — to provide the Service to our Customers and their users.
- Legitimate interests — to secure the Service, prevent abuse, and maintain and improve the platform.
- Legal obligation — where we are required to retain or disclose data by law.
- Consent — where required, for example device permissions for location or push notifications, which you can withdraw at any time.
For personal data processed on behalf of a Customer, FLOTA acts as a data processor and the Customer is the data controller.
05Location data & permissions
Vehicle location is collected from tracking hardware fitted to Customer vehicles, not from your phone, and is used to provide the fleet-tracking features of the Service. The mobile apps may request notification permission to deliver alerts; these permissions are optional and can be changed or revoked in your device settings at any time. The Service continues to function without them, minus the related feature.
06Sharing & sub-processors
We do not sell personal data. We share data only with service providers who help us operate the Service, under appropriate safeguards. These include:
| Provider | Purpose |
|---|---|
| Google Firebase (FCM) | Delivering push notifications to mobile devices. |
| Apple Push Notification service | Delivering push notifications to iOS devices. |
| MapTiler / OpenFreeMap | Map tiles and satellite imagery in the apps and dashboard. |
| Resend | Sending transactional and alert emails. |
| Telegram | Delivering alerts to Telegram, where a Customer enables it. |
| Cloudflare | Bot protection (Turnstile) on web sign-in. |
| Hosting / infrastructure | Running the Service on secured cloud servers. |
We may also disclose data where required by law, to protect our rights, or in connection with a business transfer.
07International transfers
Some of our providers may process data outside your country. Where personal data is transferred internationally, we rely on appropriate safeguards such as the providers’ standard contractual clauses and equivalent mechanisms.
08Data retention
We retain account data for as long as your organisation uses the Service, and operational data (such as positions, trips and alerts) for as long as needed to provide the Service and as directed by the Customer. When an account or tenant is closed, we delete or anonymise associated data within a reasonable period, unless we are required to retain it by law.
09Security
We use technical and organisational measures to protect data, including encryption in transit (TLS), hashed passwords, per-tenant data isolation (row-level security), encrypted storage of authentication tokens on mobile devices, access controls, rate limiting, bot protection on sign-in, and audit logging. No system is perfectly secure, but we work to protect your information appropriately.
10Your rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. Because much of the data is processed on behalf of a Customer, please direct requests to your organisation (the controller) in the first instance; we will assist them as their processor. You can also contact us at sales@flota.me, and where applicable you have the right to lodge a complaint with a data protection authority.
11Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal data from children.
12Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate.
13Contact
Questions about this policy or your data? Email sales@flota.me.
Revision history
| Version | Date | Change |
|---|---|---|
| 1.0 | 11 September 2026 | First published. |