Privacy Policy

Simple Fleet Manageris a fleet and trip management platform used by transport businesses to manage vehicles, drivers, trips and trip-related payments. The Service is offered on a per-organisation basis: your employer or the business that invited you (the “Organisation”) determines what data is entered about you and who within that Organisation may view it. In data-protection terms, the Organisation is the data controller and Simple Fleet Manager acts as a data processor on its behalf.

Contact: info@simplefleetmanager.com · Nairobi, Kenya

Account and profile information. When an account is created for you or you sign in, we collect your first and last name, display name, email address, phone number, assigned role (for example administrator, driver, owner or co-driver), your account status and, if you upload one, a profile photo.

Authentication data. We store a salted cryptographic hash of your password — never the password itself — along with session and refresh tokens issued when you sign in.

Operational data you or your Organisation enter. Vehicle records, trip records (assigned driver and vehicle, status, start and end times), and documents you attach to a trip, such as photographs or scans of delivery notes, weighbridge tickets, receipts and similar paperwork.

Payment and wallet information. Where your Organisation uses the in-app wallet, we process the mobile money number used for a disbursement or collection, transaction amounts, references, timestamps and status, together with a record of who initiated and who approved each payment request. Mobile money transactions are executed by the mobile network operator (Safaricom M-PESA); we do not collect or store card numbers, PINs or mobile money PINs.

Technical and diagnostic data. When you use the Service we automatically receive your IP address, device and operating system type, app version and timestamps of requests. This is recorded in server logs and used for security, debugging and abuse prevention.

We do not knowingly collect precise device location, contacts, calendar, SMS, call logs, microphone or health data. The app requests camera and photo access only if you choose to attach a document or profile photo, and uses that access solely for that purpose.

• To create and administer your account and authenticate you when you sign in.
• To provide the core features of the Service: assigning and tracking trips, managing vehicles, storing trip documents and processing payment requests.
• To enforce role-based access, so that each user sees only the data their role and Organisation permit.
• To send transactional messages such as account invitations, password resets and payment confirmations.
• To maintain the security and integrity of the Service, investigate suspected fraud or misuse, and keep an audit trail of who initiated and approved financial actions.
• To diagnose faults, monitor performance and improve the Service.
• To comply with applicable legal, tax and accounting obligations.

We do not sell your personal information, and we do not use it for advertising, ad personalisation or profiling unrelated to the Service.

Where data-protection law (including the Kenyan Data Protection Act, 2019 and, where applicable, the GDPR) requires a legal basis, we rely on: performance of a contract with you or your Organisation; our legitimate interests in operating, securing and improving the Service; compliance with a legal obligation; and, where required, your consent — for example before accessing your camera or photo library. You may withdraw consent at any time through your device settings.

We share personal information only in the following circumstances:

• Within your Organisation. Administrators and other authorised users of your Organisation can see the records associated with your account, such as trips assigned to you and payments you initiated or approved.
• Service providers. Infrastructure, hosting, object storage and email delivery providers who process data on our instructions and under contractual confidentiality and security obligations.
• Payment processors. Mobile money and banking partners, who receive the details necessary to execute a transaction you or your Organisation initiated. Their handling of that data is governed by their own privacy policies.
• Legal and safety. Where we are required to do so by law, court order or a lawful request from a public authority, or where necessary to establish, exercise or defend legal claims or protect the rights and safety of users.
• Business transfers. In connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply to the transferred data.

Data is stored on secured servers operated by us or our hosting providers and may be processed in a country other than the one you live in. Where personal data is transferred across borders we take steps to ensure it remains protected by appropriate safeguards.

We retain personal information for as long as your account remains active and your Organisation continues to use the Service. After an account is deleted we remove or irreversibly anonymise the associated personal data within 30 days, except where a longer period is required for financial record-keeping, tax, audit, fraud prevention or other legal obligations — transaction records, for instance, may be retained for up to seven years. Backups containing deleted data are purged on their normal rotation cycle, which does not exceed 90 days.

We apply technical and organisational measures appropriate to the risk, including encryption of traffic in transit over TLS, password hashing, short-lived authentication tokens, role-based access control, strict separation of each Organisation’s data, and a maker-checker requirement under which the person who approves a payment request cannot be the person who initiated it. No system can be guaranteed completely secure, and you are responsible for keeping your password and device credentials confidential.

Subject to applicable law, you may:

• Access the personal information we hold about you and request a copy.
• Correct inaccurate or incomplete information — much of your profile can be edited directly in the app.
• Request deletion of your account and personal data (see the next section).
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection authority — in Kenya, the Office of the Data Protection Commissioner.

To exercise any of these rights, contact us at info@simplefleetmanager.com. We will respond within the period required by applicable law. Because your Organisation controls much of the data in the Service, we may need to refer your request to it or act on its instructions.

You can request deletion of your Simple Fleet Manager account and its associated personal data at any time by emailing info@simplefleetmanager.comfrom the address registered on your account, with the subject line “Account deletion request”. Your Organisation’s administrator can also deactivate or remove your account from the dashboard.

On deletion we remove your profile details, contact information, profile photo and login credentials. Trip and financial records that your Organisation is required to keep may be retained in a form that no longer identifies you, or for the retention periods described in section 6 where the law requires it.

The Service is intended for use by people in employment and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page, and where the changes are material we will provide additional notice through the app or by email. Continued use of the Service after an update means you accept the revised policy.

Questions, concerns or requests about this policy or your personal information can be sent to info@simplefleetmanager.com, or by post to Simple Fleet Manager, Nairobi, Kenya.