✦ Warehousing, cycle counting and slotting are now live on every plan. See what shipped
Sign in Sign up
Legal

Privacy Policy

Effective date: 2026-09-07. Last updated: 2026-09-07.

1. Who we are

FleetRails ("we", "us", "our") is a Nigerian company operating the FleetRails logistics platform. Our registered office is in Nigeria. You can contact us at privacy@fleetrails.com.

2. What data we collect

2.1 Account & workspace data

When you create a workspace we collect: company name, your name, work email, phone number, and a subdomain you choose. This is the minimum needed to provision your isolated tenant.

2.2 Operational data

As you use FleetRails, your workspace generates: shipments, tracking events, warehouse movements, rider profiles, vehicle records, wallet transactions, invoices, and audit logs. This data belongs to you — we process it on your behalf to provide the service.

2.3 Usage & diagnostic data

We collect pseudonymised usage metrics (feature adoption, error rates, latency) to improve the product. This data is not linked to identifiable individuals.

2.4 Communication data

Emails you send to support@, security@, or via the demo request form, plus any replies.

3. Legal bases (NDPR / GDPR)

  • Contract — providing the service, billing, support.
  • Legitimate interest — product improvement, security monitoring, fraud prevention.
  • Consent — marketing emails (you can opt out anytime).
  • Legal obligation — tax, accounting, law enforcement requests.

4. How we use your data

  • Provision and operate your workspace (multi-tenant isolation, subdomain, database schema)
  • Run the modules you enable: dispatch, tracking, warehousing, fleet, wallets, invoicing, analytics
  • Send operational notifications (WhatsApp, SMS, email) on your behalf to your customers and riders
  • Bill you, issue invoices, and reconcile payments
  • Respond to support requests and security reports
  • Improve the platform (aggregated, pseudonymised analytics)
  • Comply with Nigerian law (NDPR, CBN guidelines, tax regulations)

5. Sub-processors

We use a limited set of subprocessors, all under data processing agreements:

  • Cloud infrastructure — hosting, managed databases, object storage and content delivery
  • Communications — WhatsApp, SMS and transactional email delivery
  • Payments — card, bank transfer and USSD processing
  • Observability — metrics, logs and traces (no personal data ingested)
  • Error tracking — crash reports (personal data scrubbed before upload)

A named vendor list is available on request at privacy@fleetrails.com, and to Pro customers under NDA.

6. Data residency

All production data resides in either an African region or an EU region — you choose at workspace creation. Backups are encrypted and stored in the same region.

7. Retention

  • Operational data (shipments, tracking, warehouse, wallet): retained while your workspace is active.
  • On cancellation: 30-day grace period, then hard delete (including backups within 90 days).
  • Billing records: 7 years per Nigerian tax law (FIRS).
  • Audit logs: 3 years for compliance.

8. Your rights

Under NDPR (and GDPR where applicable) you have the right to:

  • Access — request a copy of your personal data
  • Rectification — correct inaccurate data
  • Erasure — delete your workspace and all associated data
  • Portability — export your data in machine-readable format (CSV/JSON)
  • Restriction — pause processing
  • Objection — object to direct marketing or legitimate-interest processing

Submit requests to privacy@fleetrails.com. We respond within 30 days.

9. Security

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Per-tenant database schema isolation — your data never shares tables with another operator
  • Role-based access control in the console; approval workflows for sensitive actions
  • Annual penetration testing; continuous vulnerability scanning
  • SOC 2 Type II in progress (target 2027)

See Security for the full posture.

10. International transfers

If you choose the EU region, data stays in the EU. If you choose Nigeria/Africa, data stays in Africa. We do not transfer personal data outside the chosen region except to subprocessors with adequate safeguards (SCCs, UK IDTA).

11. Marketing communications

We only send product updates and occasional tips if you opt in. Every email includes an unsubscribe link. Operational emails (invoices, security alerts, password resets) are not marketing and cannot be unsubscribed.

12. Cookies & tracking

We use no advertising or analytics cookies on the marketing site. The app uses essential session cookies and CSRF tokens only. No third-party trackers (Google Analytics, Meta Pixel, etc.).

13. Children

FleetRails is not directed at children under 18. We do not knowingly collect children's data.

14. Changes to this policy

We'll post updates here and bump the "Last updated" date. Material changes (new purposes, new subprocessors) get 30 days' notice via email and in-app banner.

15. Contact

Data Protection Officer: privacy@fleetrails.com
FleetRails, Nigeria

This policy is written in plain language, not legalese. If something is unclear, email us — we'll clarify.