Privacy Notice
This notice explains how [Company legal name] ("we", "us") handles personal data when you use the Fleetwood fleet-management service (the "Service"). We process personal data in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.
1. Our role
For account, billing and website data, we act as a controller. For the fleet data your company puts into the Service (vehicle records, documents, notes, team activity), your company decides what is entered and who sees it — we process that data as its service provider, on the instructions given through the product.
2. What we collect
- Account data — name, email address, job title, role, password (stored only as a salted cryptographic hash), and company name.
- Fleet data — vehicles, maintenance and damage records, invoices, uploaded documents and images, notes, and the audit trail of who did what and when.
- Billing data — plan, subscription status and payment events. Card details are collected and stored by Stripe, not by us.
- Usage and technical data — log data such as request timestamps and IP-derived rate-limiting information, kept for security and troubleshooting.
- Emails — alert, summary and account emails we send, including delivery status and unsubscribe choices.
3. Why we process it (lawful bases)
- To provide the Service (contract) — accounts, fleet records, approvals, alerts, billing.
- AI features (contract / legitimate interests) — when you use the AI assistant or document scanning, the relevant fleet data and documents are sent to our AI provider to generate the response. AI output is stored with your records where you save it.
- Security and audit (legitimate interests) — access logs, audit trails, abuse prevention, and support actions (which are recorded in your company's audit log).
- Legal obligations — tax, accounting and responding to lawful requests.
4. Who we share data with
We do not sell personal data. We share it only with the processors needed to run the Service:
| Provider | Purpose |
|---|---|
| Stripe | Subscription billing and payments |
| Resend | Transactional email (alerts, summaries, account notices) |
| Anthropic | AI assistant answers and document scanning |
| Replit (incl. Google Cloud infrastructure) | Application hosting, database and file storage |
Some providers process data outside the UK (for example in the United States). Where they do, transfers are protected by appropriate safeguards such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.
5. Who can see your data inside the Service
- Each company's data is strictly separated. Only people invited into your company can see its fleet data, subject to the roles your administrators assign.
- Our support staff can access limited account information (and, at a company's documented request, restore access or reset credentials). Every support action is written to that company's audit log.
6. How long we keep data
- Account and fleet data: for as long as your company's account is active.
- After cancellation or termination: retained for a reasonable window (up to 90 days) so you can return or export, then deleted from the live system. Backups roll off on their own cycle.
- Records your administrators "delete forever" in-app are removed from the live system immediately, including the stored document file.
- Billing records: kept as long as required by tax and accounting law (typically 6 years).
7. Your rights
Individuals have rights under UK GDPR: access, rectification, erasure, restriction, portability and objection. If you are a team member of a company using Fleetwood, contact your company's administrator first — most requests (correcting your name, disabling your account) are handled inside the product. You can also contact us at [contact email]. You have the right to complain to the Information Commissioner's Office (ico.org.uk).
8. Cookies
We use only essential cookies: a session cookie that keeps you signed in and, where applicable, a demo-session cookie. We do not use advertising or third-party analytics cookies.
9. Security
Passwords are hashed with scrypt and never stored in plain text; sessions are revocable server-side; data is isolated per company; administrative and support actions are audit-logged. No system is perfectly secure — notify us immediately at [contact email] if you suspect a breach.
10. Changes and contact
We may update this notice; material changes will be flagged in-app or by email. Contact: [Company legal name], [registered address], [contact email].