Privacy Policy

What we collect

• Staff accounts — email address and password (handled by our authentication provider, Supabase; we never see your raw password), and an optional 4-digit PIN (stored as a hash, not in plain text) for fast sign-in on shared work devices.
• Staff device location — signing in with a Staff ID + PIN on a shared device shares that device's location roughly every 90 seconds for as long as the session is open, so it can be tracked on the live fleet map. This applies specifically to PIN-based sign-in; signing in with email and password instead does not share location this way.
• Customer check-in location — customers who scan a kayak/vehicle QR code are asked to consent before anything is shared. If they agree, their approximate location is shared with the hire business every couple of minutes for safety, purely for the duration of their trip; they can stop sharing at any time, and it stops automatically when the kayak or vehicle is returned. If they decline, nothing is shared.
• Business operational data — bookings, fleet and vehicle records, maintenance logs, timesheets, and business settings entered by the organizations using the platform.
• Payment information — subscription payments are handled entirely by Stripe. We never see or store your card number; we only receive subscription status (trialing, active, etc.) via Stripe's webhooks.

How we use it

To run the service: authenticate you, show your organization's own data back to you, coordinate fleet/booking/staff operations, process subscription payments, and (for location data) power the live fleet map and safety check-in features.

Who we share it with

We use a small number of service providers to run the platform:

• Supabase — database, authentication, and file storage (e.g. business logos).
• Stripe — subscription payment processing.
• Mapbox — renders the live fleet map.

We don't sell your data, ever.

Data retention

We keep account and operational data for as long as your organization is active on the platform. If you close your account, contact us and we'll delete what we reasonably can, subject to anything we're required to keep for legal or accounting reasons.

Your rights

You can ask us to access, correct, or delete the personal information we hold about you by emailing us below. If you're a customer of one of our hire-business customers (e.g. you shared your location during a check-in), that business is the first point of contact for requests about your data, since they collected it - we process it on their behalf.

Security

Data is encrypted in transit (HTTPS) and at rest (via Supabase). Access to each organization's data is enforced at the database level (row-level security), so one business's staff can't see another's data.

Children

Fleet Tracker is a business tool and isn't directed at children.

Changes to this policy

We may update this policy as the product changes. Material changes will be reflected here with an updated date.

Contact

Questions, or a request about your data: admin@virtutisdigital.com.au