Privacy Policy

1. Information We Collect

We collect information in the following categories:

Account & Identity Information

• Full name, email address, phone number
• Job role and access level within your organisation
• Profile photo (optional)
• Password (stored as a secure one-way hash — we never store plaintext passwords)

Fleet & Operational Data

• Vehicle registration numbers, chassis numbers, makes, models, and mileage
• Trip records: origin, destination, distance, date, and assigned driver
• Fuel logs: quantity, cost, odometer reading
• Maintenance records: service type, cost, vendor, date
• Tyre inspection and replacement records

Driver & Employee Information

• Full name, date of birth, national ID or driver licence number
• Contact information (phone, emergency contact)
• Employment type, salary, and payroll data
• Mobile money account numbers (used solely for payroll disbursement)

Financial & Expense Data

• Expense records captured via our Telegram bot (amounts, merchants, categories)
• Receipt images processed via OCR for data extraction
• Invoice data generated within the platform

Technical & Usage Data

• IP address, browser type, operating system
• Pages visited, features used, session duration
• Device identifiers on mobile applications
• Error logs and crash reports

Communications

• Messages sent to us via the contact form or email
• Messages exchanged with our Telegram bot

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Authenticate your identity and control access based on your assigned role
• Display fleet, driver, and operational data within your organisation's account
• Generate KPI reports, invoices, and payroll documents
• Process expense receipts submitted via the Telegram bot
• Send account-related notifications (password resets, system alerts)
• Monitor service performance and investigate errors
• Comply with legal obligations

We do not use your data for targeted advertising, and we do not sell your personal information to third parties.

3. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share information only in the following circumstances:

Within Your Organisation

Data you enter (fleet records, driver profiles, trip logs) is visible to other authorised users within your organisation's account according to their assigned access roles.

Service Providers

We use trusted third-party service providers to operate the Service, including:

• DigitalOcean Spaces — cloud file storage (profile photos, documents)
• Redis — caching and session storage
• MongoDB — operational log storage
• Telegram — expense-capture bot integration

These providers process data only as necessary to deliver their services and are bound by confidentiality obligations.

Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, prevent fraud, or protect the safety of our users.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. You will be notified via the email address associated with your account.

4. Data Security

We implement appropriate technical and organisational security measures, including:

• All data in transit is encrypted using TLS/HTTPS
• Passwords are hashed using bcrypt and never stored in plaintext
• File storage uses private, access-controlled buckets with signed temporary URLs
• Role-based access control (RBAC) restricts data access to authorised users only
• Regular dependency updates and security reviews

No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Operational data (trip logs, fuel records, etc.) is retained for the duration of your subscription plus a minimum of 12 months to support auditing and dispute resolution.

When an account is closed or upon request, we will delete or anonymise your personal information within 90 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data ("right to be forgotten")
• Portability — request your data in a structured, machine-readable format
• Objection — object to certain types of processing
• Restriction — request that we restrict processing of your data in certain circumstances

To exercise any of these rights, please contact us at privacy@terraflow.me. We will respond within 30 days.

7. Children's Privacy

The Service is intended solely for use by business professionals aged 18 and older. We do not knowingly collect personal information from children under the age of 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@terraflow.me.

8. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from those in your country.

Where we transfer personal data outside your jurisdiction, we take appropriate safeguards to ensure your data receives adequate protection in accordance with applicable laws.

9. Third-Party Links & Integrations

The Service may contain links to third-party websites or integrations with third-party services (such as Telegram). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you use in connection with our Service.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, sending a notification to the email address associated with your account.

Your continued use of the Service after any changes constitutes your acceptance of the revised Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@terraflow.me
• Web: terraflow.me/contact

We will respond to all inquiries within 30 days.