Privacy Policy

1. Who we are and our role

For account holders (fleet owners, admins, dispatchers), Orange Fleet is the controller of account and billing information.

For driver, vehicle, and telematics data that a Customer loads into the platform, the Customer is the controller and Orange Fleet acts as a service provider (processor) that processes the data only on the Customer’s instructions.

2. Information we collect

Account data: name, work email, phone, organization, role, and sign-in records.

If you sign in with Google, Microsoft or Apple, Orange Fleet receives only your name, email address and profile picture from that provider. We use them only to create your account and sign you in, and for nothing else.

Driver records supplied by Customers: name, contact details, licence and abstract details, certifications, medical certificate expiry, hours-of-service logs, policy acknowledgments, disciplinary records and signatures.

Vehicle and telematics data: VIN, odometer, GPS location, speed, engine state, fault codes, inspection records, and dashcam safety-event video received from the Customer’s telematics provider (e.g. Samsara, Motive, Geotab).

Technical data: IP address, browser type, device information, and audit logs of actions taken in the platform.

3. How we use information

To provide the service: compliance tracking (CVIP, Schedule 4, NSC/FMCSA), maintenance and work orders, live fleet view, safety and incident management, and messaging.

To secure the service: authentication, fraud and abuse prevention, and audit trails.

To communicate with you about your account, billing, and service changes. We do not sell personal information and do not use it for third-party advertising.

4. Location and driver monitoring

GPS location and driving behaviour are collected by the Customer’s telematics devices for legitimate business purposes such as safety, dispatch, hours-of-service compliance, and asset protection.

Drivers are shown a location-tracking disclosure in the Driver Portal and their acknowledgment is recorded with a timestamp and IP address. Customers are responsible for providing any additional employee notice required by local employment law.

5. AI features

Some features (document extraction, fault-code analysis, letter drafting, fleet assistant) send relevant records to an AI model to generate a result. Data sent for these features is not used to train public models. AI-generated drafts must be reviewed by a person before they are relied on.

6. Sharing and sub-processors

We share data only with service providers that help us run the platform: cloud hosting and database, email (Resend), SMS/WhatsApp (Twilio), payments (Stripe), maps, AI model providers, the Customer’s chosen telematics provider, and the Customer’s chosen document storage (Google Drive, OneDrive, Dropbox).

We may disclose information if required by law or to protect the rights and safety of users and the public.

7. Cookies and local storage

We use only essential cookies and browser storage to keep you signed in, remember your selected organization, and store your preferences. We do not use advertising or cross-site tracking cookies.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent.

Drivers and employees should first contact their employer (our Customer), who controls their records. You may also email privacy@orangefleet.app; we respond within 30 days and will help route your request.

You may complain to the Office of the Privacy Commissioner of Canada, the Alberta OIPC, or your local data protection authority.

9. Retention

Customer data is retained for as long as the Customer’s account is active, or as required by regulation (for example, inspection and driver qualification records are commonly retained for several years). On termination, Customers may export their data; we delete it from active systems within 90 days unless law requires longer retention.

10. Security

Data is encrypted in transit (TLS) and at rest. Each organization’s data is isolated with row-level security. Portal PINs are hashed, telematics keys are stored server-side only, and administrative actions are recorded in an audit log.

11. International transfers

Data may be processed in Canada, the United States, and other countries where our providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

12. Deleting your account

Company users, drivers and mechanics can delete their own Orange Fleet login from inside the app at any time. Records your employer must keep by law, such as driver qualification and inspection files, stay with your employer. Full steps: orangefleet.app/delete-account.

13. Contact

Privacy Officer, Orange Fleet — privacy@orangefleet.app. We may update this policy; material changes will be notified in the app or by email.