Privacy Policy

1. Overview

Fuata ("we", "us", "our") is a device location tracking and management platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding your data.

By creating an account or using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account information: When you register, we collect your name, email address, and a hashed password. No plaintext passwords are ever stored.

Device information: Information about devices you enroll, including device name, identifier, model, and OS version.

Usage data: Log data such as IP addresses, browser type, pages visited, timestamps, and error events — used for security and platform improvement.

Communications: If you contact us for support, we retain the content of those communications to resolve your request.

3. Location Data

Location data is the core of what Fuata processes. We collect:

• GPS coordinates (latitude, longitude, altitude) reported by enrolled devices
• Timestamps for each location event
• Speed, heading, and accuracy metadata where available
• Historical location trails and route history for enrolled devices

Consent: Location data is collected only for devices that have been explicitly enrolled by an account holder. By enrolling a device, you confirm you have the legal right and, where applicable, the consent of the device's user to collect and process its location data.

You are solely responsible for ensuring your use of location tracking complies with applicable laws, including notifying device users where legally required.

4. How We Use Your Data

We use collected data to:

• Provide and operate the Service, including displaying real-time and historical device locations
• Authenticate users and maintain account security
• Send important account notifications (password resets, security alerts)
• Monitor platform health and diagnose technical problems
• Improve the Service through aggregated, anonymised usage analysis
• Comply with legal obligations

We do not use your data for advertising, and we do not sell your personal or location data to any third party.

5. Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share data only in these limited circumstances:

• Service providers: Trusted infrastructure providers (e.g. cloud hosting, email delivery) who process data only on our behalf under strict data processing agreements.
• Legal obligations: If required by applicable law, court order, or government authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, data may be transferred. We will notify you beforehand.
• Safety: Where necessary to protect the safety of users or the public.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you delete your account, after which it is purged within 30 days.
• Location history: Retained for the period configured in your account settings (default: 90 days). Older records are automatically deleted.
• Usage logs: Retained for up to 12 months for security and diagnostic purposes, then deleted.

You may request early deletion of your data at any time by contacting us (see Section 12).

7. Security

We implement industry-standard safeguards to protect your data:

• All data in transit is encrypted via TLS/HTTPS
• Passwords are stored using strong one-way hashing (bcrypt)
• API access is controlled via authenticated tokens and API keys
• CSRF protection is enforced on all state-changing requests
• Access to production systems is restricted to authorised personnel

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Please notify us immediately if you suspect a breach.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we limit how we process your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@fuata.co.ke. We will respond within 30 days.

9. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

10. Third-Party Services

The Service may load resources from third-party providers:

• Google Fonts — for typography (subject to Google's privacy policy)
• Font Awesome CDN — for icons (subject to Fonticons, Inc. privacy policy)
• Firebase Cloud Messaging — for push notifications to enrolled devices

These providers process data under their own privacy policies. We encourage you to review them. We do not embed advertising networks or analytics trackers from social media platforms.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, by sending a notification to your registered email address. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, data requests, or to report a concern:

• Email: privacy@fuata.co.ke
• Website: fuata.co.ke

Also see our Cookie Policy and Terms & Conditions.