Fleet Privacy Policy

This Fleet Privacy Policy applies to organizations ("Fleet accounts") that use ControlMiles to manage drivers and vehicles, and to the drivers operating under them. ControlMiles is developed by Olympus Mont Systems LLC ("we", "us", "our"). It supplements the general ControlMiles Privacy Policy, (controlmiles.com/privacy), which still applies to everything not covered here (account data, maps, service providers, website cookies, and so on).

An organization's owner and administrators create and manage the Fleet account, invite drivers, assign vehicles, set schedules, and can view the data described in Section 3 for drivers under their organization. For this data, the organization decides why and how it is used, and we process it on the organization's behalf to provide the service. Administrators are responsible for how they use that data and for complying with applicable employment, labor, and privacy laws. A driver joining an organization's Fleet account acknowledges that the data they record under that organization becomes visible to its administrators, as described below.

If the organization uses branches (locations), an administrator limited to a branch only sees the drivers, vehicles, and records of that branch; the owner sees all of them.

Account and roster information: driver name, email, driver ID, role, branch, assigned vehicle, and invitation status.

Live location: while a driver has a trip open under the organization, the driver's current position is shared with the organization's live fleet map, including periodic position updates while the vehicle is stopped, and the vehicle's status (on trip, parked, or no signal). Live sharing stops when the trip ends; the organization can still see the recorded trip, including its route and last reported position.

Trip, route, and mileage data: trip start/end times, mileage, duration, the GPS route of each trip, miles by state or province (used for IFTA and state-mileage reports), and geofence entries and exits if the organization has configured geofences.

Idle time: periods when the engine is presumed running while the vehicle is stationary during a trip, derived from GPS.

Driving behavior: harsh braking, hard acceleration, and speeding events detected from GPS during trips under the organization, the location and time of each event, and a driver safety score calculated from them. To reduce false speeding alerts, the posted speed limit near the event may be looked up in OpenStreetMap (see the general Privacy Policy, Section 4).

Schedules and shifts: assigned shifts, schedules, hourly class blocks (for example in driving schools), and whether each trip started within them.

Vehicles: the organization's vehicles, and -- for owner-operators who use their own vehicle -- the vehicle details the driver registers for business use.

Vehicle inspection (DVIR) records: pre-trip and post-trip inspection results, defects reported, and photos submitted with them.

Odometer photos: photographed at trip start/end, read on the driver's device, and uploaded as evidence supporting the organization's mileage records.

Fuel purchases: date, location, gallons or liters, price, odometer, and receipt photos the driver submits (the receipt can be read on the driver's device), plus automated fuel-anomaly flags (for example a purchase larger than the tank, a duplicate receipt, or consumption out of the vehicle's normal range).

Incident reports and messages: incident reports (category, description, photo), and messages and feedback exchanged between administrators and drivers in the app.

Device and diagnostic information: basic technical information (device type, OS version, app version) and error reports, used for troubleshooting.

By the organization: to track vehicle usage, mileage, and fuel across its fleet; coordinate shifts and schedules; see where its vehicles are during active trips; prepare IFTA and state-mileage reports; review fuel anomalies, idle time, and driving behavior; verify inspection compliance; respond to incidents; coach drivers; and manage driver and vehicle assignments.

By us: to operate the service (recording, calculating, and reporting the data above; generating the PDF/CSV exports the organization requests; sending the email alerts the organization receives, such as fuel-anomaly digests; storing evidence photos), to maintain the account, respond to support requests, and secure the service against fraud or abuse. We do not sell this information, and we do not use third-party advertising networks.

Automated flags are not decisions: safety scores, driving events, fuel anomalies, and idle time are produced automatically from GPS and submitted data and can be wrong (for example because of GPS errors, tunnels, or missing map data). ControlMiles does not make employment, pay, or disciplinary decisions; any such decision is made by the organization, which should review the underlying facts and give the driver a chance to respond.

Within the organization: the data in Section 3 is visible to the organization's owner and administrators (and branch administrators for their branch) -- that visibility is the core function of a Fleet account, not an incidental data share.

Service providers and map services: the same providers listed in the general Privacy Policy (Supabase, Vercel, Cloudflare, Resend, Stripe, Google, our own trip-integrity and error-monitoring service, Protomaps, and the OpenStreetMap Overpass API), only to run ControlMiles.

Between organizations: a driver's data is only visible to the organization(s) they are actively assigned to. Removing a driver from an organization ends that organization's visibility into the driver's new trips; records already created under the organization remain part of its records.

Personal trips: trips a driver records in personal (gig) mode are never shared with an organization.

We may also disclose information if required by law or to protect the rights, property, or safety of ControlMiles, the organization, its drivers, or others.

If drivers label trips with a gig, delivery, or rideshare platform name, ControlMiles is not affiliated with, endorsed by, or sponsored by any of those platforms. It does not access, read, or store any data from those platforms' own apps, accounts, or servers.

Some organizations record driving by people who do not have their own ControlMiles account -- for example, a student driving with an instructor in a driving school, where the trip and safety score are recorded under the instructor. The organization is responsible for informing those people, obtaining any consent required by law (including a parent's or guardian's consent for a minor), and responding to their requests. We will assist the organization with such requests at privacy@controlmiles.com.

We retain an organization's driver, vehicle, trip, route, fuel, inspection, and message data for as long as the Fleet account is active, or until the organization deletes specific records, consistent with applicable law and the organization's own record-keeping obligations (for example IFTA records, which carriers generally must keep for four years). Deleting a Fleet account permanently removes the organization's data, including evidence photos and inspection records, from our active systems; residual copies in encrypted backups are overwritten on the backup rotation schedule.

A driver can see their own trips, routes, and safety score in the app. A driver can revoke location, physical-activity, camera, or notification permissions at any time from their device settings; doing so will limit or disable tracking for trips under the organization. Requests to access, correct, or delete fleet records should be sent to the organization first, since it controls them; we will help the organization respond, and drivers can also write to privacy@controlmiles.com.

If a driver is a California resident, the CCPA, as amended by the CPRA, gives them the right to know what personal information is collected and how it is used, to request deletion or correction, to limit the use of sensitive personal information such as precise location, and not to be discriminated against for exercising these rights, subject to the organization's own record-keeping obligations for business records. Residents of other U.S. states with comparable privacy laws (for example Maryland, Virginia, Colorado, Connecticut, Oregon, Texas, and Utah) have similar rights, honored on the same basis. We do not sell or share personal information for cross-context behavioral advertising. Contact privacy@controlmiles.com to exercise these rights.

If an organization or driver accesses ControlMiles from outside the United States, their information will be transferred to and processed in the United States. Organizations or drivers located in the European Economic Area, United Kingdom, or Switzerland may have additional rights under the GDPR or UK GDPR. Contact privacy@controlmiles.com to exercise these rights.

ControlMiles accounts are not available to anyone under the age of 18. See Section 7 for people recorded under an organization who do not have an account.

We use industry-standard measures to protect this information, including encrypted connections, organization- and branch-level access controls enforced at the database level, and tamper-evident trip records. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security. Report security issues to security@controlmiles.com.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice in the app, on the website, or by email.

Privacy questions and data-rights requests: privacy@controlmiles.com. Support: support@controlmiles.com.