Privacy Policy

Information you provide

Fields marked optional can be left empty. Please do not enter information in free-text "notes" fields that you do not want stored.

Information from your vehicle's GPS tracking device

When you link a GPS tracking device to one of your vehicles, that device sends us:

• device identifier (for example the tracker's IMEI/ID number);
• precise location (latitude/longitude), time, speed and heading;
• device status such as ignition on/off, where the device reports it.

We use this to show the vehicle's live position, build trip history and trip replays, record stops, calculate distance travelled, and send parking-guard and movement alerts. This is the location of the vehicle, not of your phone.

Information collected automatically from the app

When you visit our website

• velocetrack.com uses one cookie, NEXT_LOCALE, only to remember the language you choose (kept for one year). It sets no analytics or advertising cookies.
• Our servers may keep standard technical logs (such as IP address, time, page requested and browser type) for security and troubleshooting.
• The account deletion form uses the email address and code you enter only to confirm and carry out the deletion.
• Shared trip and invitation pages show only what the person who shared them chose to share (see Section 5).

Information we do NOT collect

We do not access your phone's GPS location, contacts, photos library, camera, microphone, health data, or payment card details. We do not use advertising identifiers (IDFA / Advertising ID). The app plays its own alert sound but never records audio.

We use information only to:

• provide and operate the Service and its features;
• create and manage your account and authenticate you;
• show live vehicle location, trips, stops, analytics and maintenance status;
• send notifications you have enabled (e.g. vehicle-moved alerts, trip and security alerts);
• respond to support requests;
• keep the Service secure, prevent misuse and fix problems;
• comply with legal obligations.

We do not use your data for advertising, sell it, or use it for automated decisions that produce legal or similarly significant effects on you.

Contract — to provide the Service you signed up for. Consent — for push notifications, which you can withdraw at any time in your device settings. Legitimate interests — to keep the Service secure and reliable. Legal obligation — where the law requires us to keep or disclose information.

We share information only in these cases:

Service providers that help us run the Service, under their own terms and only to the extent needed:

Map providers process data under their own privacy policies, for example the Google Privacy Policy and the OpenStreetMap Foundation Privacy Policy.

People in your account. If an administrator or fleet manager has given you access, or you are part of a business account, users with the appropriate role (for example an Admin or Manager) may see vehicles, trips and expenses they are responsible for.

People you choose to share with.

• Location sharing: when you invite someone or accept an invitation, the people you choose can see the live location and/or trip history of the vehicles you select, for the time you choose, together with your name and email address. Plate numbers and GPS device details are never shown to them. The person you invite receives an email with your name and email address. You can change or stop sharing at any time.
• Trip links: when you share a trip, anyone with the link can see that trip's route, times, distance and speeds, the vehicle's name and your first name. You can hide the start and end of the route, set an expiry date and turn the link off at any time.

Legal reasons. If required by law, court order or a valid request from authorities, or to protect the rights, safety and property of users or others.

Business transfer. If the Service is transferred to another owner, your information may transfer with it, subject to this Policy, and we will tell you in advance.

We do not sell personal information and do not share it for cross-context behavioural advertising.

When you delete your account it is closed straight away (signed out everywhere, nothing shared, GPS devices unlinked) and your personal data is permanently deleted from our active systems 30 days later. During those 30 days you can restore the account by signing in. We keep only a record that the account was deleted and when (without personal details), and limited information where the law requires it. Residual copies in backups are overwritten within 90 days.

We protect your data with encryption in transit (HTTPS/TLS), passwords stored only as salted hashes (bcrypt), hashed session tokens, role-based access controls, and restricted access to our servers. No system is completely secure, so we cannot guarantee absolute security. If a data breach is likely to affect you, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data (most of it you can edit directly in the app);
• delete your data and account;
• receive a copy of your data in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time;
• lodge a complaint with a data protection authority.

These include rights under the Sri Lanka Personal Data Protection Act No. 9 of 2022, the EU/UK GDPR, and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). To exercise them, contact us (Section 14). We may need to verify your identity first. We will not discriminate against you for exercising your rights.

Notifications: turn them off at any time in your device settings.

GPS tracking: unlink the GPS device from the vehicle in the app, delete the vehicle, or switch the tracking device off.

Veloce Track is designed to track vehicles you own or are authorised to manage. If someone else drives a tracked vehicle (for example a family member or employee), you are responsible for telling them that the vehicle is tracked and for obtaining their consent where the law requires it. The Service must never be used to secretly monitor a person. See our Terms and Conditions.

The Service is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

Our servers and service providers may be located outside your country. When we transfer personal data internationally we take steps to protect it as required by applicable law, including the Sri Lanka Personal Data Protection Act and, where relevant, Standard Contractual Clauses.

We may update this Privacy Policy from time to time. The latest version will always be available at this address with the "Last updated" date. If changes are significant, we will notify you in the app or by email before they take effect.