Skip to content
Notify me

FlotaKM privacy policy

FlotaKM is an app for keeping a fleet of vehicles under control. Here we explain, in plain words, what data it keeps, why, where, for how long, and what your rights are. We wrote it with Ecuador's Organic Law on Personal Data Protection (LOPDP) in mind.

1. Who we are

FlotaKM belongs to Zuhuan Software S.A.S. (tax ID pending), based in Camilo Ponce Enríquez, Azuay province, Ecuador. For anything about your data, write to privacidad@flotakm.com.

There are two different cases, and it helps to keep them apart:

  • The data a company enters into FlotaKM about its people and vehicles (for example, its drivers' details). Here the client company is the controller of that data and Zuhuan Software is the processor: we store and process it only to provide the service and following the company's instructions.
  • The company account data (the email of the person who manages it), the data from this website and the "Let me know when it's out" list. Here Zuhuan Software is the controller.

2. What data we keep

In the app

  • Company account: the administrator's email, company name, country, currency and units (kilometers or miles, liters or gallons).
  • People in the company (owner, recorder, drivers, partners and accountant): name, photo if added, date of birth, type and number of identity document, mobile number, role and, for drivers, license number, category and expiry date. The PIN is not stored as such: only an encrypted version that cannot be read.
  • Vehicles: plate, type, documents (insurance, registration, inspection, installments) and maintenance.
  • Each day's work: jobs and trips, payments received, expenses, each driver's cash, odometer readings and fuel.
  • Photos: of the dashboard and the vehicle when it is picked up and handed back, and any added to a claim. Each photo is stamped with the date, time, plate and driver's name.
  • Location: only the place where a photo is taken or a record is made, if the person gave permission. FlotaKM does not track anyone during the day. Without permission, the app works the same.
  • History: who did what, from which phone, when, where (if permitted) and what changed. No one can edit or delete it, not even the owner: it is there so everyone can trust the numbers.
  • Technical data: phone model and system, app version, crash reports and the code that lets us send notifications to the phone.
  • Payments: Apple or Google charge them. We never see your card: we only know whether the subscription is up to date and how many phones it covers.
  • Which campaign each company came from, to know which advertising works, without personal data.

On this website

  • "Let me know when it's out": only what you decide to give us (email, WhatsApp, country and number of vehicles; at least the email or the WhatsApp so we can tell you), the language of the page and the date. To stop abuse we also keep, for one hour, an encrypted fingerprint of your connection.
  • No tracking cookies and no advertising. We don't use tools that follow you from page to page.

3. What we use it for

  • To make the app work: store and show what each person records, according to their role, and keep the data safe with backups.
  • To send service emails and notices: sign-in codes, expiry reminders, payments and deletion notices.
  • To help you when you write to support.
  • To keep things secure, find bugs and prevent abuse.
  • To comply with the law.

We don't sell your data, we don't rent it and we don't use it for advertising.

4. Legal basis

  • The contract with the client company (the terms of use), to provide the service.
  • Your consent, for the "Let me know when it's out" list and for phone permissions (camera and location). You can withdraw it at any time.
  • Legitimate interest in keeping the app secure and free of bugs.
  • Legal obligations we may have.

When a company enters its people's data, it is that company that must have a legal basis to do so and must tell its people how it uses the data. When activating their phone, each person sees and accepts this policy.

5. Who else sees it

Inside each company, each person sees only what their role allows. Outside the company, we use these providers, who work for us, only to provide the service:

  • DigitalOcean (New York, United States): the server, the database and the photos.
  • Cloudflare (United States): this website, the "Let me know when it's out" list and an encrypted backup of the database.
  • Resend (United States): automatic emails, such as sign-in codes.
  • Google Firebase: phone notifications and crash reports.
  • RevenueCat: checking the status of subscriptions.
  • Apple and Google: the stores, where the app is downloaded and paid for.
  • Google Workspace: the email we use to answer you.
  • WhatsApp (Meta): only if you left us your WhatsApp in "Let me know when it's out" and we notify you there.

Because several of them are in the United States, your data leaves Ecuador. We only work with providers that commit by contract to protect the data and to use it only for what we ask. If an authority asks us for data, we hand it over only when the law requires it.

6. How we protect it

  • Everything travels encrypted (HTTPS) between the phone, the server and the website.
  • The database only accepts connections from our server.
  • Backups are made every day and a weekly encrypted copy goes to another provider.
  • Each person signs in with their PIN (or fingerprint or face) and sees only what their role allows. The owner can cut off someone's access at once.

7. How long we keep it

  • While the account is active.
  • If a payment fails, the company becomes read-only: it can see and download its data. If it isn't up to date within 90 days, the data is deleted, with email notices at 60, 80 and 89 days.
  • If account deletion is requested, it is deleted within 30 days, and from backups within a further 90 days at most. How to request it: Delete my account.
  • "Let me know when it's out": until we tell you about the launch and, at most, 12 months from when you signed up.
  • We keep data longer only when a law requires us to.

Your data is yours: the company owner can download all of it, with the photos, in Excel, CSV and PDF at any time.

8. Your rights

Under the LOPDP you can ask to: see your data (access), correct or update it, delete it, object to its use, suspend its use, take it to another service (portability) and not be subject to decisions made solely by a machine.

Write to privacidad@flotakm.com. We answer within 15 days at most. If your company entered your data, ask the company first; if it doesn't answer, write to us and we'll help.

If you are not satisfied with our answer, you can complain to Ecuador's Superintendency of Personal Data Protection.

9. Minors

FlotaKM is a work tool for businesses and is not made for people under 18.

10. Changes

If we change this policy, we publish the new version here with its date. If the change is significant, we let you know beforehand by email or in the app.

11. Language

This policy is published in several languages. If they differ, the Spanish version prevails.

Last updated: November 6, 2026