FleetCifu Privacy Policy

Last updated: 9 October 2026

FleetCifu is a fleet management platform, sold together with the CIFU AI Dashcam, and operated by IC 360 Ltd ("we", "us"). This policy explains what information the service handles, why, and the choices available.

1. Who is responsible for what. Our customers are businesses that run vehicle fleets. For the information their vehicles, drivers and staff generate in FleetCifu, the customer decides why and how it is used, so the customer is the data controller and we act as their data processor under our customer agreement and data processing terms. For our own business contacts, account sign-ups and billing, we are the controller. If you are a driver or employee of one of our customers, please contact your employer first about your information; we will help them respond.

2. What we handle.

• Account information: names, work email addresses, roles and sign-in details of the customer's users.
• Vehicle and trip information: GPS location, speed, heading, ignition, trips, stops, geofence visits and vehicle diagnostics.
• Dashcam information: video, still images and in-cab audio from the road-facing, cabin and rear cameras, plus driver-safety alerts such as forward-collision, lane-departure, distraction and fatigue warnings. Recording depends on how the customer configures the camera.
• Driver information: driver names and the contact details the customer adds for alerts and coaching messages.
• Driver face matching (only where the customer turns it on): an enrolment photo of each driver, taken with that driver's consent, and a face image captured at the start of a trip, used only to check which enrolled driver is driving. See section 5.
• Assistant information: questions asked of Cifu, the in-app assistant, and its answers. Spoken questions are turned into text when voice is enabled.
• Technical information: device identifiers, connection logs, and security and audit logs.

3. Why we use it. Only to provide the FleetCifu service to the customer: showing vehicles on the map, trip history and playback, safety alerts and clips, driver coaching messages, reports, alert emails and messages, answers from Cifu, support, keeping the service secure, preventing abuse, and meeting legal obligations.

4. What we never do.

• We do not sell customer data, driver data or face data.
• We do not use customer data to train shared AI models that serve other customers, and we ask our AI providers not to train on it.
• Cifu answers from the customer's own fleet records. It does not take sensitive actions without a person approving them.
• We do not use the service for continuous in-cab facial recognition.

5. Driver face matching. This feature is off unless the customer turns it on. A driver is enrolled only after giving consent. The match runs at the start of a trip (and, if the customer chooses, an occasional spot check) and labels the trip as matched, not matched, or unknown, for a manager to review. Face images are used for no other purpose, only authorised roles can see them, they are kept for a limited period set in the customer's retention settings, and a driver's enrolment is deleted when the driver is removed or asks the customer to withdraw consent.

6. Who else handles it. We use a small number of service providers to run FleetCifu, each bound to protect the information and use it only to provide their service to us:

• Railway: hosting of the application and database.
• Flespi: receiving data from vehicle devices.
• Deep Infra and/or OpenAI: turning fleet facts into plain-English answers and summaries.
• Twilio: text and WhatsApp messages, when used.
• Resend: alert and notification emails.
• MapTiler: maps and address lookup, when enabled.
• Deepgram: speech-to-text for spoken questions, when voice is enabled.

We share information with others only when the customer authorises it (for example, sending an incident clip to their insurer) or when the law requires it.

7. Where it is stored. Information is stored with our cloud providers, which may be outside the Cayman Islands. Where it is transferred, we use contractual and technical safeguards as required by the Cayman Islands Data Protection Act.

8. How long we keep it. Customers set retention in the app. By default, detailed location points are kept for 90 days, events and alerts for 365 days, and raw device messages for 30 days. Video clips and face images follow the customer's retention settings. When a customer leaves, we export their data on request and delete it within 30 days after the export window closes, except anything we must keep by law.

9. Security. Information is encrypted in transit and at rest, access is limited by role, sensitive actions are logged, and staff access to production systems is restricted. If a breach affects personal information, we notify the customer without undue delay and support any required notice to the Ombudsman and affected people.

10. Your rights. Under the Cayman Islands Data Protection Act, people can ask to access, correct or delete their personal information, object to certain uses, and complain to the Ombudsman. Drivers and staff of our customers should send requests to their employer; we will help the employer respond. For information we control, contact us using the details below.

11. Changes. We may update this policy. The date at the top shows the latest version, and we tell customers about material changes.

12. Contact. Use the enquiry form on cifu.ai or email the enquiry form on cifu.ai. No phone line.