Legal document

Privacy Policy and Personal Data Processing Policy

Version 2026-11-01 · Effective November 1, 2026 · This document is available in English and in Spanish.

1. Who is responsible and who this Policy applies to

This Policy explains how VanTrack (Brayan Felipe Castrillon Salazar, C.C. 1193226446), domiciled at Pereira, Risaralda, Colombia, email brayan.desarrollo2270@gmail.com ("VanTrack", "we"), processes personal data in connection with the VanTrack service: the web platform (including the site https://app.vantrack.cloud/ and each company's workspace on its subdomain), the "VanTrack" mobile app for Android and iOS, the API and our communications (the "Service").

This Policy is also our personal data processing policy under Colombia's Law 1581 of 2012 and Decree 1377 of 2013 (incorporated into Decree 1074 of 2015), and our privacy notice for the purposes of United States privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), to the extent they apply to us. It is written for three kinds of people:

• Visitors and prospects: people who visit our site, watch the demo video or request a demo.
• Customers and their administrators: the company that contracts VanTrack and the people who represent it before us (contact, billing, support).
• Users of a company: the people a customer company gives access to (administrators, managers, office staff and drivers), and any other person whose data that company loads (for example, a shop contact or someone who appears in a photo).

Two roles matter here. When a customer company loads its Users' and its operation's data into VanTrack, that company is the data controller (the "business" in CCPA terms) and VanTrack acts as processor (the "service provider"): we process that data solely on the company's behalf, under its instructions and under Annex A of the Terms of Service. If you are a User of a company, that company decides which of your data it loads, why and for how long, and it is the company you should contact first with your requests; we will help it and, if you write to us directly, we will tell you so and forward your request. For prospects' data, Customers' contact and billing data, support data and usage data, VanTrack is the controller and this Policy applies directly.

2. What data we process

We process only the data needed to provide the Service. We do not ask for or want sensitive data (health, biometrics, ethnic origin, beliefs, union membership, sex life), personal financial data, or data of anyone under 18; Customers agree not to upload them.

What we do not collect. We do not use the device's location, we do not read your contacts, we do not access the microphone, we install no advertising trackers or third-party analytics, and we do not profile people or make automated decisions with legal effects on them.

3. Why we use the data and on what basis

We do not use the data for advertising, we do not market to companies' Users and we do not "sell" or "share" personal data within the meaning of the CCPA/CPRA. The only commercial emails we send go to prospects who requested information or to Customers' contacts about the Service itself, and they can always opt out.

4. The mobile app: permissions and data on the phone

• Camera and photos. The app asks for permission to use the camera or pick photos from the gallery only when you choose to attach a photo to an inspection, a fault or a receipt. Photos are resized on the phone and sent to your company's workspace; no gallery photos you did not choose are uploaded. You can revoke the permission in the phone's settings.
• Location, contacts, microphone. The app neither uses nor requests them.
• Data stored on the phone. The app keeps, in the system's secure storage, an access token for each company you signed in to, your name and role, the chosen language and theme, and a temporary cache of what you view so screens load fast. Signing out deletes the token; uninstalling the app deletes everything.
• Notifications. Today the app receives the bell's notices through a direct connection to the Service (WebSocket) while it is open. If in the future we enable push notifications through Google (Firebase) or Apple, the device identifier needed to send them will be treated as usage data and explained here.
• Connections. The app communicates only with VanTrack's servers, over HTTPS, and reaches NHTSA or Google Maps only through our servers, never directly.

5. Who we share data with (processors and third parties)

We do not sell, rent or give away personal data. We share it only with:

• The customer company you belong to. Its administrators see its Users' and its operation's information within its workspace, according to each role. We do not decide those accesses.
• Providers that help us operate (subprocessors), chosen for their security and bound by contract to use the data only to provide their service to us:

• Authorities and third parties under legal obligation, when a law, a court order or a competent authority requires it, or when necessary to protect rights, people's safety or the integrity of the Service. Where the law allows, we will notify the Customer before handing over its data.
• A successor to the business, if VanTrack is sold, merged or reorganized; the data would remain protected by this Policy and we would notify Customers.
• Professional advisers (accounting, legal) bound by confidentiality, to the extent strictly necessary.

We will give at least fifteen (15) days' notice, by updating this table and by email to Customers' administrators, before engaging a new provider that processes personal data.

6. International transfers

VanTrack is operated from Colombia and hosted on servers located in the United States. Personal data is therefore transferred between both countries and, for email, to the European Union (Brevo). The United States and the European Union countries are on the list of countries with an adequate level of data protection issued by Colombia's Superintendence of Industry and Commerce (External Circular 005 of 2017, incorporated into its Single Circular), so the transfer is permitted by Law 1581 of 2012; in addition, the Customer, as controller, authorizes the transmission to VanTrack as processor through Annex A of the Terms. For people located in the United States, their data may be accessed from Colombia by the VanTrack team to provide support and operate the Service, under the same security and confidentiality measures.

The Service is not directed at people located in the European Union, the United Kingdom or Switzerland, and this Policy is not designed for the GDPR; if a company from those regions wants to contract VanTrack, we will agree the necessary clauses beforehand.

7. How long we keep the data

When a period ends, we securely delete or anonymize the data. The databases with personal data we manage as controller remain in force for as long as the Service exists and the purposes of this Policy subsist.

8. How we protect the data

We apply technical, human and administrative measures proportionate to the data we process, including: encryption of all communications with HTTPS/TLS; passwords stored with strong hashing functions, never in clear text; a separate database schema for each company, so that none can see another's data; role-based access control defined by each company; photos and receipts served only to that company's authenticated users; temporary lockout after several failed sign-in attempts; secure session cookies; security headers in the web application (including a content policy that prevents loading unauthorized third-party code); access logs; daily backups; security updates of the system and its dependencies; and VanTrack staff access limited to what is necessary, with individual credentials and under confidentiality.

No system is infallible. If a security incident affects personal data, we will investigate immediately, notify the affected companies without undue delay and no later than 72 hours after confirming it, give them the information they need to meet their own notification obligations and, where the law requires it, inform the authorities (in Colombia, the Superintendence of Industry and Commerce) and the affected people.

9. Your rights

9.1 If you are in Colombia or a data subject under Law 1581 of 2012

You have the right to: know, update and rectify your data; request proof of the authorization given; be informed about the use made of it; file complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law; revoke the authorization and request deletion of your data when no legal or contractual duty requires keeping it; and access it free of charge. Inquiries are answered within a maximum of ten (10) business days of receipt (extendable by five more, with notice to you) and complaints within a maximum of fifteen (15) business days (extendable by eight more, with notice to you), under articles 14 and 15 of Law 1581 of 2012. If a complaint is incomplete, we will ask you to complete it within the following five days; if two months pass without a response, it will be deemed withdrawn.

9.2 If you are in the United States

Depending on your state and whether the law applies to you (for example, the CCPA/CPRA in California), you may have the right to: know what personal data we hold about you, where it comes from, what we use it for and whom we share it with; obtain a copy; correct inaccurate data; ask us to delete it; opt out of the sale or sharing of your data for advertising (we do not do it); limit the use of sensitive data (we do not process it); and not be discriminated against for exercising your rights. You can exercise them yourself or through an authorized agent. We will respond within the deadlines set by your law (in California, confirmation within 10 business days and a response within 45 days, extendable by another 45 with notice to you). If we deny a request, we will tell you why and how to appeal. If you are a User of a customer company, as a rule that company is the responsible "business" and we will refer you to it, helping it respond.

9.3 How to exercise them

Write to brayan.desarrollo2270@gmail.com with the subject "Personal data", stating your name, the company you belong to (if applicable), which right you want to exercise and a description of your request. To protect your information, we will verify your identity in a reasonable way (for example, by your replying from the email registered in your account or through your company) before handing over or deleting data. If you have an account in the Service, you can change your language, theme and password from the settings, and ask your administrator to update your name and email. Exercising these rights is free.

10. How to delete your account and your data

VanTrack accounts are created by the customer company for its Users; neither the web platform nor the mobile app lets you create accounts on your own. Therefore:

• If you are a User of a company (driver, manager, administrator): you can request the deletion of your account in three ways: in the mobile app, under More → Delete my account; on the public page https://app.vantrack.cloud/eliminar-cuenta/ (we email you a link to confirm); or by writing to brayan.desarrollo2270@gmail.com with the subject "Delete my account". Once the request is recorded, your company's administrators are notified and handle it from "Users" within 15 business days at most; if they do not within that period, we do it and confirm it to you by email. Meanwhile you can keep using your account and withdraw the request from the app. An administrator may also delete your account on the company's initiative, or "deactivate" it (close the access while keeping your record) when appropriate. Deleting the account removes your name, username, email and password and closes the access; the operational records you created (inspections, repairs, notes) are kept as the vehicle's history, without your contact information, because they belong to your company and its obligations. If you are your company's only administrator, nobody inside the workspace can process the request: we will contact you to agree on the export and the closing of the workspace (next point).
• If you are a company administrator and want to delete the whole workspace: write to us from the administrator's email at brayan.desarrollo2270@gmail.com. We will first offer you a full export, and then delete the workspace as described in section 7.
• If you are a prospect: ask us to delete your data at the same address or by replying to any of our messages; we will do it within 10 business days at most.
• In the mobile app: "More → Sign out" removes the access from the phone and uninstalling the app deletes everything it stores locally, but neither deletes your account: for that use "More → Delete my account" or the page above.

We may keep what the law requires us to keep (for example, billing records) and security logs for the periods in section 7.

11. Cookies and similar technologies

The web platform uses only its own, necessary cookies and local storage: the session cookie (to keep you signed in; if you tick "Remember me" it lasts up to two weeks, otherwise it is deleted when you close the browser), the cross-site request forgery (CSRF) protection cookie, and preferences such as language, light or dark theme and menu state. We use no advertising cookies or third-party analytics. Google Maps, when the company has it enabled, may set its own cookies when loading a map, under Google's policy. You can delete cookies from your browser; without the session cookie the Service cannot be used. Since we do not track visitors across sites, we do not respond to "Do Not Track" signals differently from how we treat everyone.

12. Minors

The Service is for companies and their workers aged 18 or over. We do not knowingly collect data from minors. If you believe a minor has an account, let us know and we will delete it along with their data.

13. Communications

We send transactional emails needed for the Service (notices your company configures, password reset, trial or subscription status, changes to these documents) that you cannot turn off while you have an account, except operational notices, which your company can configure. We send commercial communications only to those who requested information and to Customers' contacts, with a clear way to stop receiving them. The Service's WhatsApp links simply open that app on your phone so you can decide to write; we send no automated WhatsApp messages.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, in our providers or in the law. We will publish the new version on this page with its date and, if the change is material, notify Customers' administrators by email or within the Service at least fifteen (15) days in advance. If the change involves processing that requires a new authorization from data subjects, we will request it before applying it. Previous versions are available on request.

15. Contact and service channel

The area in charge of handling inquiries, complaints and requests about personal data is the VanTrack team, at brayan.desarrollo2270@gmail.com and at Pereira, Risaralda, Colombia. If you are not satisfied with our response, in Colombia you may go to the Superintendence of Industry and Commerce (www.sic.gov.co) and, in the United States, to your state's privacy authority or attorney general.

This Policy takes effect on the date stated at the top and replaces any previous version.