Nova Fleet

Privacy

Last updated: [date TBD]

POPIA notice — who we are

Nova Fleet is operated by [Company legal name TBD], [Address TBD]. Contact: [contact@ TBD]. Information Officer (placeholder): [Information Officer email TBD].

B2B pattern: the customer organisation is the responsible party for personal information of its workforce and for GPS/IMEI/plates of vehicles it operates. The software operator of Nova Fleet ([Company legal name TBD]) processes that information as an operator to provide the product, once a production operator agreement exists. This localhost build has no production contracts.

Nova Fleet on this build is a localhost / development product. It is not a production deployment, does not use TLS, and the session cookie is not marked Secure.

What this product is

Nova Fleet is a B2B workforce fleet tracker: organisations sign in with email and password and see vehicles and devices in their membership scope.

Nova Fleet is a B2B workforce fleet product for organisations. It is not directed at children.

Data subjects and personal information

Data subjects on this build: organisation users (email, name, role, membership) and people whose location may be inferred from vehicle GPS (drivers/operators of tracked vehicles).

Nova Fleet processes account email and name; role and membership; vehicle plate; device IMEI; GPS coordinates (last_known / points / trips); and the raw ingest payload stored from the device.

Purpose: GPS, IMEI, and vehicle plates are processed so the customer organisation can operate its fleet (locate vehicles in membership scope, match trackers to vehicles, and keep last_known / trips for operations). Account email and name identify the signed-in user and their role.

Roles are owner, manager, driver, and dev. Access follows membership scope (org, fleet, or assigned vehicle).

Compute currently copies the original raw payload into points.extras and last_known.extras. That is a minimisation risk: extra device fields may be retained beyond lat/lon/speed/heading/ignition.

Session cookie (openness)

The only first-party cookie is the necessary session cookie nova_user_id (httpOnly, SameSite=Lax, path=/, Secure when the site is HTTPS). It stores a signed session token after email/password login so the web app can call the server as you. There are no analytics or advertising cookies. The first-visit banner is an openness notice, not Accept-all tracking consent.

Third parties and cross-border

Live maps load raster tiles from OpenStreetMap (tile.openstreetmap.org). OpenStreetMap is a third party. Map tiles and geodata remain © OpenStreetMap contributors.

OpenStreetMap tiles are fetched from servers that are typically outside South Africa (cross-border transfer of map-tile requests). This localhost build has no production host; a future production region is [Host region TBD].

South Africa / POPIA

The Protection of Personal Information Act, 2013 (POPIA) is the primary compliance lens for these notices.

B2B pattern: the customer organisation is the responsible party for personal information of its workforce and for GPS/IMEI/plates of vehicles it operates. The software operator of Nova Fleet ([Company legal name TBD]) processes that information as an operator to provide the product, once a production operator agreement exists. This localhost build has no production contracts.

Information Officer (placeholder): [Information Officer email TBD].

You may lodge a complaint with the Information Regulator (South Africa) (https://inforegulator.org.za/). This page is a product-accurate placeholder, not legal advice.

A production PAIA/POPIA manual and signed operator agreements are still TBD.

Access, correction, export, and deletion

POPIA rights on this build: access (Export data), correction (Request correction to the Information Officer), and deletion of your user and memberships. Organisation fleet history (raw ingest, points, trips, last_known, devices, plates) is not wiped when a person leaves.

Export (Account → Export data) is membership-scoped JSON/zip of your profile, memberships, in-scope vehicles/devices, and org raw/points/trips/last_known only where your membership grants. It never crosses tenant.

Organisation GPS and device records (vehicle plate, IMEI, last_known, points, trips, and raw ingest payload) may remain after your user and memberships are removed.

Contact

Privacy questions: [contact@ TBD]. Information Officer (placeholder): [Information Officer email TBD].