Privacy policy

Lee Henry AI & Technology, Lee Henry AI and Technology Ltd (RC 9955786), 3 Alabi Center, Karaole Street, Abule Egba, Lagos 100276, is the data controller for your account with us. You can reach us at hello@lhat.app.

One important exception, set out in section 4: where you use Fleet Watch to track vehicles driven by your own people, you are the controller of their data and we act on your instructions.

From you, when you set up and use an account:

• Your name, email address and the account or company name you give us.
• The vehicles you add, their plates and the trackers bound to them.
• The drivers you add: their name, and optionally their phone number, licence number and the identifier of the card they tap.
• Zones you draw, settings you change, and commands you send to a vehicle.

From your trackers, automatically:

• Position, speed, heading, satellite count and whether the device had a valid fix.
• Ignition, movement, mileage and battery or power state.
• Alert events such as towing, impact, harsh braking or a power cut.
• The identifier of any driver card tapped in that vehicle.
• Engine data where the vehicle's bus is connected and reports it.

From your device, when you use the app:

• The IP address you signed in from, and the approximate city we resolve from it, recorded once per sign in so you and your account's administrators can spot access you do not recognise.
• A short description of the browser or device used to sign in.
• Strictly necessary cookies that keep you signed in. We do not use advertising cookies and we do not track you across other websites.

When you contact us:

• The messages you send to support and any photographs you attach.
• Enquiries sent from our website, including the email address and WhatsApp number you leave.

• To provide the service you asked for: showing where your vehicles are, building journeys, raising alerts and carrying out commands. This is necessary to perform our contract with you.
• To keep accounts secure: recording sign ins, detecting misuse and investigating incidents. This is our legitimate interest in a secure service, and yours.
• To answer you: support conversations and website enquiries. Contract, or your consent where you contacted us before there was one.
• To bill you and keep proper records. Contract, and our legal obligations.
• To improve the service, using aggregated information that cannot identify anybody.

We do not sell your data. We do not share it with advertisers. We do not use your vehicle positions or your support conversations to train models.

When you track a vehicle driven by an employee or contractor, the data that vehicle produces is about that person as much as about the vehicle. For that data you are the controller and we are your processor: we hold and process it on your instructions and for no purpose of our own.

That makes some things your responsibility, not ours. You must tell your drivers that the vehicle is tracked, what is recorded, why, and for how long, and you must have a lawful basis for doing it. Where you operate, that may also require consultation or consent before you begin.

A driver who wants to know what is held about them should ask their employer first. If they come to us, we will point them to you and tell you they asked.

SICILEE runs in one of two modes and which one applies is set on the organisation, not chosen per request.

• Stateless, which is what every company building on our API gets: nothing is read from memory and nothing is written to it. The context you send is used to answer and then discarded.
• Resident, which runs our own products: SICILEE retains what it needs to be useful across conversations, within your account and never across accounts.

We use a small number of providers, and only for the purposes below.

• Our hosting and database provider, which stores your account, your telemetry and your support attachments.
• A geocoding provider, which turns coordinates into a street name so a journey can be read.
• An IP geolocation provider, used once at sign in to resolve an approximate city.
• A payment provider, when billing is introduced, which will handle card details directly so that we never hold them.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If we are ever asked for your data by an authority and are permitted to tell you, we will.

Some of these providers operate outside your country. Where data is transferred, we rely on the safeguards those providers offer for international transfers.

• Position and journey data: 90 days from the day it was recorded.
• Support conversations and their attachments: for as long as your account is open, so you can read back what you were told.
• Sign in records: 12 months.
• Website enquiries: 12 months after we have answered.
• Account and billing records: as long as we are required to keep them.

When an account is deleted, everything on it is deleted with it, including every position its trackers ever reported. That is permanent and we do not keep a copy.

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing we carry out on the basis of legitimate interests. You can also ask for a portable copy of what you gave us.

Write to hello@lhat.app and we will respond within 30 days. If you are not satisfied you can complain to your data protection authority. In Nigeria that is the Nigeria Data Protection Commission.

Every account’s data is separated at the database itself rather than by a filter in our code: a query that cannot name the account it belongs to is refused. Passwords are handled by our authentication provider and are never stored or seen by us. Support attachments sit in private storage and are served through links that expire.

Access by our own staff is limited to what their job needs and is recorded. Support staff can read support conversations and cannot see vehicle positions, journeys or drivers.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant authority as the law requires.

The services are for businesses and are not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, tell us and we will delete it.

If we change this policy in a way that materially affects you, we will tell you through the service or by email before it takes effect. The date at the top always shows when it last changed.