Privacy Policy

Vebric (“we”, “us”) provides a fleet tracking and telematics platform at vebric.app that lets organizations monitor the location and condition of their equipment and vehicles. For questions or requests about your data, contact us at support@vebric.app.

• Account information. When you sign in with Google, Microsoft, or an email magic link, we receive and store your email address and display name from your identity provider, along with your sign-in times and role within your organization. We never see or store a password.
• Machine location and telemetry.GPS trackers and manufacturer telematics feeds installed on your organization’s equipment report position (latitude/longitude), speed, heading, ignition state, engine and CAN-bus data (such as fuel level, RPM, and battery voltage), and device identifiers (IMEI, serial number, SIM number/ICCID, VIN). This data describes machines; where a machine is operated by an identifiable person, it may also constitute personal data about that person.
• Customer records your organization enters. Organizations may store contact records for their own customers (name, company, email, phone, notes) to associate machines with them. Your organization controls this data; we process it on their behalf.
• Preferences and activity. Your interface preferences (theme, map style, alert settings) and an audit log of administrative actions taken in the app.

We do not collect payment card details (billing is handled by Stripe), and we do not run any advertising or analytics trackers.

When you open the map, your browser may ask permission to use your device’s location. If you allow it, your location is used only on your device to center the map — it is never transmitted to our servers or stored. You can decline the prompt or revoke the permission in your browser at any time; the map works without it.

We use only strictly necessary cookies — the ones required to keep you signed in and to secure the service. Because we set no optional, analytics, or advertising cookies, there is nothing to opt in or out of; we show a one-time notice for transparency instead of a consent wall.

• Authentication cookies (names beginning sb-): hold your encrypted Supabase sign-in session so you stay logged in. Deleted when you sign out.
• vebric_backup_oauth_state: a short-lived (10 minute) security cookie used only during the administrator Google Drive backup connection flow, to prevent cross-site request forgery.
• Browser local storage (keys beginning vebric:): your theme choice, whether you dismissed the welcome tour and the cookie notice, and the last product announcement you saw. These never leave your device.
• Map imagery cache: to make the map fast, satellite and street map tiles you view are cached on your device for up to 30 days. Cached tile addresses can reveal which geographic areas you viewed. You can clear this cache at any time from Account → Privacy & Data → Clear cached map imagery, or by clearing your browser’s site data.

We share data with a small set of service providers, only as needed to run the platform:

• Supabase — authentication and magic-link sign-in emails. Your browser communicates with Supabase directly during sign-in.
• Google and Microsoft — if you choose them as your sign-in provider, your browser is redirected to them and they learn that you sign in to Vebric.
• Map imagery providers — Mapbox, Esri/ArcGIS, OpenStreetMap, CARTO, and OpenMapTiles serve map tiles and fonts directly to your browser. They receive your IP address and the tile coordinates of the areas you view, subject to their own privacy policies.
• Resend — delivers organization invitation emails (recipient address, inviter name, organization name).
• Stripe — subscription billing for organizations; card details go to Stripe, never to us.
• Google Drive — encrypted-in-transit system backups (which include the database) are stored in a Vebric-controlled Google Drive account.
• Connectivity and telematics partners— Hologram (tracker SIM management) and equipment manufacturers’ telematics APIs (e.g. MyDevelon) that supply machine data for your organization’s equipment.

We never sell personal information or share it for advertising.

• Machine position and event history: 90 days.
• Raw device diagnostic data: 30 days.
• Administrative audit logs: 365 days.
• Account, organization, and customer records: for as long as the account or organization remains active, then deleted on request or on account closure.

Depending on where you live (including under the GDPR and the California Consumer Privacy Act), you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. You can export your data and permanently delete your account yourself at any time from Account → Privacy & Data in the app. For anything else, email support@vebric.app — we respond within 30 days. If your data was entered by an organization using Vebric (for example, a customer record or telemetry from a machine you operate), we may refer your request to that organization, which controls that data.

If your organization tracks vehicles or equipment operated by employees or other identifiable people, your organization is responsible for having a lawful basis to do so and for informing those individuals, as described in our Terms of Service.

All traffic is encrypted in transit (HTTPS/TLS). Access to data is scoped to your organization and role, administrative actions are audit-logged, and we retain raw data only as long as described above. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify affected users and authorities as required by law.

Vebric is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children.

If we make material changes to this policy, we will update the effective date above and notify signed-in users in the app. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.