Privacy Policy

This policy explains what personal data Pickovo Ltd ("Pickovo", "we") collects when you use the Pickovo website, web app and Android app (the "Service"), why we collect it, who we share it with, and the rights you have. We handle personal data in line with Rwanda's Law No. 058/2021 on the protection of personal data and privacy and, for users outside Rwanda, the principles of the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

Pickovo is used by businesses, fleet operators, garages, spare-parts shops and inspection bodies, and by individual vehicle owners.

• Your own account: for the data you give us to create and run your account (and, for vehicle owners, the data you record about your own vehicles), Pickovo is the data controller.
• Data a business records about others: when an organisation records details about its staff, drivers, customers or their vehicles, that organisation is the data controller and Pickovo is the data processor, acting only on its instructions. If you are, for example, a garage customer or a driver, please contact that organisation first about your data; we will help them answer you.

2. What we collect

• Account data: name, email address, phone number, password (stored only as a one-way hash), role, organisation and language preference.
• Business and vehicle records: vehicles (plate number, make, model, VIN, mileage, fuel, insurance and documents), drivers (including licence number and category), assignments, trips, job cards, diagnoses, inspections, quotations, invoices, inventory, bookings, reviews, complaints and messages you exchange on the platform.
• Files you upload: photos, documents and attachments, such as vehicle photos, accident photos or insurance papers.
• Location: only when you allow it, for example, to set a garage's position on the map.
• Payment data: amounts, plan, payment status, gateway references and the Mobile Money number used. We never see or store full card numbers, card security codes or Mobile Money PINs.
• Security and usage logs: sign-in attempts, IP address, device and browser type, session records, and an audit trail of important actions taken in your organisation's account.
• Communications: messages you send us through the contact form, support tickets or email.

3. How we use it

• To provide the Service: running your account, showing your records to the right people in your organisation, and connecting fleets, garages, parts shops and vehicle owners when you choose to work together.
• To send notifications you need or have opted into, in-app, by email, by SMS, or as WhatsApp links you choose to open. You can manage most notification types in your settings.
• To process subscription and invoice payments.
• To keep the Service secure: verifying sign-ins, limiting abuse, detecting suspicious activity and investigating incidents.
• To provide support and respond to your requests.
• To improve the Service using aggregated, de-identified statistics that do not identify any person.
• To meet legal, tax and accounting obligations.

We rely on the performance of our contract with you or your organisation, our legitimate interest in running a secure and reliable service, your consent (for example, access to your location or camera, which you can withdraw at any time in your browser or device settings), and our legal obligations.

4. AI features

Optional AI features, such as vehicle diagnosis suggestions, health scores and the maintenance assistant, send the relevant vehicle and job information you provide to our AI provider, Anthropic, to generate a response. Anthropic processes this data on our behalf under terms that do not allow it to be used to train their models. AI output is a suggestion only; a qualified person should always check it before acting on it. We do not use AI to make decisions about you that have legal or similarly significant effects.

5. Device permissions

The web app and Android app ask for device permissions only when a feature needs them, and you can refuse or withdraw them in your browser or device settings at any time:

• Location used once, when you ask, for example to place your garage on the map. We never track your location.
• Camera to scan part barcodes. Images are processed on your device and are not uploaded.
• Files and photos only the ones you choose to upload.

Some data is stored on your device so the app keeps working offline and syncs when you reconnect.

6. Cookies and local storage

We use strictly necessary cookies to keep you signed in securely and to remember your language. We also store small preferences in your browser (such as whether the sidebar is collapsed or a tip was dismissed) and cache data for offline use. We do not use advertising cookies or third-party tracking, and we do not sell your data.

7. Who we share data with

We share personal data only as needed to run the Service, with service providers bound by confidentiality and data-protection obligations:

• Hosting, database and file storage (Vercel and our managed database provider)
• Security, caching and rate limiting (Upstash)
• Email delivery (Resend) and SMS delivery (our SMS gateway provider)
• Payments (AzamPay, MTN Mobile Money and Centiwise)
• AI features (Anthropic)

Within the Service, your data is visible to the people your organisation authorises and to the businesses you choose to work with, for example, a garage you book receives your booking and vehicle details. We may also disclose data where the law requires it, to protect the rights or safety of users or the public, or as part of a merger or sale of our business, in which case this policy will continue to apply.

8. International transfers

Some of our service providers store or process data outside Rwanda. Where this happens, we transfer data only as permitted by Law No. 058/2021 and with appropriate safeguards, such as contractual data-protection commitments from the provider.

9. How long we keep it

• Account and business records are kept while your account is active.
• After an account is closed, you may export your data for 30 days. It is then deleted from our active systems within a further 30 days.
• Security and audit logs are kept for a limited period (normally up to 12 months) and then archived or deleted.
• Invoices and payment records may be kept longer where tax or accounting law requires it.
• Deleted data may remain in routine backups for a short time before being overwritten.

10. Security

We protect your data with encrypted connections (TLS), hashed passwords, role-based access so people only see what their role allows, separation of each organisation's data, sign-in auditing, rate limiting, signature-verified payment callbacks and regular backups. No system is perfectly secure, but if a personal-data breach affects you we will notify you and the relevant authority without undue delay, as the law requires.

11. Your rights

Under Law No. 058/2021 you have the right to:

• be informed about and access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent at any time;
• not be subject to decisions based solely on automated processing.

To ask us to delete your account and its data, use our account deletion request page. To exercise your other rights, email info@heptadev.com from the address linked to your account. We may need to verify your identity, and we will respond within the time the law requires. If your data was recorded by an organisation (such as your employer or a garage), we will pass your request to them. You may also complain to Rwanda's National Cyber Security Authority (NCSA), the data-protection supervisory authority.

12. Children

The Service is meant for businesses and adults. It is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the Service changes. We will change the "Last updated" date above and, for significant changes, notify you in the app or by email before they take effect.

14. Contact us

Pickovo Ltd, 1 KN 78 St, Kigali, Rwanda · info@heptadev.com · +250 788 701 902