Privacy Policy
Effective 2 November 2026. Mansa Fleet Ltd ("Mansa") collects only the personal data needed to run, secure and bill Mansa Drive, Mansa Invoices and the mansafleet.com website (together, the Service), never sells it, and acts as a processor for the records customers store. Questions go to privacy@mansafleet.com, which also reaches Mansa's data protection contact. Words such as Customer, User and Customer Content mean what the Terms of Service say.
Mansa Fleet Ltd is being registered in Kenya. These documents are being reviewed by our lawyer; we will give 30 days’ notice of any material change.
Two roles
For account, billing and usage data, Mansa is the controller. For Customer Content (the files and records a company uploads or creates, such as pay statements, loads, fuel and IFTA data, driver, truck and owner records, and the people named in them), the Customer is the controller and Mansa is its processor under the Data Processing Agreement. Requests about those records go to the Customer first.
What we collect and why
| Data | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Website visits | IP address, browser and the page asked for, processed by Cloudflare to deliver and protect mansafleet.com | Delivering the site, blocking attacks | Legitimate interests |
| Account | Name, email, profile photo, company, role | Sign-in, access control, support | Contract |
| Billing | Plan, invoices, payment method type, masked phone or card ending, transaction references | Charging, receipts, fraud prevention, tax | Contract, legal obligation |
| Usage and security | Actions in the audit trail, IP address, device and browser, sign-in times, error logs | Security, abuse prevention, audit trail, fixing faults | Legitimate interests |
| Product usage analytics (inside the apps only) | Features used and how often, setup steps completed and when, days active; tied to an account ID, no names, file contents or record text | Finding where people get stuck and improving the Service | Consent, withdrawable at any time |
| Customer Content | Uploaded files, Extracted Text, records, pay and deduction details, approvals, signatures | Providing the Service to the Customer | Processor, on the Customer's instructions |
| Support | Messages and attachments you send us | Answering you | Contract, legitimate interests |
The mansafleet.com website sets no cookies of its own and runs no analytics or advertising. Mansa does not receive full card numbers or mobile money PINs; these are handled by the Payment Provider. For fuel cards the Service keeps only the last 6 characters, and for driver ID numbers (such as a CDL, SSN or national ID) only the last 4.
How text is read from files
Uploaded files are read so their text can be searched (Mansa Drive) or imported as loads, fuel purchases and statements (Mansa Invoices). PDFs, spreadsheets and Word files are read by the Service itself where it can. Scanned pages, photos, screenshots and PDFs it cannot read are sent to Anthropic, PBC (Claude), which reads the text and returns it, and may suggest details (such as title, dates, party, amounts or load IDs) for you to confirm before they are saved. In Mansa Drive a company's administrator can switch off reading scans with AI; those files are then searchable only by title and tags. Anthropic acts as Mansa's Subprocessor and processes this content under its commercial terms and data-use commitments.
International transfers
Data may be processed outside your country, including in the United States and other countries where our providers operate. Where required we use lawful transfer safeguards, such as the EU Standard Contractual Clauses or the safeguards required by the Kenya Data Protection Act 2019.
How long we keep it
Account data: for the life of the account plus 90 days. Billing records: as long as tax law requires, typically 7 years. Security logs: up to 12 months. Customer Content and Extracted Text: until the Customer deletes it or 30 days after the account closes. Backups roll off within a further 35 days.
Deleting your account or your company's data
A signed-in user can ask Mansa to delete their own account, or the whole company's records, from the app or by email to support@mansafleet.com. We confirm the request, then delete or anonymise the data within 30 days and tell you when it is done; the company can export its records and files first. When a company uses both products, deleting a record in one product does not delete a copy kept in the other.
Legal hold
Records the law requires us to keep are held instead of deleted: billing and tax records for 7 years in the United States and 5 years in Kenya, or the period the law of the company's country sets (Mansa keeps this period per country); and records a court, regulator or tax authority has asked us to keep, for as long as that request lasts. Held records are kept apart, used for nothing else, and deleted when the period ends. Backups roll off within a further 35 days.
Your rights
Depending on where you live (for example under the Kenya Data Protection Act 2019, GDPR, UK GDPR or US state privacy laws), you may ask to access, correct, delete, restrict, object to or port your personal data, and withdraw consent. Contact privacy@mansafleet.com. We answer within the time the law sets and may need to verify your identity. You may complain to your data protection authority, such as Kenya's Office of the Data Protection Commissioner.
Security
We use encryption in transit, access controls by role, file type checks on upload, an audit trail, and limited staff access. Mansa Drive password vault entries are end-to-end encrypted: they are encrypted in your browser before they are saved, and we store only ciphertext and the encrypted keys. A Mansa Invoices company can also encrypt its records with its own passphrase. The Security page says what is in place today and what is still to come. No system is fully secure, and we cannot guarantee that data will never be accessed without permission.
Children
The Service is not for anyone under 18, and we do not knowingly collect their data as account holders.
Cookies and storage
See the Cookie Policy. Without your consent the apps use only essential storage, for security and remembering your settings, and no advertising cookies or tracking pixels. Offline copy: if you turn on working offline on a device, a copy of your company's records (never passwords) is kept in that browser until you remove it or lose access to the company. Anyone who can use that browser can open it, so turn it off on shared devices.
Changes
We will post updates here and give notice of material changes at least 30 days before they apply.