Privacy Policy

Introduction

Fleetira ("Fleetira", "we", "us", "our") is a product operated by AHMEDMEDIAGROUP, an organisation registered in the United Kingdom. We provide a Mobile Device Management ("MDM") platform for Apple devices, built for automation and usability, enrolling, configuring, and securing macOS, iPadOS, and iOS.

This policy explains what personal information we collect when you visit fleetira.io, join the waitlist, or use the Services, how we use that information, who we share it with, and the choices you have. By using the Services you agree to these practices.

For privacy questions, write to hello@fleetira.io.

What We Collect

Information You Give Us. Name, work email, organisation name and size, role, billing details (post beta), message content, and anything else you submit via forms or support channels.

Information From Your Use. Browser, operating system, device type, IP address, approximate location derived from IP, session identifiers, pages viewed, referrer, and timestamps. We use this to operate the site and detect abuse.

Customer Managed Device Data. If your organisation enrols devices, we receive, as instructed by the device's controlling organisation and within the limits of Apple's MDM protocol, hardware identifiers, OS version, installed applications, configuration profile state, supervision state, and compliance signals. We do not access user files, messages, photos, browsing history, or document contents.

Cookies And Local Storage. See the Cookies section below.

How We Use It

• Operate, maintain, secure, and improve the Services.
• Communicate about your account, waitlist status, beta invitations, support requests, and service notices.
• Send occasional product news. You can opt out from any such email.
• Detect, prevent, and respond to fraud, abuse, security incidents, and breaches of our Terms.
• Produce aggregated, de identified analytics to understand product usage.
• Comply with our legal obligations and respond to lawful requests.

We do not sell personal information. We do not use personal information for cross context behavioural advertising.

Legal Basis For Processing (UK/EU)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Contract, to provide the Services you've requested.
• Legitimate Interests, to operate, secure, and improve the Services, and to communicate about them in ways you would reasonably expect.
• Consent, for optional marketing emails and non essential cookies. You can withdraw consent at any time.
• Legal Obligation, to comply with applicable law and respond to lawful requests.

Who We Share With

• Sub Processors, Vetted vendors that help us deliver the Services (for example, cloud hosting, transactional email, AI inference, and analytics). Each is bound by a written Data Processing Agreement.
• Apple Business Manager, When you connect ABM, we exchange the data Apple's protocol requires to enrol and manage your devices, at your direction.
• Authorised Integrations, Identity providers (SSO, SCIM), security tooling (SIEM), and ticketing systems, only at your direction and only with the data you instruct us to share.
• Legal And Safety, Where we have a good faith belief that disclosure is required to comply with law, enforce our Terms, or protect rights, property, or safety.
• Corporate Transactions, In a merger, acquisition, financing, or sale of assets, with reasonable confidentiality protections.

Current Sub Processors.

• Cloudflare, Inc. (United States, with global edge locations). Provides website hosting, edge caching, DDoS protection, and the database (Cloudflare D1) that stores waitlist signups. Cloudflare also handles the Pages Functions that process the waitlist and contact forms.
• Resend, Inc. (United States). Sends transactional email on our behalf, namely waitlist confirmations, contact form notifications to us, and auto acknowledgements to people who write in.
• Google Ireland Ltd. (Ireland, with global infrastructure). Provides Google Analytics 4, used only after you click Accept on our cookie banner. No data is sent to Google if you click Reject.

We give at least 30 days' written notice before any new sub processor begins processing customer data. To request the latest list or notify us of an objection, email hello@fleetira.io.

Cookies And Similar Technologies

This Waitlist Site (fleetira.io). Sets no cookies on first visit. We store one browser localStorage entry, fleetira_consent_v3, that records your answer to our cookie banner so we don't ask again on every page. That entry is strictly necessary under UK GDPR / PECR and is exempt from consent.

Analytics — Optional, Off Until You Accept. If you click Accept on the cookie banner, we load Google Analytics 4 to understand how people use this site. Google sets first party cookies (_ga and _ga_*) with up to a two year lifetime, and receives an anonymised IP address along with usage events. If you click Reject, Google Analytics never loads, no analytics cookies are set, and no usage data is sent. Google's processing of analytics data is governed by Google's own Privacy Policy.

Withdrawing Or Changing Your Choice. To change your answer at any time, clear cookies and site data for fleetira.io in your browser settings, then reload — the banner will reappear with both options. You can also install Google's official opt out add on, which disables GA on every site that uses it.

The Fleetira Product (web application). Once paid plans launch and you sign in to the product, a small number of first party cookies and local storage entries are used:

• Strictly Necessary, Authentication, CSRF protection, and load balancing. The Services do not work without these.
• Preferences, Theme, language, and other UI choices you make.
• Analytics, Privacy respecting, aggregated measurement of feature usage. No cross site tracking, no advertising identifiers.

We do not run third party advertising cookies anywhere. Where required by law, we ask for consent for non essential cookies before they are set.

Security

• TLS 1.3 in transit and AES 256 at rest for all customer data.
• PostgreSQL row level security, every query is scoped to your organisation_id.
• APNs and MDM identity certificates are encrypted at rest and never exposed to client devices.
• Bearer token authenticated Edge Functions and 15 second timeouts on external fetches.
• Continuous vulnerability scanning, dependency auditing, and least privilege internal access.
• SOC 2 Type II is on our post beta roadmap; we will publish the report when complete.

To report a suspected vulnerability or compromise, email hello@fleetira.io. We aim to acknowledge within one business day.

Your Rights

Depending on where you live (including UK GDPR, EU GDPR, California CCPA/CPRA, Canada PIPEDA), you may have the following rights over your personal information:

• Access, Obtain a copy of the personal data we hold about you.
• Correction, Ask us to correct inaccurate or incomplete data.
• Deletion, Ask us to delete personal data, subject to legal retention requirements.
• Portability, Receive your data in a structured, machine readable format.
• Objection, Object to processing based on legitimate interests, including direct marketing.
• Restriction, Ask us to limit how we use your data while a dispute is resolved.
• Withdraw Consent, Where processing is based on consent, withdraw it at any time.
• Lodge A Complaint, With your local data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk).

To exercise any of these rights, email hello@fleetira.io. We will respond within the statutory time limit (one month under UK/EU GDPR), and we will not discriminate against you for exercising your rights.

International Transfers

Fleetira is operated from the United Kingdom. Our infrastructure runs in the United Kingdom, European Union, and United States. Where personal data is transferred outside the UK or EEA, we rely on UK Addendum or EU Standard Contractual Clauses, supplemented by technical measures (encryption in transit and at rest, key separation) where appropriate.

Retention

We retain personal data only as long as we have a lawful reason to do so:

• Active Accounts, For the life of the account, plus a reasonable wind down period after termination.
• Waitlist Entries, Until you unsubscribe, or for up to 24 months of inactivity.
• Support Correspondence, Up to 3 years after the last interaction.
• Billing And Tax Records, For the period required by applicable law (typically 6 to 7 years in the UK).

You can request deletion at any time. We purge or anonymise within 30 days of a verified request unless we are required to retain the data by law.

Children

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, email hello@fleetira.io and we will delete it.

Data Processing Agreement & Sub Processors

For customers acting as a data controller, we offer a GDPR Article 28 compliant Data Processing Agreement. To execute the DPA or request our current sub processor list, email hello@fleetira.io. We will give 30 days' notice of any new sub processor before they begin processing customer data.

Changes To This Policy

We may update this policy from time to time. Material changes will be announced at least 30 days in advance by email and via an in product banner. The "Last Updated" date at the top of this page always reflects the latest revision. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

How To Contact Us

Fleetira, A Product By AHMEDMEDIAGROUP
United Kingdom
Email: hello@fleetira.io