Privacy Policy

1. Who we are & what this covers

Alchemilla Ventures Private Limited, incorporated in India, operates Steer ("we", "us" or "our"). This policy explains our handling of personal information through steer.ae, our fleet-management platform, contact forms, support and associated email, SMS and WhatsApp communications. Our business address, mobile/WhatsApp number and legal email appear below.

It applies to visitors, prospective customers, workspace users and people whose information is supplied through a customer's fleet operations. It does not replace your employer's or fleet operator's own privacy notice, or the independent policies of payment and messaging providers. The Terms of Service govern the commercial relationship.

2. Our role & your fleet operator's role

For website enquiries, our business contacts, account administration, security and billing, we decide why and how information is used. For fleet and driver information entered into a customer workspace, the customer normally determines the tracking purpose, access permissions and lawful instructions, and we process information to provide that service on its behalf. The precise legal roles depend on applicable law and any agreed data-processing contract.

If you are a driver or employee, ask your fleet operator about the monitoring it has enabled. You may also contact us, and we will help route a request to the appropriate authorised organisation. A workspace administrator's access does not remove an individual's legal rights.

3. Information we collect

What we receive depends on the features used and the information you or your organisation supplies.

• Account and company information: names, usernames, email addresses, phone numbers, company and address details, roles, permissions and credential-verification records.
• Fleet and driver records: vehicle identifiers and plates, device identifiers, driver assignments, fleet records, notes and uploaded documents or images.
• Location and telemetry: vehicle coordinates, timestamps, routes, movement, speed, ignition and supported fuel, engine and sensor readings; associated trips, alerts and reports.
• Messages and enquiries: contact-form fields, support correspondence, message content you provide, phone identifiers, message references, delivery events and communication preferences where recorded.
• Orders and payments: purchased vehicle counts, billing periods, amounts, currencies, order/payment references, payment status and related invoice, refund and reconciliation records.
• Technical information: connection and security logs, IP addresses where logged, browser/device information supplied during requests and locally saved preferences or cached application data.

Do not submit unnecessary identity documents, sensitive personal information, complete card numbers, banking passwords or third-party information you are not authorised to disclose.

4. Where information comes from

We receive information directly when you register, sign in, purchase, submit a form or contact us; from administrators who create users or fleet records; from installed telematics devices; and from service providers that deliver messages, verify payments or support an enabled feature. Some technical information is generated automatically when the service is used.

Customers must ensure they can lawfully supply employee, driver and other third-party data. A contact enquiry is sent to our team's mailbox; choosing to enquire does not enrol you in a promotional messaging list.

5. Why we use information

• Provide accounts, workspace access, fleet monitoring, history, alerts, reports and requested integrations.
• Verify sign-ins, deliver requested authentication codes and manage permissions.
• Answer enquiries, provide support, arrange delivery or installation and communicate about service.
• Process and reconcile purchases, invoices, refunds and payment disputes.
• Detect abuse, troubleshoot failures, maintain the service and protect accounts and devices.
• Meet legal obligations and establish, exercise or defend legal claims.
• Send optional promotional communications only with the permission required by applicable law.

Where applicable law requires a legal basis, we rely on the appropriate basis for that purpose, such as fulfilling a contract or authorised customer instruction, consent, a legal obligation or a permitted legitimate interest. We do not treat acceptance of the terms as consent to every optional use. Withdrawing an optional permission does not affect processing that has a separate lawful basis.

6. Vehicle & optional browser location

Vehicle tracking can reveal a driver's movements and work patterns, including when the driver is not actively using the website. Customers must give appropriate notices and obtain any required permissions before collecting that information. Access and sharing should be limited to authorised operational purposes.

Separately, an address form may offer "Use my location". If you choose it and grant browser permission, coordinates are used to help fill an address and may be sent to BigDataCloud for an address lookup. You can decline permission or enter the address manually. This browser request is not permission for background tracking of your personal phone.

Maps and address providers can receive the requests, network information and geographic context necessary to display maps or perform a lookup. They handle their own processing under their policies. Do not assume every map provider receives every fleet record.

7. WhatsApp, Meta, SMS & email

When you contact us on WhatsApp or request a supported phone-based sign-in code, your phone number, the relevant message and delivery information may be processed through WhatsApp/Meta and, depending on configuration, a messaging provider such as Twilio. Email providers and SMS carriers similarly process information necessary to deliver those communications.

Messages may include requested sign-in codes, replies to your enquiry, support information and account or order updates you have opted to receive. Appropriate opt-in is required before business-initiated WhatsApp messages; we use approved templates where WhatsApp requires them. Providing a phone number alone is not unrestricted marketing consent. Separate permission is needed for promotional use where applicable law requires it.

To withdraw messaging consent, email info@steer.ae with the affected phone number and the categories or channels you want stopped, or tell our team in your support conversation. You can also block our business within WhatsApp. We respect opt-out requests; an opt-out is not a request to cancel your account or delete all its data. A new sign-in-code request is a request for that authentication message, not renewed permission for marketing.

We use WhatsApp-related information to support the communication and its legitimate service purpose, not to build unrelated advertising profiles. We do not forward one customer's private conversation to another customer. Do not send full payment-card numbers, banking credentials or sensitive identifiers in messages. For a human escalation, email or call us.

WhatsApp/Meta also processes information under its own Privacy Policy and Business Messaging Policy. Our Data Deletion Instructions cover information we control, including relevant Steer messaging records; they do not delete your WhatsApp account.

8. Razorpay & payment information

Razorpay processes online payments where enabled. Checkout can receive the order amount, currency and the name, email and phone information used to prefill it. Your payment details are supplied to the payment provider; Steer receives order and payment references, status and verification information for reconciliation and account activation.

We do not store complete card numbers or CVVs, and we do not ask you to send a payment OTP or banking password to our staff. The provider and financial institutions may process information for fraud prevention, regulatory compliance, disputes and settlement under their own duties. Read Razorpay's Privacy Policy and our Refunds & Cancellations Policy before paying.

9. When we share information

We do not sell personal information or sell fleet-location data for advertising. Relevant information may be shared with:

• Your workspace's authorised users and the recipients your organisation selects for exports or tracking links.
• Hosting, storage, communications and support providers that help deliver or secure the service, with appropriate contractual restrictions where they act on our behalf.
• Payment, mapping and messaging providers for the feature you use, including their independent processing described above.
• Installation or delivery providers where needed to fulfil your order, limited to the relevant contact and job information.
• Professional advisers or authorities where needed for a lawful obligation, security incident, dispute or legal claim.
• A successor in a business transaction, subject to applicable protections and any notice required by law.

We aim to disclose only information relevant to the purpose, not an entire workspace when a narrower disclosure is sufficient.

10. Cookies & browser storage

Steer uses local storage, session storage, application caches and a preference cookie for functions such as sign-in state, language, interface preferences and saved application views. Some cached information may contain account or fleet data. Sign out on shared devices and use your browser's controls to clear storage when appropriate; doing so can remove preferences or require you to sign in again.

Third-party features, such as checkout or maps, may use their own cookies or similar technologies under their policies. We do not treat necessary application storage as consent to advertising tracking. If we introduce optional analytics or advertising technologies that require consent, we will provide the relevant notice and choice before their use.

11. Retention & international processing

Raw telemetry is retained for the deployment's configured history window, normally 180 days unless a different period is agreed or configured. This is not a promise that every record is erased at day 180: fleet records, derived reports, alerts, account information and billing records can have different operational or legal retention needs.

Account and workspace information is kept while needed to provide the service and fulfil lawful obligations. Enquiries and messaging records are kept as needed for support, security, communication preferences or claims. Transaction and invoice records may need to be retained for accounting, tax, fraud prevention or legal requirements after an account closes. Authorised deletion and any applicable exceptions are described below.

Our company is based in India. Depending on deployment, customer location and the providers used, information may be processed in India or other countries. We do not promise a particular data-residency region unless it is expressly agreed in writing. Where applicable law requires transfer safeguards, we use the safeguards appropriate to that transfer. Contact us about deployment-specific hosting or processing requirements before providing restricted data.

12. Security & shared links

Safeguards include protected credential verification, account permissions, workspace access controls and authenticated device ingestion. Security also depends on the deployment, device connectivity and how administrators configure and use the service. Use secure website connections, protect your credentials and keep devices and user access under review. No transmission method or storage system can be guaranteed completely secure.

Public tracking links intentionally allow access to the information shared through that link. Anyone who obtains a link may be able to view it, so do not publish it unintentionally. Downloaded reports, screenshots and data copied to another system are outside the workspace's access controls. Tell us promptly if you suspect unauthorised disclosure or access.

13. Your rights & privacy requests

Depending on applicable law and our role, you may request access to your information, correction, erasure, withdrawal of consent, restriction or objection to processing, or a portable copy where that right applies. You may also raise a privacy grievance or contact the competent authority. Not every right applies to every record or legal basis.

Email info@steer.ae with the subject "Privacy request" or "Privacy grievance", the relevant account or phone identifier and a description of the request. We may ask for proportionate information to confirm your identity and authority; do not send passwords, sign-in codes or unnecessary identity documents. We respond within the period required by applicable law. If customer-controlled data is involved, we coordinate with the authorised workspace operator rather than disclose another organisation's records.

14. Data deletion instructions

Email info@steer.ae with the subject "Data deletion request". Include the email address or phone number associated with Steer, your company/workspace if relevant, and whether you want an account, WhatsApp-related records or other specified data deleted. State your authority if acting for an organisation or another person. Do not include a password or OTP.

We complete authorised deletion requests within three working days after your identity and authority have been verified. We confirm completion by email. A request affecting an entire workspace requires the appropriate owner's authority; an individual's request is handled according to the rights and legal roles applicable to that information.

Records that must be retained for legal, tax, payment-dispute or fraud-prevention obligations may be excluded from deletion and restricted to those purposes; we explain relevant exceptions in our response. Backup copies may remain until their scheduled expiry and are not used to reinstate a deleted account. We cannot erase information independently held by your fleet operator, WhatsApp/Meta, Razorpay or your bank.

Read the dedicated Data Deletion Instructions for verification, scope, working-day definitions and consequences. That public page may be used as the data-deletion instructions URL in a Meta application.

15. Children's information

Steer is intended for business use by adults, not children under 18. We do not knowingly solicit children's personal information for account creation. If you believe a child has provided information without appropriate authority, contact us so we can investigate and take the action required by applicable law.

16. Changes to this policy

We update this policy when our practices, service or legal requirements change and publish the revision date here. We provide additional notice or obtain fresh consent where required for a material change; a published update alone does not create consent for a new optional purpose. The English version is the reference version, with translations provided for convenience subject to applicable legal requirements.