Privacy Policy :

This Privacy Policy applies to OnPoint Mobile and the OnPoint APIs and cloud services it uses, together called the Service. The Service is operated by Required: full legal name of the OnPoint operating entity, referred to as “OnPoint,” “we,” “us,” or “our.”

This policy explains the information processed through the Service, why it is used, when it may be disclosed, how long it is retained, and the rights and choices that may be available. Use of the Service is also subject to the applicable OnPoint terms and any agreement or notice provided by the Customer that issued the account. This policy does not govern an unrelated website, application, or service that provides its own privacy notice.

App

The OnPoint Mobile application for iOS and Android.

Customer

The employer, fleet owner, or other organization that authorizes use of the Service and provides or manages an account.

Personal information

Information that identifies, relates to, describes, or can reasonably be linked to an individual. Equivalent terms under applicable law, such as personal data, have the same general meaning here.

Processing

Collecting, accessing, using, storing, transmitting, sharing, analyzing, retaining, or deleting information.

Controller or business

The party that determines why and how personal information is processed.

Processor or service provider

A party that processes personal information for a controller or business under its instructions.

In most workforce deployments, the Customer decides why and how driver, vehicle, trip, and workforce information is processed. The Customer generally acts as controller or business, and OnPoint acts as its processor or service provider. OnPoint may act as controller for account security, service administration, legal compliance, and direct support. A Customer’s own policies and notices may also apply.

The categories depend on your role, Customer configuration, connected vehicles, and the features you use.

We use information as necessary to:

• authenticate users, maintain sessions, apply role-based access, and keep Customer data separated;
• provide dashboards, live vehicle tracking, trips, fleet and driver management, geofences, alerts, reports, fuel and EV analysis, maintenance tools, and authorized vehicle commands;
• create, upload, certify, review, and retain DVIR inspection records and evidence;
• calculate operational metrics, safety and maintenance alerts, scores, trends, and recommendations;
• honor Customer governance settings, cache recent information, and support interrupted connectivity;
• provide support, investigate errors, secure the Service, prevent abuse, and maintain audit trails;
• comply with contracts, law, valid legal process, and regulatory obligations; and
• improve reliability and functionality using aggregated or de-identified information where reasonably possible.

OnPoint may generate operational scores and insights using automated rules and analytics. OnPoint does not itself use those outputs to make solely automated employment or similarly significant legal decisions. A Customer remains responsible for its own decisions and for providing notices or review rights required by law.

Where required, processing may rely on performance of a contract, OnPoint’s or the Customer’s legitimate interests in operating and securing a fleet, compliance with legal obligations, protection of legal claims or vital interests, or consent. When a Customer is controller, it determines the appropriate legal basis. Consent may be withdrawn for future processing where processing depends on consent.

Required: confirm the legal bases used in every launch country with privacy counsel.

Information may be disclosed to:

• Customers and authorized users according to their roles and fleet assignments;
• Cloud and service providers that host, store, secure, transmit, support, map, geocode, or otherwise process information for OnPoint;
• Mapping and geocoding providers when a map area, coordinate, IP address, request metadata, diagnostic, SDK identifier, or map interaction is processed to return a map or place label or maintain the provider’s service;
• OEMs and telematics providers selected or authorized by the Customer;
• Customer-directed recipients through configured email, SMS, webhook, export, report, or event-stream delivery;
• Legal or safety recipients when reasonably necessary to comply with law, protect rights or safety, investigate incidents, or defend legal claims; and
• Transaction participants in a merger, financing, reorganization, sale, or similar transaction, subject to appropriate safeguards.

No advertising SDK is present in the current app. Required: confirm that OnPoint does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and add any legally required opt-out method if this is not accurate.

Vehicle location shown in live maps, trips, alerts, and geofences comes from a connected vehicle, OEM, or Customer-authorized telematics provider. Vehicle location can be associated with an assigned driver and may therefore be personal information.

Users may manually place geofences by tapping a map. Maps and reverse-geocoding features may send a viewed map area or vehicle coordinate to the applicable mapping provider. Customer administrators may configure location precision for governed views.

OnPoint requests camera permission when an authorized user chooses to capture optional DVIR evidence. Camera access supports vehicle walkaround, odometer, defect photos, and short inspection videos. Camera permission can be denied or revoked, and a DVIR can be submitted without media.

Captured files are kept in private app storage while awaiting upload, associated with the relevant driver, vehicle, inspection, label, and capture time, and uploaded through a time-limited URL. A local file is deleted after the server confirms processing or the user cancels the upload. A failed upload may remain locally for retry or cancellation.

The implemented flow captures directly from the camera and does not use a photo-library picker. DVIR video is recorded without sound. The final release must not declare or request microphone or broad photo-library access unless OnPoint intentionally retains those capabilities and updates its in-app notices, permission prompts, store disclosures, and this policy first.

The current mobile build does not register for Apple Push Notification service or Firebase Cloud Messaging. Alerts may be displayed inside the app. Depending on Customer configuration, the broader Service may deliver operational alerts through email, SMS, webhooks, event streams, or another Customer-directed channel. These messages may contain driver, vehicle, trip, location, safety, or maintenance information.

Required: identify production communication providers and available unsubscribe or administrator controls.

Native mobile app

The native app does not use browser cookies. Authentication tokens are stored in operating-system protected storage. Private local storage is used for fleet context, interface preferences, recent searches, pending drafts and uploads, runtime configuration, and operational caches such as dashboards, trips, vehicle rosters, alerts, maintenance, fuel, geofence, and live-tracking views.

Sign-out clears protected session tokens and enumerated operational caches. Some preferences, recent searches, configuration, drafts, or pending-upload records may remain until removed, overwritten, canceled, or the app is uninstalled.

Analytics and logs

The current dependencies do not include a dedicated behavioral-analytics, advertising, or cross-app tracking SDK. OnPoint infrastructure may produce operational, security, and diagnostic logs. Google Maps SDK for Android performs the technical collection described above and may collect map interactions to maintain and improve Google services. These activities are not used by OnPoint for third-party advertising or cross-app tracking.

OnPoint website

Required: confirm cookies, analytics, CDN logs, consent tools, and tracking used on onpointsolution.ai.

• Amazon Web ServicesAuthentication through Amazon Cognito and infrastructure for APIs, compute, storage, databases, queues, and logging.AWS Privacy Notice
• Google Maps PlatformNative Android maps. Google documents collection of request/device metadata, crash metrics, IP address, a pseudonymous Maps identifier, and potentially map interactions.Google Maps disclosure
• Apple Maps / MapKitNative map rendering on iOS.Apple Maps & Privacy
• OpenStreetMap and NominatimFallback map tiles and reverse geocoding. Coordinates are transmitted when a readable place name is requested.OSMF Privacy Policy
• OEM and telematics servicesRequired: list every production provider and applicable privacy link, including any production CerebrumX integration
• Communications and integrationsRequired: list production email, SMS, support, webhook, event-stream, monitoring, and crash-reporting vendors

Apple and Google may separately process app-store downloads, diagnostics, and account information under their own terms. This policy does not control their independent processing.

OnPoint uses safeguards designed for the nature of the information, including encrypted HTTPS transport, managed authentication, protected token storage, role-based access, tenant and fleet scoping, time-limited media links, audit context, and cloud access controls. No transmission or storage method is completely secure, so absolute security cannot be guaranteed.

Service data is hosted in Required: production AWS regions and countries.

When information is transferred across borders, OnPoint uses Required: the approved transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, the UK Addendum, or another lawful safeguard. Contact OnPoint to request information about applicable safeguards.

Information is retained only as long as needed for the purposes in this policy, Customer instructions and contracts, legal obligations, security, dispute resolution, and enforcement. Active systems, backups, and logs may use different deletion schedules.

Information may be retained longer when required by law, subject to a legal hold, needed to prevent fraud or abuse, or necessary to establish or defend legal claims. Aggregated or de-identified information may be retained where permitted.

Depending on location and OnPoint’s role, individuals may have rights to access, know, correct, delete, or obtain a portable copy of information; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; appeal a denied request; and complain to a privacy authority.

• Customer-managed information: contact the employer or fleet organization that provided the account. OnPoint assists Customers with verified requests when acting as processor or service provider.
• Access, correction, or deletion: Required: public privacy-request URL and monitored privacy email.
• Account deletion: in the app, open Settings → Account & Support → Account Deletion Request. Required: public account-deletion request URL. Certain fleet, inspection, safety, compliance, or audit records may be retained where legally or contractually required.
• Camera: deny or revoke permission in iOS or Android settings. An inspection can continue without media.
• Customer communications: contact the Customer administrator to change configured operational alert and delivery settings.
• Local information: sign out to clear protected tokens and covered caches; cancel failed uploads to remove pending local media; or remove the app to clear app-local storage according to the operating system.

OnPoint may verify identity and authority before responding. Law may permit or require a request to be denied or limited. Authorized agents may submit requests where permitted. OnPoint will not unlawfully discriminate against anyone for exercising privacy rights.

European Economic Area, United Kingdom, and Switzerland

Individuals may have the rights described above and may complain to a local supervisory authority. Required: DPO, EU representative, and UK representative details, or confirmation that an appointment is not legally required.

California and other U.S. states

Depending on Customer configuration, OnPoint may process identifiers, customer-record information, electronic-network activity, precise vehicle geolocation, professional or employment information, photos and videos, fleet information, and inferences such as safety, efficiency, or maintenance scores. Driver’s-license data, precise geolocation, and medical-certificate information may be considered sensitive. OnPoint uses sensitive information to provide, secure, and administer the Service as directed by the Customer unless an additional notice and choice is provided.

Required: confirm the statement concerning sale, sharing, targeted advertising, financial incentives, sensitive-information use, and profiling and add required opt-out methods.

India and other jurisdictions

Where applicable, individuals may request a processing summary, correction, completion, updating, erasure, grievance redressal, withdrawal of consent, or nomination as provided by law. Required: India grievance officer or data-protection contact and confirmed launch jurisdictions.

The Service may open links operated by OnPoint, a Customer, a mapping provider, a support provider, or another third party. A third party’s privacy notice governs information it independently collects. OnPoint does not control an unrelated third party’s content or privacy practices. Review the applicable notice before submitting personal information to an external service.

OnPoint is a workforce fleet-management service and is not designed for children. Customers must not create an account for, or direct OnPoint to process personal information about, anyone below the applicable minimum age without legally required authorization. OnPoint does not knowingly use children’s information for advertising or unrelated profiling. Contact OnPoint if you believe a child’s information was provided improperly.

Required: confirm the minimum eligible age and Apple/Google target-audience declarations.

OnPoint may update this policy when the Service, vendors, law, or data practices change. The revised policy will be posted at the same public URL with an updated “Last updated” date. Additional notice or consent will be provided when required. Material changes apply prospectively unless law permits otherwise.

For privacy questions, requests, or complaints, contact:

Required: full legal entity name Required: registered street address, city, state or province, postal code, and country Required: monitored privacy email address Required: public support URL or email Required: public privacy-request URL Required: public account-deletion request URL

If a Customer provided the account, include its name, fleet or tenant, and enough information to locate the account. Do not send passwords, authentication tokens, or unnecessary driver’s-license information by email.