Privacy Policy

1. Definitions

• “Customer” — a company that uses SaleMile under a contract with us.
• “User” — a person who uses SaleMile: a customer's administrator, manager, warehouse worker or driver.
• “Controller” — whoever decides why and how personal data is processed; “processor” — whoever processes it on the controller's behalf and instructions.
• “Personal data” — any information about an identifiable person.

2. Who is responsible for your data

We are the controller of data we process for our own purposes: SaleMile accounts, sign-ins, security logs, website use and enquiries sent to us.

Data that a company using SaleMile (our customer) enters or creates — orders, its customers' and recipients' details, drivers' routes, GPS and proofs of delivery — is controlled by that company. We process it as a processor, only on the company's instructions and only to provide the service. If you are an employee, a driver or a customer of such a company, please contact that company first about this data; we will help it handle your request.

The customer is responsible for having a legal basis to process its staff's and customers' data in SaleMile and for informing them — for example, that drivers know their location is recorded while they run a route.

3. What data we process

• Account data: name, email, phone, role in the company, login name and a password hash (we never see your password).
• Security data: sign-in times, failed attempts, IP address, browser or device information, two-step sign-in status, sessions.
• Driver work data: routes, stops, arrival and departure times, distance driven, assigned vehicle, inspections, fault reports and the performance metrics (score) calculated from them.
• Location (GPS) data: while a driver runs a route, the app sends the phone's location about every 10 seconds, including when the app is in the background. Location sharing stops when the route is finished. No location is collected outside work.
• Proof of delivery (ePOD): recipient name, signature, photos, notes, delivered quantities and corrections, time and place of confirmation.
• Order and customer data: names of the company's customers, delivery addresses, contact persons, phones, emails, invoices and goods, entered by the company or imported from its accounting system.
• Device data: push notification token, app version and device type, so we can notify drivers about route changes.
• Website data: website performance measurements (without cookies and without identifying you) and strictly necessary sign-in cookies.

4. App permissions

The driver app asks only for the phone permissions it needs for work. You can withdraw any of them at any time in the phone settings.

• Location (including in the background) — to run the route and calculate arrival times and distance driven. Used only while you are running a route.
• Camera and photos — for delivery photos and documents. Photos are uploaded only when you attach them to a delivery.
• Notifications — for messages about route changes and urgent orders.
• Face ID / fingerprint — for quick sign-in. Biometric data stays on your phone; we never receive it.

5. Why we process it and on what basis

• Providing the service under the contract with the company: accounts, route planning, the driver app, proof of delivery, reports (GDPR Art. 6(1)(b); for drivers and recipients, the company's legitimate interest or its contract with them).
• Security and abuse prevention: sign-in logs, blocking after failed attempts, audit trail (legitimate interest, Art. 6(1)(f)).
• Proof of delivery: ePOD is kept as evidence that goods were delivered, for disputes and accounting (the company's legitimate interest and legal obligations).
• Location data: route execution, arrival time estimates for customers and mileage records. Your phone asks for permission before location is collected; you can withdraw it at any time in the phone settings, but route features will then not work.
• Answering your enquiries (legitimate interest or your request).

We do not sell data, use it for advertising or build advertising profiles. Driver scores are calculated automatically, but we do not make decisions about you based on them; your company sees them.

6. Who we share data with

We share data only with service providers SaleMile cannot run without, and only as much as needed. They process it on our behalf and may not use it for their own purposes:

• database, sign-in and website hosting services (EU and United Kingdom);
• archive and backup storage for proofs of delivery and documents (EU and USA);
• map, address search and route calculation services — addresses and coordinates are sent (USA);
• document recognition — only if a company uses invoice recognition from a PDF or photo (USA); this data is not used to train models;
• push notification delivery services (USA);
• integrations chosen by the company, e.g. its accounting system — exchange of that company's data with its own system only.

We provide customers with the list of our service providers on request.

If SaleMile or part of it is transferred to or merged with another business, data may pass to the new provider only for the same purposes and under this policy; we will tell customers in advance.

When data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We may also disclose data where the law requires it.

7. Cookies

The website and workspace use only strictly necessary cookies: to keep you signed in, for security and to remember your chosen theme (light or dark). We do not use advertising or tracking cookies, so we do not show a consent banner. Website performance measurements use no cookies and do not identify you.

You can delete or block cookies in your browser settings, but you will not be able to sign in without the sign-in cookie.

8. How long we keep it

• Driver's current location — 24 hours; GPS history — 90 days; route deviation data — 3 months.
• Orders, routes, invoices and proofs of delivery (ePOD) — 2 years, unless the company sets a longer period for its legal obligations.
• Security and activity logs — 12 months; notifications — 3 months.
• Backups — daily 30 days, monthly 3 months.
• When an account or company is removed, its data is deleted when the periods above end; it disappears from backups within 30 days.

9. How we protect it

Data is sent only over encrypted connections (HTTPS) and stored encrypted by our providers. Each company sees only its own data, enforced by database access rules. Two-step sign-in is available to administrators and mandatory for platform administrators. Signed proofs of delivery are stored unchanged so they remain reliable evidence. Photos and signatures are available only through temporary, protected links.

10. Your rights

You have the right to access your data, have it corrected or deleted, restrict processing, object to processing based on legitimate interest and receive your data in a portable format. Where processing is based on consent, you can withdraw it at any time.

Contact us at info@salemile.com. We reply within one month. If your employer or another company controls the data (see section 2), we will pass your request to it and help it respond.

If you believe your data is processed unlawfully, you can lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or the authority in your country.

11. Deleting your account

Driver and staff accounts are created and removed by the customer (your company administrator). To delete your account, contact them or email us at info@salemile.com — after verifying your identity we remove the account within 7 days.

Once the account is removed you can no longer sign in. Your company's work records (e.g. signed proofs of delivery) are kept for the periods in section 8, because the customer needs them as evidence and for accounting.

12. Notifications and marketing

We send only service messages: invitations, password resets, security alerts and route notifications. We do not send marketing emails; if we ever do, it will only be with your consent and every email will let you unsubscribe.

13. US residents

If you live in California or another US state: we do not sell personal data or share it for advertising, and we do not use sensitive data to infer characteristics about you. You can ask to know, correct or delete the data we hold, and we will not discriminate against you for doing so. Contact us at the email above.

14. Children

SaleMile is intended for businesses and their staff. We do not knowingly process data of anyone under 16.

15. Links to other sites

SaleMile may link to other websites or services (e.g. navigation apps). We do not control their privacy practices and are not responsible for them — please read their privacy policies.

16. Changes

If our processing changes, we will update this policy and the date at the top. We will notify companies of material changes in advance.