Legal document

Smart Tracks Mobile Apps — Privacy Policy

This policy explains what information Smart Tracks processes through its mobile applications and platform, the purposes of that processing, the parties with whom it may be shared, and the rights available to you. It complements — and does not replace — the Terms of Service. Your use of the application constitutes acknowledgement that you have read it.

Last updated: 29 August 2026 · Applicable to all users of the Smart Tracks mobile applications in every edition

Scope & Our Legal Role

The Smart Tracks platform and its mobile applications are operated by Smart Tracks, registered in the Kingdom of Saudi Arabia and the authorised distributor of the Navixy platform in the Kingdom (“Smart Tracks”, “we”).

Scope: This policy applies to the web tracking platform, to the mobile applications in all editions on the App Store and Google Play (including X-GPS Monitor for supervisors and X-GPS Tracker for field teams), and to the associated tracking hardware.
Intended audience: The Service is a business tool for fleet operators and their authorised personnel. The application cannot be used without an account issued to a subscribing organisation. It is not directed at the general public or at personal use.
Our legal role: In respect of vehicle and driver tracking data, your subscribing organisation is the data controller and we act as a processor on its behalf and on its instructions. In respect of your platform account data, we are the controller.
Subscriptions through an agent: If your organisation subscribes through one of our authorised agents, that agent is your contracting channel, and the processing framework set out here continues to apply.
User responsibility: The User bears responsibility for compliance with applicable law when collecting and processing driver and employee data through the platform, including providing notice and obtaining consent where required.

Information We Process

2.1 · Account information

When you sign in we process the email address and credentials associated with your account, solely to authenticate you against our servers. Session data is stored on your device so that you remain signed in until you sign out.

2.2 · Vehicle and fleet data

The Service displays data generated by tracking units fitted to your organisation's vehicles, including:

Vehicle position, speed and heading
Engine and ignition status, stop and idle durations
Fuel level and consumption
Sensor readings such as temperature and door status
Trip history and route playback
Assigned driver details, where configured by your organisation

This data is generated by vehicle hardware, not by your phone. It is operational data belonging to your subscribing organisation, not personal data about you as an application user.

2.3 · Device and notification data

A push notification token issued by your device operating system (Apple or Google) to deliver alerts
Basic device information such as model and OS version, for compatibility and technical support
Application preferences such as language, theme and server address

2.4 · Location data

The application may request permission to access your device location while in use only (When In Use), for a single purpose: to show your position on the map relative to your vehicles and to centre the map view on request.

Your location is not collected in the background — the application does not request the “Always” location permission and does not enable the background location mode.
Your location is not transmitted to our servers, is not stored by us, and is not shared with any third party. It is processed on your device only, to render it on the map.
The permission is entirely optional — you may decline or withdraw it at any time in your device settings, and all core features continue to work: vehicle display, maps, reports and alerts.

2.5 · Diagnostic data

We may collect crash reports and related technical data to identify and resolve problems and improve service stability. These reports do not include the content of your fleet data and are not linked to your identity.

App Privacy Disclosure

The following table sets out the data types the application collects, mapped to Apple's App Privacy categories, their purposes, and whether they are linked to your identity:

Data type	Purpose	Linked to you?	Tracking?
Contact Info Email address	App functionality — sign-in	Yes	No
Identifiers User ID, push token	App functionality — session and alerts	Yes	No
Location While in use only — optional	App functionality — showing your position on the map. Processed on-device, never sent to us	No	No
Diagnostics Crash and performance data	App functionality — stability	No	No

Data types the application never collects

The application does not collect or request any of the following: financial or payment information, health and fitness data, contacts, photos or media, browsing history, search history, message content, purchases, sensitive data (race, religion, orientation, political affiliation, biometrics), or any advertising data.

Device Permissions

The application requests the minimum permissions necessary for its functions. All of the following permissions are optional, and the application's core functions operate if they are declined:

Permission	Why it is requested	If declined
Location — While In Use	Showing your position on the map relative to your vehicles	Your position is not shown on the map. Everything else works
Notifications	Delivering the fleet alerts your organisation configures	You do not receive push alerts. They remain visible inside the app
Face ID / Biometrics	Fast, secure sign-in instead of typing your password	You sign in with your password as usual

The application does not request background (Always) location, camera, microphone, photo library, contacts, calendar, health, Bluetooth, or App Tracking Transparency permission.

Biometric authentication data (Face ID or fingerprint) is processed entirely within your device's operating system; it never reaches us and is never stored by us in any form.

Purposes & Legal Basis

We process the information described above for the following purposes only:

Authentication: enabling access to your organisation's account — performance of contract.
Service delivery: displaying vehicle data and maps and generating reports — performance of contract.
Alerts: delivering the notifications your organisation configures — performance of contract.
Support: responding to your enquiries and resolving issues — legitimate interest.
Service improvement: diagnosing faults and improving stability and performance — legitimate interest.
Compliance: meeting applicable legal obligations — legal obligation.

We do not use your data for any other purpose without prior notice to you and an appropriate legal basis, in line with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

No Tracking, No Advertising

We expressly confirm the following:

We do not sell your data, rent it, or trade it with any party, and we do not share it with data brokers.
We do not track your activity across apps or websites owned by other companies, and we do not link your data with data from external sources for advertising purposes.
We do not use the advertising identifier (IDFA / Advertising ID), and the application contains no advertising or commercial analytics SDK.
The application displays no advertising of any kind and contains no in-app purchases.
For these reasons, the application does not present the App Tracking Transparency prompt, because it performs no tracking activity within the meaning of Apple's policies.

Third-Party Services

The Service relies on external providers for specific technical functions only:

Service	Purpose	Data available to it
Navixy Navixy	Operating the tracking platform the application displays	Vehicle data and platform account data
Google Maps Platform Google	Map rendering and address lookup	Vehicle coordinates needed to render the map
Firebase Cloud Messaging Google	Notification delivery on Android devices	Push token and alert text
Apple Push Notification service Apple	Notification delivery on Apple devices	Push token and alert text
Firebase Crashlytics Google	Crash and error reporting	Technical fault data, not linked to your identity

We contract with these providers on terms requiring a level of data protection no lower than that set out in this policy, and none is authorised to use your data for its own purposes or for any advertising purpose. Their processing is additionally governed by their own privacy policies.

Disclosure of Data

We disclose your data only in the following circumstances:

To your organisation: its authorised fleet administrators can view vehicle and account data within the scope of their permissions.
To service providers: as necessary to operate the Service, under contractual confidentiality obligations and an equivalent standard of protection.
Where legally required: in response to a lawful request from a competent authority, or to protect our rights or the safety of individuals.
On a corporate change: in a merger, acquisition or transfer of assets, with prior notice to you.

Storage & Security

Data is stored on servers operating in accordance with the requirements of the Saudi Space Agency, which regulates navigation and tracking activities, and the system is approved by the Communications, Space & Technology Commission. We apply reasonable technical and organisational measures against unauthorised access, loss or alteration, including encryption in transit, role-based access control, and restriction of internal access to personnel whose duties require it.

No method of electronic transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for notifying us immediately of any suspected unauthorised access.

Data Retention

Tracking data: retained in accordance with your organisation's subscription plan and the retention periods agreed in its contract. Organisations may retain it independently through the periodic reports.
Account data: retained for the duration of the subscription and for a reasonable period afterwards to meet legal and accounting obligations, after which it is deleted or anonymised.
Push token: deleted as soon as you sign out or remove the application from your device.
Diagnostic data: deleted automatically in accordance with the provider's retention policies.

Your Rights

Under the Saudi Personal Data Protection Law and its regulations, you may:

Be informed of how your personal data is collected and the legal basis for it
Access the personal data we process about you
Request correction of inaccurate data or completion of incomplete data
Request destruction of your data, so far as legal and contractual obligations permit
Object to or request restriction of certain processing
Withdraw consent where processing is based on it — including revoking location or notification permissions in your device settings at any time
Obtain a copy of your data in a machine-readable format
Lodge a complaint with the competent supervisory authority in the Kingdom

Because the Service is provided through your organisation's subscription, some requests may need to be directed to your fleet administrator, and we will co-operate with your organisation in responding to them.

To make a request, contact us using the details in section 16. We respond within thirty days of verifying your identity, and we charge no fee for exercising these rights.

Account & Data Deletion

You may request deletion of your account and the personal data associated with it at any time, without giving reasons and at no cost.

How to submit a request

Send an email to info@smart-tracks.net from the address registered to the account.
Use the subject line “Account Deletion Request”, and state the organisation name and the account to be deleted.
Alternatively, call +966 50 310 6938 or contact the fleet administrator at your organisation.

Timelines

Within 7 days: we acknowledge your request and verify your identity.
Within 30 days: we delete the account and its associated personal data and confirm completion to you.

What is deleted and what may be retained

Deleted: your account data, email address, credentials, push token, and personal preferences.
May be retained: vehicle tracking data belongs to your subscribing organisation rather than to you personally, and its deletion requires a request from that organisation. We may also retain accounting records for the period required by the laws in force in the Kingdom.

Deleting the application from your device does not by itself delete your account from our servers — the request above must be submitted.

Cross-Border Transfers

Tracking data is managed within the Saudi regulatory framework and on the servers described in section 9. Some limited technical data may nonetheless be processed on servers located outside the Kingdom, given the Service's reliance on the international mapping and notification providers listed in section 7.

We contract with these providers on terms requiring an appropriate level of protection equivalent to that set out in this policy, and we do not authorise them to use the data for their own purposes.

Minors' Privacy

Smart Tracks does not make its services available to persons under 18 years of age. The Service is a business tool, is not directed at children, and cannot be used without an account issued to a subscribing organisation.

We do not knowingly collect data from minors. If we become aware that we have collected data from a person under that age, we delete it promptly. If you are a parent or guardian and believe a minor has provided us with data, contact us via section 16.

Changes to This Policy

We may update this policy from time to time. The date of the most recent update appears at the top of this page.
Material changes are announced with at least thirty days' prior notice via registered email or a platform notification.
Where processing purposes or collected data types are expanded, we seek fresh consent where the law requires it.
The Arabic version of this policy constitutes the original reference text in the event of any conflict with other language versions.

Contact Us

For any enquiry regarding this policy, to exercise any of your rights, or to request account deletion, you may contact us through:

Email info@smart-tracks.net
Phone and WhatsApp +966 50 310 6938
Working hours Sunday – Thursday, 8 AM – 4 PM
Website smart-tracks.net
Address Smart Tracks, Kingdom of Saudi Arabia