Privacy Policy
What we process, why, for how long and who has access. Including what goes through an artificial intelligence model, and what does not.
This is a translation of the Portuguese original. In case of any discrepancy, the Portuguese version prevails — myfleet.pt/privacidade/.
Last updated: 14 October 2026
1. Who processes the data
Libelinha Lilaz, Lda., Bigorna.digital brand, company number 519531400, with registered office at Praça Capitão José Santos Leite, Loja 4A, 2615-164 Alverca do Ribatejo, Portugal. For any question about personal data: [email protected].
Libelinha Lilaz is the controller of the data of the company account and its users, of the subscription billing data and of the data of visitors to the website.
The data of drivers processed in the context of the relationship with the operating company has the company as controller. This includes the data the driver uploads themselves, such as their documents and the time clock, because it serves the management of that relationship. Libelinha Lilaz processes it on the company's behalf, as processor, under the Data Processing Agreement accepted by the company.
The invoicing targets that drivers set for themselves, and which the company does not see, are processed by Libelinha Lilaz as controller, to provide that feature to the driver.
2. What data we process
- Identification and contact: name, email, phone, tax number, address, IBAN.
- About the company: company name, company number, address, who is authorised to bind it, documents required for the activity.
- About drivers: identity document, driving licence, TVDE driver certificate, criminal record certificate and vehicle documents, with their expiry dates.
- Activity: trips on the platforms, amounts, distances, times and hours online; time clock.
- Financial: weekly settlements, expenses, uploaded receipts and payment proofs, signed contracts.
- Conversations with the GPS assistant.
- Technical: access, activity and error logs.
The criminal record certificate is requested by the company to verify the good repute required of TVDE drivers. Only the company and the driver themselves can access it, and it is deleted within the periods for personal documents (section 7).
Myfleet does not collect the phone's location.
3. For what, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service to the company and the drivers | Performance of the contract |
| Complying with legal obligations, in particular tax obligations and the documentation required for TVDE activity | Legal obligation |
| Keeping conversations with the assistant for 30 days, to improve the answers | Legitimate interest |
| Security and abuse prevention | Legitimate interest |
| Measuring visits to the myfleet.pt website | Consent |
For drivers' data for which the company is the controller, it is the company that determines the legal basis, usually the performance of the contract with the driver and the legal obligations of the activity.
We do not sell personal data and do not use it for advertising.
4. Automatic reading and artificial intelligence
When a document or a receipt is uploaded, it is sent to an artificial intelligence model (Anthropic, USA) that reads the number, the dates, the expiry date and the totals, so that they do not have to be typed by hand. This includes identity documents and the criminal record certificate. The result is compared with what is already recorded; when it does not match, the operator decides. The reading takes no decision about the person.
Automatic reading is optional. Anyone who does not want it can say so in the app or through the contact above: the document is stored and the data is typed by hand.
The weekly summary is written by the same service, which receives the name of the person who will read it and that week's figures; it does not receive the tax number, contact details or documents.
Questions asked to the GPS assistant are sent to the same service, with what is needed to answer them (for example, the names and dates the question asks for). Conversations are kept for 30 days, so that we can improve the answers, and are then deleted. The provider does not use this data to train its models.
5. Who has access
The company, to its drivers' data. Each driver, to their own data. The Myfleet team, to what is strictly necessary to operate the service and provide support. Separation between companies is enforced by the database itself.
We may also disclose data to authorities, where the law requires it.
6. Processors and transfers
| Provider | For what | Where |
|---|---|---|
| Supabase | Database, accounts, uploaded files | Frankfurt, Germany (EU) |
| Cloudflare | Hosting of the pages and the web apps | Global network; files in the EU |
| Stripe | Subscription payments | EU and USA |
| Resend | Sending emails | EU and USA |
| Anthropic | Reading documents and receipts, weekly summary, GPS assistant | USA |
| Sign in with Google; notifications on Android; measuring visits to the website, only with consent | EU and USA | |
| Apple | Notifications on iPhone, once the iOS apps are published | EU and USA |
Transfers to the USA rely on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or, in other cases, on standard contractual clauses approved by the European Commission. A copy of the safeguards can be requested through the contact above.
When the company connects its Bolt account, or imports Uber files, those platforms are data sources chosen by the company and not Myfleet processors.
On registration, the company's tax number is checked in VIES, the European Commission's public service; this is a lookup, not a processor. When electronic signature is switched on, YouSign will join this list.
7. For how long
| Data | Period |
|---|---|
| Settlements, receipts, payment proofs, trips, expenses, subscription payments | 10 years |
| Time clock and hours on the platforms | 5 years |
| Driver's personal documents, including the criminal record certificate | While working with a company, plus 1 year |
| Conversations with the GPS assistant | 30 days |
| Activity log | 3 months |
| Account not accessed for 2 years and with no active company | Anonymised |
| Account never used | Deleted after 6 months |
Closing the account does not delete the history with tax relevance: settlements, receipts and payments are kept for the legal period. In those cases, the data is anonymised: it no longer has a name, email, phone, tax number, address, IBAN or documents, and only the figures remain. Everything else, including access, is removed.
Anyone who requests closure has 30 days to change their mind, and the request does not proceed while a weekly settlement is still open, so that no one loses money they are owed.
8. Rights
Anyone whose data we process may request access, rectification, erasure, restriction of processing and portability of their data, and may object to processing based on legitimate interest. Consent may be withdrawn at any time, without affecting processing already carried out.
Requests are made through the contact above and answered within one month. Where the company is the controller (section 1), we forward the request to it and help it to respond.
It is always possible to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).
9. Security, cookies and changes
Data is encrypted in transit and stored in the EU, with limited and logged access. If a data breach occurs that poses a risk to people, we notify the CNPD and, where the law requires it, the people affected.
The pages do not use advertising cookies. The myfleet.pt website measures visits with Google Analytics only after the visitor accepts; without that consent, no analytics cookie is placed. The apps store on the device what is needed to keep the session signed in.
When this policy changes in a relevant way, the app shows the new version and what has changed.