Privacy Policy
Savari L.L.C-FZ (Savari, we, us, or our) respects your privacy. This policy explains how we use personal data when we decide why and how it is processed, and how that differs from data we process for customers using the Savari Service.
Savari L.L.C-FZ is a limited liability company formed under Meydan Free Zone regulations in the United Arab Emirates, formation number 2528797 and business licence number 2528797.01. Its registered office is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.
1. Who is responsible for your data?
Savari is ordinarily the controller for account administration, contracting, billing, security, compliance, customer relationship management, marketing, website activity, and appropriately configured product analytics.
For passenger, customer, driver, employee, vehicle, journey, booking, workshop, invoice, communications, location, and other operational data entered by a Savari customer, that customer ordinarily decides why the data is used and acts as controller. Savari processes the data on its instructions as processor. Contact the relevant transport operator, employer, fleet, workshop, or service provider first if your request concerns that operational data.
2. Personal data we process
Identity and business contact details, account roles, signatures, and correspondence.
Account, authentication, membership, permission, login, session, and security-event information.
Subscription, billing, invoice, payment-status, tax, and transaction information; payment-card details may be collected directly by the payment provider.
Support enquiries, tickets, feedback, meeting details, and attachments.
IP address, device, browser, operating system, timestamps, logs, diagnostics, audit records, and security alerts.
Product usage, configuration, preferences, consent choices, analytics identifiers, and marketing interactions.
Operational data processed for customers, including passenger, booking, journey, address, driver, employee, vehicle, maintenance, location, inspection, communications, invoice, and file records.
Optional voice, transcription, artificial-intelligence, telematics, mapping, accounting, or integration data when the relevant customer enables the feature.
We do not intentionally request sensitive data for our own purposes. Customers must configure the Service lawfully if their use involves health, accessibility, biometric, trade-union, criminal-offence, children’s, precise-location, workforce-monitoring, or other sensitive information.
3. How we obtain data
Directly from you, your employer, or the organisation that invited you.
From a Savari customer that uses the Service for its operations.
Automatically from browsers, devices, application logs, cookies, and similar technologies.
From payment, identity, communications, support, analytics, security, and customer-selected integration providers.
From public business sources where law permits.
4. Why we use personal data
Where Savari is controller, we use personal data to provide and secure accounts and requested services; administer contracts, subscriptions, billing, support, onboarding, and customer relationships; prevent abuse and fraud; troubleshoot and maintain audit trails; monitor reliability and product performance; comply with law and enforce agreements; send permitted marketing; manage the business; and produce aggregated or de-identified statistics.
Where UK GDPR applies, our legal bases may include contract, steps requested before a contract, legal obligation, legitimate interests, consent, and the establishment or defence of legal claims. Legitimate interests include operating and securing the Service, supporting customers, preventing fraud, and managing business relationships. Consent may be withdrawn at any time without affecting earlier lawful processing.
5. Customer-directed processing
When Savari acts as processor, it processes personal data only to provide, secure, maintain, and support the Service, follow the customer’s documented instructions, and comply with applicable law. The customer is responsible for its lawful basis, transparency, data quality, retention, workforce-monitoring, location-tracking, and communications obligations. Savari does not sell customer operational data or use it for unrelated advertising.
6. Sharing and subprocessors
We may share personal data with authorised Savari personnel; the customer that controls the relevant operational data; contracted hosting, database, communications, payment, support, security, analytics, mapping, artificial-intelligence, and integration providers; professional advisers; a purchaser or successor in a corporate transaction; and courts, regulators, or law-enforcement bodies where required by law or reasonably necessary to protect rights, safety, and security.
The current Subprocessor Register identifies core providers and optional providers that may receive Customer Data only when the relevant feature is enabled or otherwise needed for the customer’s configuration.
We do not sell personal data.
7. Hosting and international transfers
Customer data is hosted on Convex Cloud in the United States. Static site content is delivered through Vercel’s global network. Application functions run in configured regional infrastructure. Optional providers may process data in other countries when a customer enables the relevant feature.
Where transfer rules apply, Savari and the relevant customer must ensure that any required transfer safeguard is completed, legally binding, and supported by any required assessment or supplementary measures. The applicable agreement or transfer instrument, rather than this public policy alone, identifies the mechanism for a specific restricted transfer.
8. Security
Savari maintains measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, or access. Measures are risk-based and include access restriction, tenant and permission controls, encrypted transport, provider-managed encryption at rest for core data, security logging and monitoring, source-controlled development, incident handling, backups where configured, and supplier oversight.
No internet service is completely secure. Users must protect their credentials and devices, and customers must configure permissions and integrations appropriately.
9. Retention
We keep personal data only as long as reasonably necessary for the purpose for which it was collected, taking account of contractual, security, dispute, tax, accounting, and legal requirements.
Customer operational data is retained for the subscription term and then returned, restricted, deleted, or de-identified under the applicable agreement, accepted Data Processing Addendum, customer instructions, law, and Savari’s verified technical procedures. Export scope and any specific deletion timetable must be agreed for the customer’s configured modules and providers. Backup, log, and optional-provider retention follows the relevant configured provider lifecycle and legal requirements.
Account, support, contract, billing, security, and suppression records may be retained for legitimate business or legal needs, with access restricted when the original operational purpose has ended.
10. Your rights
Depending on applicable law, you may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent, objection to direct marketing, and human review of certain solely automated decisions. Rights are not absolute and lawful exemptions may apply. We may need to verify identity and authority.
If Savari processes the relevant data for a customer, we will refer the request to that customer or assist it. For Savari-controlled data, email hello@savari.io. Where UK GDPR applies, we ordinarily respond without undue delay and within one month, subject to lawful checks, exemptions, and permitted extensions.
11. Children and passenger data
The Service is offered to organisations and is not directed to children for independent use. A customer may lawfully enter a child’s passenger information, for example to manage a school or family journey. The customer is responsible for the lawful basis, notices, permissions, safeguarding, and data minimisation, and Savari processes the data on its instructions.
12. Automated processing and artificial intelligence
Optional features may transcribe, summarise, classify, or generate content. Savari does not intend to make solely automated decisions about individuals with legal or similarly significant effects for its own purposes. Customers decide whether and how to use optional output and are responsible for required information and meaningful human review. Savari does not use Customer Data to train a general-purpose model for other customers unless the Customer expressly agrees.
13. Cookies, analytics, and marketing
Our websites and applications may use technologies needed for authentication, security, preferences, and operation. With consent where required, we may use analytics or marketing technologies to understand use and improve communications. Non-essential choices can be managed through available consent controls and browser settings. Marketing emails include an unsubscribe method, while necessary contractual, security, and service notices may still be sent.
14. Mobile applications and location
Driver and technician applications may process device, camera, file, notification, and location data when the relevant permission and customer feature are enabled. Some records may be held on a device until synchronisation. Device permissions can be changed in operating-system settings, although doing so may prevent a requested feature from working. The customer using location or workforce data is responsible for notices, lawful basis, proportionality, retention, and access controls.
15. Complaints, changes, and contact
Email hello@savari.io with the subject “Data protection complaint” so we can investigate. You may also complain to the competent data-protection authority where law gives you that right. For UK GDPR matters, the supervisory authority is the UK Information Commissioner’s Office.
We may update this policy to reflect changes in law, technology, providers, or our processing and will give additional notice where a change materially affects individual rights or law requires it.
Contact hello@savari.io. Savari L.L.C-FZ’s registered office is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Business licence 2528797.01.