Privacy Policy

Last updated: July 2026

This policy explains how Raahi ("we", "us") collects and uses personal data when you use our fleet-management software at raahiflow.com and app.raahiflow.com (the "Service").

1. Who we are

Raahi is operated by Urooj Shafait, based in the United Kingdom. For any privacy question or to exercise your rights, contact urooj_shafait292@hotmail.com.

2. Controllers and processors

We are the data controller for information about the account holder (the operator/company that subscribes) and their staff who log in.

For personal data that a subscribing operator enters about their own drivers and staff (for example driving-licence numbers, document photos and locations), the subscribing operator is the data controller and Raahi acts as their data processor, handling that data only to provide the Service.

3. Data we collect

Account & company data — name, email, phone, company name, and operator-licence details.
Driver & staff data — names, contact details, driving-licence and CPC numbers, driver/tacho card details, and photographs of these documents where uploaded.
Operational records — walkaround checks, defects, shifts, runs/trips, fuel, expenses, messages, invoices and signatures.
Location data — a driver's device GPS location, collected only while they are on shift and the app is open, to show the operator where vehicles are working.
Uploaded files — photos, receipts, tickets and invoices you choose to upload.
Technical data — a session cookie to keep you logged in, and limited server logs for security.

4. How we use it and our lawful basis

To provide the Service — performance of our contract with you.
Fleet management & safety — the legitimate interests of the operator in running a safe, compliant fleet.
Compliance records — to help meet legal obligations such as keeping walkaround/defect records.
Location — collected during working hours in the operator's legitimate interest; the driver is shown when it is active and it stops when the shift ends or the app is closed.

We do not sell your data or use it for advertising.

5. Who we share it with

We use a small number of trusted providers ("processors") to run the Service:

DigitalOcean — secure hosting.
Stripe — subscription payments (card details are handled by Stripe, not stored by us).
Anthropic — optional AI reading of documents/invoices, only when the operator enables it.
Google Maps — to display routes for driver loads.

We share data only as needed to run the Service, or where required by law.

6. International transfers

Your data is hosted in the UK/EU. Some processors (for example Stripe and Anthropic) may process data outside the UK; where they do, appropriate safeguards (such as standard contractual clauses) apply.

7. How long we keep it

We keep records for as long as your account is active, plus a reasonable period afterwards. Some records are kept to meet legal requirements — for example, HGV walkaround and defect records are typically kept for at least 15 months. Backups are retained on a short rolling cycle. You can ask us to delete data (see your rights below).

8. Security

Data is encrypted in transit (HTTPS), access is restricted by login and role, and the database and files are backed up regularly. No system is perfectly secure, but we take reasonable measures to protect your information.

9. Your rights

Under UK data-protection law you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise any of these, email urooj_shafait292@hotmail.com. If Raahi is acting as processor for an operator, we will direct your request to that operator (the controller).

10. Cookies

We use a single essential cookie to keep you securely logged in. We do not use advertising or third-party tracking cookies.

11. Complaints

If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes

We may update this policy from time to time. Material changes will be posted on this page with an updated date.

This policy is provided in good faith as a plain-English summary. If your operation has specific legal requirements, we recommend a quick review by a data-protection professional.