Privacy Policy

1. Information we collect

We may collect:

• Website / contact data: name, company, email, phone, message content, and support requests submitted through forms.
• Technical data: IP address, browser type, device identifiers, pages viewed, referring URLs, and approximate location derived from IP (subject to cookie consent for non-essential analytics).
• Fleet account data: business profile, authorized users, billing contacts, vehicle/driver roster metadata, and configuration settings.
• Driver enrollment data: identifiers provided by a fleet during enrollment (for example driver name/ID, phone/email for invitations, vehicle assignment), and authentication events.
• Transaction / fueling data: station location, product, volume, amount, timestamps, payment status, and fraud signals associated with cardless fueling events.
• Partner / station data: merchant profile, settlement and reconciliation records, and operational metrics.

2. Why we collect information

• Provide, operate, and improve the Services.
• Authenticate users and protect accounts.
• Detect, investigate, and prevent fraud, misuse, and unauthorized fueling.
• Process payments, rebates, settlements, and financial recordkeeping required for commercial fuel transactions.
• Respond to demos, sales, and support inquiries.
• Comply with legal, tax, accounting, and regulatory obligations.
• Measure website performance only when analytics consent is granted (or unless a privacy signal requires otherwise).

3. Retention periods

We retain information only as long as needed for the purposes above, including:

• Marketing/contact inquiries: typically up to 24 months after last meaningful interaction, unless a longer period is required for an active opportunity or legal hold.
• Consent records: retained to demonstrate compliance with cookie/privacy choices (generally at least 24 months, or longer if required).
• Account / operational data: for the life of the customer relationship plus a wind-down period.
• Financial and transaction records: generally 7 years (or longer where financial recordkeeping, tax, dispute, or regulatory rules require).
• Fraud-prevention logs: retained for periods needed to investigate patterns and defend against abuse, then deleted or de-identified.

4. Third-party disclosures

We may disclose information to:

• Service providers that host, process payments, send communications, provide security, or support operations under contractual confidentiality and use limits.
• Payment processors, banks, and card networks as needed to settle transactions.
• Analytics providers (for example Google Analytics via Tag Manager) only after optional analytics consent, and never when Global Privacy Control disables non-essential tracking.
• Professional advisors, auditors, and authorities when required by law or to protect rights, safety, and fraud controls.
• Successors in connection with a merger, acquisition, or financing, subject to appropriate protections.

We do not sell personal information in the conventional sense. For cookie-related choices, see our Cookie Policy.

5. Fleet relationships

Fleet customers are typically the contracting party that configures the Service for their organization. Fleets may designate administrators, set spend controls, review transaction reports, and manage which drivers/vehicles are authorized. Fleet administrators are responsible for providing accurate roster information and for notices to their personnel as required by applicable employment or privacy laws.

6. Driver enrollment model

Drivers are generally enrolled by or at the direction of a fleet. Enrollment may include invitation links, mobile credentials, vehicle assignment, and authentication for cardless fueling. Driver use of the Service is tied to the fleet relationship; when a driver leaves a fleet or is de-authorized, access should be revoked by the fleet administrator. Drivers should contact their fleet for employment- related data requests in the first instance; PistonPay will assist fleets and individuals as required by law.

7. Fraud prevention activities

To protect fleets, stations, and the payment ecosystem, we monitor transactions and account activity for anomalies (for example unusual locations, volumes, velocity, device signals, or credential misuse). We may delay, decline, or investigate transactions; require re-authentication; notify fleets/partners; and maintain fraud casework. These activities are part of required security and fraud- prevention processing.

8. Financial recordkeeping requirements

Because PistonPay facilitates commercial fuel payments and related settlements, we maintain books and records needed for accounting, tax, audit, chargeback/dispute handling, partner reconciliation, and regulatory obligations. Transaction evidence may include amounts, timestamps, station identifiers, fleet/driver references, and settlement status. Retention of these records may extend beyond account closure where financial recordkeeping rules apply.

9. Cookies and browser privacy signals

On the public website, non-essential analytics and marketing technologies are blocked until consent. If your browser sends Sec-GPC: 1, we treat that as a request to disable analytics and marketing cookies automatically. Details are in the Cookie Policy.

10. Your choices and contact

Depending on your location, you may have rights to access, correct, delete, or restrict certain personal information, or to appeal a decision. To exercise privacy requests or ask questions, contact us via our Contact page. Fleet users may also contact their administrator for account-level changes.

11. Updates

We may update this Privacy Policy from time to time. The effective date above will change when material updates are published on this page.