Privacy Policy

Kora is the data controller for: account registration data for company administrators; business and owner verification (KYC) documents collected to confirm a Customer's identity; billing and subscription records; platform usage analytics and audit logs; marketing communications and enquiry submissions; and platform-level personnel records for Kora's own staff.

For all Operational Data submitted by a Customer — including personnel profiles, trip records, fuel logs, maintenance records, driver settlement records, and driver activity — Kora acts as a data processor. The Customer is the data controller and determines the purposes and means of processing. Customers must ensure they have a lawful basis to submit their personnel's personal data to Kora and must provide adequate notices to their data subjects.

By accepting the Terms of Service or entering into an Order Form, Customers agree that Kora may provide a written data processing addendum or equivalent contractual data-protection terms where required for the Customer relationship. Customers requiring a standalone signed data processing agreement should contact legal@korafleet.com.

• Company name and the industry or operations profile selected during onboarding.
• Company KRA PIN, where optionally provided by the administrator.
• Administrator name, email address, and account authentication credentials.
• Phone number, where optionally provided for billing and service communications.
• Company logo, where optionally uploaded by the administrator.

Customers create personnel records for their own drivers, mechanics, and office staff. The profile fields collected are:

• Full name (required).
• National ID number (required).
• Phone number (required).
• Role and employment type within the fleet company (e.g. permanent, contract, casual, owner-driver).
• Email address, where the personnel member is given app access.
• Driver's licence number and expiry date (required for drivers), used for document-expiry reminders.
• An M-Pesa registered name, where the Customer optionally records one for its own settlement reference records.

Customers also upload personnel identity and compliance document images for their own record-keeping, document-expiry reminders, and trip dispatch-readiness checks. Depending on the person's role, these may include:

• National ID — front and back images (collected for all personnel).
• Driver's licence — front and back images (collected for drivers).
• PSV badge, where the driver operates passenger or commuter vehicles.
• Certificate of good conduct and medical certificate, where the Customer requires them.
• Mechanic competency certificate, for mechanics.
• Employment or engagement contract.

These documents are uploaded and controlled by the Customer and are stored in private, access-controlled storage. Kora processes them on the Customer's behalf (as data processor) for compliance and expiry tracking; Kora does not independently verify them against government or regulatory registries. This is distinct from the business and owner verification Kora performs on the Customer itself (see 3.6).

Kora does not collect personnel date of birth, KRA PIN, bank account details, a separate mobile-money payment number, profile photographs, or emergency contacts.

• Vehicle registration plates, make, model, fuel type, and related identifiers.
• Vehicle compliance document images — such as insurance certificates, NTSA inspection certificates, logbooks, speed-governor certificates, and PSV/route documents — uploaded for expiry tracking and dispatch-readiness checks.
• Trip records including origin, destination, cargo details, mileage, and timestamps.
• GPS traces, location pings, route deviations, telematics device identifiers, and related vehicle telemetry where tracking features are enabled.
• Fuel fill records including quantity, cost, station, and odometer readings.
• Maintenance job cards, parts used, and mechanic notes.
• Invoice data including client details, line items, and payment status.
• Advance request records and repayment schedules.
• Route definitions and associated client records.

• Browser type, operating system, and device information.
• IP address, timestamps, and session identifiers (for security and audit purposes).
• Feature usage patterns, page navigation data, and performance measurements used for privacy-friendly product analytics and service monitoring.
• API request logs retained for 90 days for security monitoring.

• Enquiries and messages submitted through the contact form at /contact.
• Support ticket correspondence.
• Email communications regarding billing, security alerts, and service notices.

To confirm that an account belongs to a genuine business and to identify the person who controls it, Kora collects a limited set of verification documents from the company administrator during or shortly after onboarding:

• The company certificate of incorporation or business registration certificate.
• The company administrator's (owner or authorised representative's) national ID document — front and back images.

This Kora-performed verification covers only the company and its administrator. Kora does not run this verification step on the Customer's drivers, mechanics, or other field personnel — although Customers separately upload their own personnel's identity and compliance documents as described in 3.2. Verification documents are stored in private storage, are not publicly accessible, and are streamed only through Kora's access-controlled document viewer. Access is restricted to administrators of the same company and to Kora platform staff carrying out verification and compliance review. Kora is the data controller for this verification data, which it collects for its own customer-verification and fraud-prevention purposes.

We use personal data to create and maintain company accounts; authenticate and authorise users; process trip dispatch, fuel records, and maintenance workflows; generate invoices and financial reports; and send critical service notifications such as security alerts, billing reminders, and subscription status changes.

Kora's fuel anomaly detection engine analyses fuel fill records against vehicle specifications and historical patterns to flag potential siphoning, over-reporting, or mileage discrepancies. This processing is carried out on behalf of the Customer to protect the Customer's operational integrity. Flagged anomalies are surfaced to Customer administrators only and are not disclosed to third parties.

Subscription billing data is used to generate invoices, apply supported Paybill payments, and maintain billing history. Driver settlement contact data, including mobile-money phone numbers where provided, is used solely to calculate settlements and record Customer-managed payment references.

We maintain audit logs of significant platform actions — account creation, data mutations, admin actions, and access events — to detect security incidents, investigate complaints, and comply with regulatory requirements. Kora staff access to Customer Operational Data is restricted to support, security incident response, and legal compliance scenarios, and is logged.

Anonymised, aggregated, and non-identifiable usage data may be used to improve platform features, optimise performance, and inform product development. No individual Customer's data is disclosed in such analytics.

We use trusted service providers for hosting, infrastructure operations, authentication, mapping, telemetry, messaging, and transactional communications. These providers are engaged only where needed to deliver the Service and are subject to contractual data-protection obligations appropriate to the work they perform. Where a Customer requires vendor-specific diligence materials during contracting or procurement, Kora may provide them on request under appropriate confidentiality controls.

Where supported mobile-money billing features are used, relevant payment or mobile-money operators process the transaction details needed to complete those subscription payment flows. For driver settlements and advances, Kora records Customer-provided payment references for reconciliation, audit, and support purposes but does not initiate personnel payouts or transmit payout instructions.

We may disclose personal data where required to comply with a court order, statutory obligation, or lawful request from a Kenyan regulatory authority. We will notify the affected Customer where permitted by law before disclosure.

In the event of a merger, acquisition, or asset sale, Customer data may be transferred to a successor entity subject to equivalent data protection obligations. Customers will be notified of any such transfer at least 30 days in advance.

Customer Operational Data (trips, fuel logs, maintenance records, driver settlement records) is retained for the life of the Customer's active subscription. Upon account termination, data is retained for 30 days in a read-only state for export. After 30 days, data is permanently deleted from active storage. Certain financial transaction records may be retained for up to 7 years to satisfy Kenya Revenue Authority requirements.

Audit logs and activity trails are retained for a minimum of 12 months and may be retained for up to 7 years where required by applicable law. Audit logs are not accessible to Customer users but are available to Kora's compliance team and may be produced in response to lawful regulatory requests.

Company administrator credentials and account registration data are deleted 30 days after account termination. Billing records and subscription history are retained for 7 years for accounting and tax compliance.

Customers may request immediate deletion of their Operational Data (outside the standard 30-day post-termination window) by writing to privacy@korafleet.com. Deletion requests will be actioned within 14 days, subject to any mandatory retention obligations. A deletion confirmation will be issued in writing upon completion.

Business and owner verification documents (certificate of incorporation and administrator national ID images) are retained while the account is active and for up to 30 days after account termination, after which they are deleted from active storage, subject to any mandatory regulatory retention obligation. Customers may request earlier deletion of verification documents by writing to privacy@korafleet.com, subject to Kora's ongoing fraud-prevention and legal needs.

We use strictly necessary cookies and secure session technologies to authenticate users, refresh sessions, protect secure routes, and keep users signed in. These controls are required for the Service to function and cannot be disabled without affecting access.

The Kora apps use browser localStorage or sessionStorage to remember interface preferences, onboarding state, PWA prompts, draft form data, notification sync markers, and queued field actions awaiting reconnection. This browser-side state is stored on your device and can usually be cleared through your browser settings.

Kora uses privacy-friendly traffic and performance measurement tools to understand aggregate usage and service performance. We do not use advertising cookies or cross-site tracking for the marketing site or apps.