Legal

Privacy Policy

Last updated: August 27, 2026·Version 1.0·Applies to: Elexi mobile app (Android & iOS)

Overview

Elexi is a fleet management platform that connects vehicle operators, fleet drivers, and supporting staff. This policy explains exactly what personal data the Elexi mobile application collects, why it is collected, how it is protected, and what rights you have over it.

By installing and using the Elexi app, you agree to the data practices described in this policy. If you do not agree, please discontinue use and contact your fleet administrator.

Applicable laws

This policy is designed to comply with the Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022.

Data collected — Fleet Drivers

Fleet drivers use Elexi to manage their trips, earnings, and vehicle sessions. The following data is collected to operate these features.

Full name, NIC number, and mobile phone number (account registration)

GPS location — collected during active driving sessions and Smart Meter usage (including background) for accurate tracking and safety.

Trip metrics: distance travelled, average speed, session duration, and calculated fare

Financial transaction alerts (via device notifications or Apple Shortcuts) — only the sender institution name, transaction amount, and date are extracted. The full message body and personal messages are never stored or transmitted. This data is used to verify daily payment activity, monthly subscription affordability, and overall financial health — because direct banking APIs are not yet available in Sri Lanka, device notifications are the only reliable method to confirm a driver's financial standing without requiring online payments, which many drivers cannot access.

Face biometric data — mathematical descriptor vectors used solely for identity verification at login. Raw images or photographs are never stored.

Never collected from drivers

⊘Off-Duty Tracking⊘Call Logs⊘Raw Face Images⊘Device Contacts⊘Browsing History

Data collected — General Users

General users access Elexi to track financial eligibility for vehicle provisions. Only the minimum data necessary for this purpose is collected.

Full name, NIC number, and mobile phone number

Financial transaction alerts (via device notifications or Apple Shortcuts) — only the sender institution name, transaction amount, and date are extracted. Message body content is never stored. This data is used to assess whether a user can meet daily payment obligations, manage monthly expenses, and sustain subscription fees — as direct banking APIs are not yet available in Sri Lanka, and not all users have access to online payment methods.

Background GPS Location — strictly limited to when you actively use the Smart Meter.

App usage statistics (session frequency, feature engagement) for service improvement

Never collected from general users

⊘Continuous Tracking⊘Call Logs⊘Camera / Photos⊘Device Contacts

Background Location Data Collection & Usage

Elexi uses device location services to power core transportation and trip metering functionality. Under Google Play's User Data & Location Policy and Apple Human Interface Guidelines, we provide the following explicit disclosures regarding foreground and background location access:

Prominent Disclosure (Google Play User Data Policy)

ELEXI collects location data to enable real-time trip tracking, accurate distance measurement, and fare calculation even when the app is closed or not in use.

1. When is location collected in the background?

Location data is accessed in the background strictly while an active Smart Meter session or authorized driver shift is underway. If a driver locks their screen or switches to another application (such as navigation or messaging), Elexi continues collecting location points in the background via a foreground service so that ride distance and calculated fares remain accurate throughout the entire trip.

2. Persistent notification and user visibility

Whenever background location is active on Android devices, an ongoing notification ("Smart Meter Active – Tracking trip distance in background") is displayed in the notification drawer and lock screen. Users retain complete control and can terminate location access at any moment by stopping the meter or disabling location permissions in device settings.

3. No off-duty or continuous tracking

Elexi does not monitor, track, or record your location when the Smart Meter is idle or stopped, or when you are logged out or off-duty. Continuous background tracking is strictly prohibited outside active metering sessions.

4. Zero advertising or commercial sharing

Location data is never sold, leased, or rented to third-party advertising networks, data brokers, or marketing entities. Location information is shared solely with the authorized fleet operator or business account manager to provide verified trip receipts, audit travel distance, and ensure billing transparency.

5. Data retention and purging

Granular second-by-second GPS coordinates are cleared from memory once a session concludes. Only summary trip metadata (total kilometres, duration, waiting intervals, and final calculated fare) is stored for receipt history and regulatory accounting purposes.

Purpose of data collection

Elexi processes personal data for three clearly defined purposes only:

1. Fleet safety and compliance

Trip location and speed data are used to monitor driver safety and ensure compliance with fleet operating requirements during active sessions.

2. Financial health assessment via Transaction Alerts

Device notification data (or Apple Shortcuts) is used to verify a driver's ability to meet their financial obligations within the Elexi platform. Specifically, this assessment covers:

Daily payment verification — confirming that cash or bank payments made by drivers are reflected in their account activity

Monthly subscription affordability — assessing whether a driver can sustain the platform subscription fee and associated vehicle expenses

Expense management capacity — evaluating income regularity and spending patterns to support financial eligibility decisions

Why Notifications? Direct banking APIs are not yet available in Sri Lanka, and many drivers cannot access online payment platforms. Reading bank notifications securely on-device is currently the only reliable, inclusive method to verify financial activity without excluding drivers who rely on cash or branch-based transactions.

3. Identity verification

Face biometric descriptor vectors are used only to confirm the identity of the driver at login. This data is not used for any other purpose and is never shared externally.

How your data is protected

All data is encrypted in transit using TLS 1.3

All data is encrypted at rest using AES-256

Face biometric data is stored as mathematical descriptor vectors, not photographs

Location data is purged from active memory once a driving session ends; only aggregated summary data is retained

Only authorised Elexi personnel with a verified, documented business need can access your records

Access to all systems is logged and subject to regular internal security review

Data is stored on servers within a secure, access-controlled environment

Third-party sharing

Elexi does not sell, rent, or trade your personal data to any third party under any circumstances.

Fleet operators can view trip records and financial standing summaries for drivers within their fleet

Raw biometric descriptor data is never shared with fleet operators or any external party

Aggregated, anonymised usage statistics may be used internally for service improvement

Data may be disclosed if required by applicable law or a valid court order

Your rights

Under the Sri Lanka PDPA and Elexi's data practices, you have the following rights at any time:

Request a full copy of all personal data we hold about you

Request correction of any inaccurate or incomplete information

Request deletion of your account and all associated data — initiable via the Account screen within the app

Withdraw your consent at any time — note that your account will be deactivated within 30 days and platform access will cease

Lodge a complaint with the relevant data protection authority if you believe your rights have been violated

Data retention

Your personal data is retained for a maximum of 3 years from the date of your last activity on the platform, or until you request deletion — whichever occurs first.

Transaction records and trip data subject to regulatory or legal compliance obligations may be retained for the period mandated by applicable law, even after account deletion.

Contact & data requests

For any privacy questions, data access requests, or deletion requests, please contact our Data Protection Officer directly:

Privacyprivacy@elexi.com

Generalinfo@elexi.com

Phone+94 76 066 5055

Subject"Privacy Request – [Your Full Name]"

We will acknowledge your request within 5 business days and respond in full within 30 days, in accordance with the PDPA.