Akvora International

Privacy policy

For staff, drivers and partners who use the Smart Delivery system and the Akvora Driver app. Version 1.0 · in effect from 16 October 2026.

This policy explains what personal data Akvora International ("we") keeps in its delivery management system, why, who can see it, how long it is kept and what you can ask us to do. It is written to meet the Sri Lanka Personal Data Protection Act, No. 9 of 2022. Questions or requests: support@akvora.lk.

1. Who this covers

Office staff who sign in to the web system.
Drivers who use the Akvora Driver app, and the helpers named on a route.
Dealers and shops we deliver to, and the people receiving courier parcels.
Sales representatives who answer through a link we send them, and hired lorry drivers who record a trip through a link or QR code.

2. What we keep, and why

Data	Why
Account details: name, email, phone, department, role, password (stored only as a one-way hash).	To let you sign in and to control what each person may see and do.
Driver details: name, driver code, phone, address, date of birth, licence number, type and expiry, experience.	To assign routes, check a driver is licensed for the lorry, and contact them.
Location while a route is running: the phone's GPS position about every 15 seconds, with accuracy, speed and direction, and the position when a stop is marked delivered.	To show the office where the lorry is, check deliveries were made at the shop, and confirm the distance claimed. Tracking starts when the driver starts a route and stops when the route ends or the driver signs out. The app does not track in the background or outside a route.
Location switched off during a route, and whether a position came from a "fake GPS" app.	To understand gaps in a route's tracking and protect the honesty of the records.
Odometer readings, fuel fills, cash given and returned, spends, collections and returns.	To pay for and account for each route, settle cash, and meet our accounting duties.
Fuel card text messages: when a driver chooses "Pick from inbox", the app reads recent SMS messages on the phone to find fuel card messages.	To record a fill without retyping it. Only the one message the driver picks is sent to us and kept with that fill. Other messages never leave the phone. The driver can type the fill instead and never give SMS permission.
Dealer, shop and parcel details: business name, address, contact phone, map position; parcel receiver's name, address and phone.	To plan deliveries, print labels and follow up deliveries.
Activity records: who changed what and when, with the device's internet address and browser for sensitive actions; sign-in sessions.	Security, preventing fraud, and resolving disputes.
Daily mood check-in (optional): a score from 1 to 5 and an optional note.	To understand how the team is doing. Managers see only the team average and unsigned notes, never who answered what. Your name is stored only so you are asked once a day, and answers are deleted after 90 days.

We use this data because it is needed to employ you or work with you, to meet legal duties (such as accounting and tax), and for our legitimate interest in running deliveries safely and honestly. Where something is optional (SMS reading, the mood check-in) we ask first and you can say no.

3. Who can see it

Inside Akvora International, people see only what their role needs: for example dispatchers see routes and live locations, Accounts see cash and payments, and only administrators manage users and settings.
A driver sees only their own routes in the app.
We do not sell personal data and do not use it for advertising.

Service providers we use

Google Maps Platform: addresses and stop positions to work out distances and directions, and lorry route positions to draw the trail along the road. Maps you open in the web system load from Google.
OpenStreetMap: the map in the driver app loads its map pictures from OpenStreetMap's servers.
Google Gemini (only if switched on): powers the help assistant (🤖). It receives the user guide and the question you type, never data from the system. Do not type personal details into it; on the free service Google may use what is sent to improve its products.
Gmail: sends welcome and password-reset emails.
Google Drive: stores encrypted copies of our backups.
jsDelivr: delivers some charting code to your browser.

Some of these providers process data outside Sri Lanka. We use them under their standard terms and send them only what the task needs.

4. How long we keep it

The GPS trail (a position every 15 seconds) is deleted after 365 days. The route keeps its own totals and the position where each delivery was marked.
Route, cash, fuel and delivery records are kept with the route they belong to, for as long as we need them for operations, accounting and audit.
Activity records are kept for security and audit.
Server log files are deleted after 14 days. Backups are kept for up to two years on a rolling schedule and are encrypted.
On the phone, sent items are cleared after 14 days.
When we no longer need data for these purposes we delete or anonymise it.

5. How we protect it

Encrypted connections (HTTPS) between the app, browsers and the server.
Passwords stored as one-way hashes; the app's sign-in token stored in the phone's secure storage.
Access limited by role, sensitive actions recorded, and backups encrypted.

6. Your rights

Under the Personal Data Protection Act you can ask us to:

see the personal data we hold about you;
correct data that is wrong or incomplete;
delete data, or stop or limit how we use it, where the law allows (some records, such as cash and accounting records, we must keep);
withdraw consent for anything optional (SMS reading, the mood check-in) at any time;
complain to the Data Protection Authority of Sri Lanka if you are not satisfied with our answer.

Email support@akvora.lk. We will answer within 21 working days.

7. Phone permissions in the driver app

Location: asked when you start a route, used only while a route is running.
SMS: asked only when you tap "Pick from inbox"; optional.
Install updates: to install a new version of the app that we publish; the file is checked before it is installed.

You can turn any of these off in the phone's settings. Without location a route cannot be started, because tracking is part of how routes are recorded.

8. Changes

If we change this policy we will update the version and date above and tell staff and drivers about important changes.