Privacy

Who we are

This site is operated by Techleads Consulting Limited, Lusaka, Zambia [PLACEHOLDER]. For anything about your data, write to privacy@galimoto.app [PLACEHOLDER].

[NEEDS REVIEW: confirm the registered entity, address, and whether a data protection officer or representative must be named]

What we collect

Only what you type into a form. There is no account, and nothing is collected in the background as you browse.

Booking a demo (/demo): your name, company, work email, phone or WhatsApp number, fleet size, preferred time of day, and anything you write in the optional notes field.

Getting started (/get-started): your company name, operating city, country, fleet size, how renters collect cars today, your chosen app name and brand colour, your name, your role, work email, and mobile number.

Contacting us (/contact): your name, email, the topic you pick, and your message.

Your IP address, taken from the connection headers, is held in the server's memory for up to one hour and used only to limit how many times the same source can submit a form. It is not written to a database and it is discarded when that hour passes or the server restarts.

The notes and message fields are free text, so please don't put anything sensitive in them; we only need enough to answer you.

What we don't do

These are properties of how the site is built, not just promises. They describe browsing. Once you submit a form, your details do reach the companies named in Where it goes.

• No cookies. This site sets none. There is no cookie banner because there is nothing to consent to.
• No analytics or tracking. No Google Analytics, no pixels, no session recording, no fingerprinting.
• Nothing loads from anyone else. Fonts are served from this domain rather than Google Fonts, so reading a page doesn't reveal your IP address to any third party. Every page is self-contained.
• No advertising, and no selling or sharing of what you submit with anyone for their own purposes.

[NEEDS REVIEW: re-confirm every bullet above if analytics, a chat widget, a map embed, or any third-party script is ever added, because each one breaks one of these claims]

Where it goes

It becomes email. There is no database behind these forms and no CRM. When you submit one, exactly two messages are sent, and that is the whole journey:

• A notification to us, containing everything you submitted. Its reply-to is set to your own address, so when we answer it, the reply goes straight back to you.
• An acknowledgement to you, confirming what happens next and giving you a phone number for a human.

Which means two other companies handle your details:

• Resend (resend.com) sends both emails for us, so it processes your address and the contents of the message.
• Google. Our leads inbox is a Gmail mailbox, so the notification and everything in it is stored there.

Nothing is written to a database, and nothing is shared beyond those two providers and the people at Techleads Consulting Limited who answer you.

[NEEDS REVIEW: confirm each provider's legal entity and where it stores data, put a data processing agreement in place with both, and identify the transfer mechanism. Resend and Google both process outside Zambia, which makes this a cross-border transfer that needs a lawful basis of its own]

[NEEDS REVIEW: decide whether a shared company mailbox should replace a personal Gmail account as the leads inbox before launch. The current default is one individual's address, which is hard to square with access control, staff turnover, or answering a deletion request]

[NEEDS REVIEW: revisit this whole section the moment leads are persisted anywhere (database, CRM, spreadsheet). As written it is only true because the inbox is the only record]

Why we're allowed to hold it

[NEEDS REVIEW: state the lawful basis for each purpose, likely your request being a pre-contractual step, or legitimate interest for replying to an enquiry]

[NEEDS REVIEW: confirm the regime and state the lawful basis. The controller is in Lusaka and the product sells into Zambia on Zambian rails, so Zambia's Data Protection Act 2021 is the one to work from. GDPR still applies on top for any EU/UK enquiry. Note this page covers the marketing site only: it collects enquiries, takes no payments, and so has no Lenco or mobile-money data in scope. That changes the moment the product itself is in scope]

How long we keep it

Honestly: right now, indefinitely. Because the forms write to no database, what we hold is simply the email in our inbox, and an email sits there until somebody deletes it. There is nothing on a timer.

Resend also keeps its own record of messages it has sent for us, and your IP address is the one exception that does expire on its own; it's dropped within the hour, as described above.

[NEEDS REVIEW: this section describes the current state, not an acceptable one. “Until someone deletes it” is not a retention policy: set a real period per form, name who owns the deletion, and say what triggers it]

[NEEDS REVIEW: confirm how long Resend retains message content and logs on our plan, and whether that is configurable, then state the actual period here rather than describing it vaguely]

Your rights

[NEEDS REVIEW: list the rights that actually apply in each relevant jurisdiction (access, correction, deletion, objection, portability, complaint to a regulator), the response deadline, and how a request is verified]

Requests should go to privacy@galimoto.app [PLACEHOLDER]. [NEEDS REVIEW: confirm this mailbox exists and someone is responsible for it]

Security

Traffic to this site is encrypted in transit, and the forms are rate-limited and screened for automated submissions.

[NEEDS REVIEW: the honest position is that your data's security is currently whatever the leads mailbox's security is. Confirm that account has multi-factor authentication and a named owner, then describe access control here. Do not claim encryption at rest or a breach process that nobody has actually implemented]

Changes to this policy

If this policy changes materially, we'll update the date at the top. [NEEDS REVIEW: decide whether past form submitters are notified directly]