Delete your account and data

Your account was created by your employer, and the logs you submit are that company's business records. That makes your employer the controller of the data, and it means a deletion request goes to them first — but there are two things you can do yourself, and one of them is immediate.

• Erase everything on your phone, now. In the app, open Settings → Delete account & data → Erase data & sign out. This permanently removes the logs, profile, and settings stored on the device and returns you to the code screen. It is immediate and needs no network connection. Anything you have already submitted stays with your employer, because it is their record of work performed.
• Request deletion of the account itself. The same screen has Request deletion, which sends your request through Fuel Relay to your company's administrator. They are notified, and the app shows the date it was sent. If the app can't send it (no connection, or your access code has already been deactivated), it offers an email to Fuel Relay support instead. If you no longer have the app, email us directly at privacy@fuelrelay.net and tell us your name and the company you fueled for. We pass it to your company's administrator and help them carry it out.

Your company's administrator erases your data from the Fuel Relay dashboard. That erases, from our servers:

• your access code, which stops working at once;
• the name, truck number and fuel load on your profile;
• your phone's device identifier, the app version, and when the app last checked in;
• any logs you started but never submitted;
• our technical records about your phone's requests;
• the IP addresses and user agents recorded for your activity.

Every log you submitted, including any sent back to you for correction, is not erased: it stays with your company, with your name and truck number on it, as its business record of fuel delivered. Those logs are deleted when the company deletes its account. The app on your phone erases its own copy once it has confirmed with us that the code is gone, which takes two checks: on two openings of the app, or an hour apart. If anything was still waiting to be sent, it keeps its data for at least 30 days first, and erases it the next time the app is opened after that.

We answer every request within 30 days, including the ones we have to route through an employer.

You can delete the whole organization yourself, without contacting us. In the dashboard, go to Settings → Account → Delete company. You will be asked to type the company’s name and re-enter your password first, because it is not an action to take by accident. Any of the organization’s admins can do this. To stop being an admin while the organization carries on, leave it from Settings → Admins instead. Your login is deleted then, unless you are also an admin of another organization: you keep it for that one.

Deleting the account also cancels the subscription at the end of the current billing period, and schedules the organization's data for permanent deletion 30 days later. Any admin of the company can cancel the deletion from the dashboard before that date; signing in alone does not cancel it. Every admin is emailed, so if you change your mind, or it was done in error, any of you can undo it.

If your company issues invoices in Fuel Relay, download the ones you need to keep first (open each in Invoices, then Print or download): they are deleted with the account.

You can also ask us to do it: email privacy@fuelrelay.net from the address on the account.

When an organization is deleted and the 30 days elapse, we permanently delete:

• Admin and fueler profiles, including names and access codes
• Every fuel log and every entry inside it
• AFEs, location nicknames, and app settings held on our servers
• Your company's branding settings: the colour, and the logo you uploaded, which is deleted from our file storage too, normally the same night (a logo you linked from another website instead stays where you host it)
• If the company used prices and invoices: its prices, tax and invoice settings, contractors’ bill-to addresses, every invoice it issued or voided, and the history of changes to them
• Dispatch sheets, and the PDFs and photos attached to them, which are deleted from our file storage too, normally the same night
• Contractors' billing email addresses for delivery receipts, the record of which receipts were sent, and the one-way fingerprints of addresses that unsubscribed
• Every admin's login, and our authentication provider's log of their sign-ins

Data held only on a fueler's phone is encrypted on that device and is erased by the in-app step above, or by uninstalling the app.

Four things outlive the account. We would rather say so here than have you discover it later.

• The audit log, anonymized. It is a security record that no one in your company can edit, and its entries are never deleted. On deletion we clear the acting user, IP address, and user agent (and the one-way code that links sign-in attempts to the account's email address), and keep what remains as evidence that the account's security-relevant actions happened. IP addresses and user agents are removed after 90 days anyway.
• Billing records. Stripe keeps the company's customer record (name, email, billing address and payment method details) with its invoices and payment history. We don't delete these when the account is deleted: they are kept as our accounting and tax records.
• Backups. The database is copied every night, encrypted, and each copy is kept for 30 days. Deleted data is gone from the backups within 30 days of its deletion, and if we ever restore one we first delete again everything deleted after it was taken.
• Crash and error reports. Scrubbed of access codes, contact details and record details before they are sent (a crash inside the phone's own system software is reported without that scrubbing, with no fuel data added), and deleted by Sentry after up to 90 days.

We never delete an account for being unused or unpaid. If a subscription lapses without the account being deleted, the data stays exportable for 90 days and is then scheduled for deletion; starting a new subscription before that date clears the schedule. The full retention table is in section 6 of the privacy policy.

• On-device erase: immediate.
• Acknowledgement of a request: within 30 days, and usually far sooner.
• A fueler's data: erased when the company's administrator erases it in the dashboard, which we ask them to do within 30 days of the request.
• An organization's permanent deletion: 30 days after the account is deleted or the request is verified, unless an administrator cancels it in the dashboard.
• Backups: within 30 days of either.

Questions about any of this go to privacy@fuelrelay.net. Your other rights — access, export, correction — are set out in section 7 of the privacy policy.