Privacy Policy

Mobilio is a software-as-a-service (SaaS) platform for car rental business management, operated under the domain mobilio.cloud and subject to Mauritian law. For data protection purposes, Mobilio is the data controller in respect of data collected via the mobilio.cloud website and the data processor in respect of client data entered by our Customers.

Data Protection Officer contact: privacy@mobilio.cloud

We collect data in the following categories:

Under the DPA 2017, we process personal data on the following legal grounds:

• Contract performance: to provide the Service you have subscribed to;
• Legitimate interests: to ensure platform security, prevent fraud, and improve the Service;
• Consent: for optional communications and non-essential cookies (where applicable);
• Legal obligation: to comply with applicable Mauritian and international law.

We use collected data to:

• Provide, maintain, and improve the Mobilio platform;
• Communicate with you regarding your account, subscription, or support requests;
• Send transactional emails (booking confirmations, invoices) through our email infrastructure;
• Detect and prevent fraudulent or unauthorised activity;
• Comply with legal obligations under Mauritian law;
• Anonymise and aggregate data for analytics and product improvement (we never sell personal data).

Mobilio sends transactional emails to your clients on your behalf (e.g., proforma invoices, final invoices). These emails originate from Mobilio infrastructure using the mobilio.cloud domain and are sent using Resend, an email delivery service.

Recipients may unsubscribe from non-essential communications via the unsubscribe link included in emails. Once an unsubscribe request is processed, the email address is recorded and excluded from future non-essential communications.

We do not sell, rent, or trade personal data. We share data only in the following limited circumstances:

• Supabase: our database and authentication provider. Data is stored on Supabase infrastructure. See Supabase Privacy Policy.
• Resend: our transactional email provider. Email content is transmitted through Resend servers to deliver invoices and notifications. See Resend Privacy Policy.
• Legal authorities: where required by the DPA 2017, ICT Act 2001, or a valid court order in Mauritius.

All third-party sub-processors are required to process data in compliance with applicable data protection law and under contractual terms that protect your data.

We retain personal data for as long as necessary to provide the Service and comply with legal obligations. Specifically:

• Account data is retained for the duration of your subscription plus 30 days after termination;
• Booking and invoice records may be retained for up to 7 years to comply with tax and commercial record-keeping obligations under Mauritian law;
• Audit logs are retained for up to 2 years;
• Unsubscribe records are retained indefinitely to honour opt-out preferences.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS) and at rest;
• Row-level security (RLS) in our database, ensuring each customer can only access their own data;
• Access controls limiting data access to authorised personnel only;
• Authentication tokens and session management via Supabase Auth.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Data Protection Commissioner of Mauritius in accordance with the DPA 2017.

Under the Data Protection Act 2017 (Mauritius), you have the right to:

• Access: request a copy of the personal data we hold about you;
• Rectification: request correction of inaccurate or incomplete data;
• Erasure: request deletion of your personal data, subject to legal retention obligations;
• Restriction: request that we restrict processing in certain circumstances;
• Objection: object to processing based on legitimate interests;
• Portability: receive your data in a structured, commonly used, machine-readable format;
• Withdrawal of consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us at privacy@mobilio.cloud. We will respond within 28 days.

You also have the right to lodge a complaint with the Data Protection Commissioner of Mauritius (dataprotection.govmu.org) if you believe your rights under the DPA 2017 have been violated.

We use essential cookies to maintain your session and authenticate your identity within the platform. For full details, please see our Cookie Policy.

Data processed through Supabase and Resend may be stored or processed outside Mauritius. Where such transfers occur, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms recognised under the DPA 2017.

The Mobilio platform is intended for use by businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us promptly so we can delete it.

We may update this Privacy Policy periodically. If we make material changes, we will notify active Customers by email at least 14 days before the changes take effect. The latest version will always be available at mobilio.cloud/privacy.

For privacy-related enquiries, please contact: privacy@mobilio.cloud

Mobilio · mobilio.cloud · Mauritius