Privacy Policy

Two groups of people come into contact with Grizzly IQ:

• Console users. The people at a fleet company who sign in at grizzlyiq.com: the account Owner and the Admins they invite. We collect a small amount of information about you directly, described in section 3.
• Tablet users. Usually drivers or field staff who use a company-owned tablet that has the Grizzly IQ app installed. The app collects information about the tablet’s condition, described in section 2. It is designed to watch equipment, not people.

The fleet company that enrolls its tablets and opens a console account (the “organization”) decides which tablets run the app and who may see the console. We process tablet information on that organization’s behalf and under its instructions. If you are a tablet user with a question about why your employer uses Grizzly IQ, your employer is the right first contact; we will help them answer it.

The app shows every tablet user a disclosure screen before it starts. This section covers everything on that screen, in more detail. The app takes a quick reading about every 15 minutes (organizations can choose a slower schedule to save mobile data) and notices connection changes as they happen. It collects:

• Device identity. The tablet’s make and model, Android version and security-update date, app version, and a one-way hashed device identifier. If the organization provisions the tablet through a mobile device management (MDM) system, it may also attach the tablet’s serial number, asset tag, and a friendly name.
• Battery. Charge level, temperature, whether it is charging, charge sessions, the battery’s measured capacity over time, cycle count, and charge-protection settings. This is how the service tells a worn battery from a healthy one.
• Storage, memory, and heat. Free storage, free memory, and how hot the tablet runs.
• Restarts. Whether the tablet restarts unexpectedly, and whether a restart followed a deliberate power-off.
• Connection. Whether the tablet is on Wi-Fi or cellular, whether it has working internet, signal strength, and the moments a connection drops and returns. If the organization lists the online services its tablets need (for example a dispatch or ELD service), the app records whether those services could be reached. It records reachability only, never the content of any traffic.
• Data usage. How many bytes the tablet moves each day over Wi-Fi and over cellular, including how much cellular use happened while roaming. If the organization turns on Android’s optional “Usage access” for the app, it also records per-app totals for data, storage space, and screen time. Totals only, never what was done inside an app. It also records the name of the Wi-Fi network the tablet is connected to and how many bytes moved over each named network, so an organization can separate data that passes through a vehicle hotspot from depot Wi-Fi. Network names and byte totals only, never passwords.
• Location, in limited cases. Reading signal strength on Android requires the location permission, and the signal check itself keeps no location. Beyond that: (1) at the moment a connection drops and again when it returns, the app records the tablet’s position, as precisely as the tablet reported it, to map coverage dead zones for the organization; (2) with each scheduled check-in it records the tablet’s most recent position so a lost or stolen tablet can be found; and (3) if the organization is actively searching for the tablet, the app shares its live position for up to five minutes at a time and shows a notice on screen while it does. Separately, while spoken dead-zone warnings are turned on (the default) and the organization has known dead zones, the app checks the tablet’s position on the tablet itself to decide when to speak a warning; those positions are never uploaded or stored. The service keeps no route history, uploads no continuous location trail, and does not measure how anyone drives.
• Tablet check-ups. The app checks the tablet at the start of each shift, and whenever the tablet user runs a check-up, and sends the result: the readings above, plus whether location services, Bluetooth and the speaker are on, whether the tablet’s clock is right, and when it last restarted. It reads whether these settings are on or off, never anything they are used for.
• Diagnostics the tablet user runs. If a user runs a hardware self-test or files a repair request, the app records the results (for example “speaker: passed”) and any note the user types. Audio tests measure sound level only; nothing is recorded or stored.
• Short vitals recordings. While the screen is on, the app keeps a rolling 30-minute record of vitals (battery, temperature, memory, network state) on the tablet. It sends that record to the console only when it detects a fault or a repair request is filed. It never captures the screen, keystrokes, or app content. On request from a console user, the app can also stream the same vitals live for about five minutes.
• Speed tests. When a console user or the tablet user runs one, a small test file is transferred to measure download and upload speed. The result and the bytes used are recorded.
• The app’s own health. Whether the app is running, when it last reported, whether it is exempt from battery optimization, and any errors it hit. A push-notification token from Google’s Firebase Cloud Messaging lets the console wake the app for an on-demand check.

What the app never collects: messages, photos, calls, browsing, keystrokes, the content of other apps, screen recordings, a route history or continuous location trail, or anything about how a person drives.

• Account details. Your name, work email address, role (Owner or Admin), and your organization’s name. Sign-in is passwordless: we email you a link or code, so we never store a password.
• Sign-in and security records. When you sign in, our authentication provider records the time, IP address, and browser type. On signup we use Cloudflare Turnstile to tell people from bots.
• Console activity. Changes made in the console (for example inviting a teammate, changing a threshold, revoking a device) are written to an audit log that records who did what and when. The log cannot be edited or deleted, which is how organizations can trust it.
• Preferences. Which email notifications you want, your display theme, and any fleet settings you save.
• Correspondence. Anything you send us by email.
• Billing details (when paid plans launch). Payments are handled by Stripe; we store only Stripe’s reference identifiers, never card numbers.

• To run the service: turn tablet readings into health verdicts, worklists, maps, and reports.
• To notify the organization’s team: ticket alerts, weekly reports, trial, billing, and account notices (including a deletion notice before inactive data is removed), and sign-in emails.
• To power the AI copilot when an organization has it enabled (section 5).
• To keep the service secure: detect abuse, enforce access rules, and investigate incidents.
• To bill for the service and keep the records the law requires.
• To support you when you write to us.
• To improve the product, using information that no longer identifies any organization, tablet, or person (for example, how often a class of battery fault appears across all fleets).

We do not sell personal information, we do not use it for advertising, and we do not build profiles of individual drivers.

Organizations can turn on an AI assistant inside the console that answers questions like “which tablets need attention this week?” and drafts repair tickets. When a console user asks it something, we send the question and the facts needed to answer it to our AI provider, Anthropic, through the Vercel AI Gateway. Those facts are the same health results the console already shows: device names, asset tags, health states, battery and heat readings, ticket text, and the road or place names of coverage dead zones. Location coordinates are never sent to the AI provider.

Under our provider’s terms, prompts and answers are not used to train its models. The assistant cannot change anything; it reads and summarizes. Its answers can be wrong, and drafted tickets are labelled for review before sending.

We share information only with the service providers that run Grizzly IQ, with the organization that owns the tablets, and when the law requires it. We never sell it.

Your organization’s own choices. An organization can point the console at its own systems, for example webhook endpoints or email recipients for alerts and weekly reports. Information sent to those destinations is under the organization’s control.

Legal and business events. We may disclose information when required by law or a valid legal process, to protect the safety or rights of people, or as part of a merger, financing, or sale of the business, including a transfer to an affiliated company that continues to operate the service under this policy. The de-identified data described in section 8 may be transferred in the same way.

The console uses a small number of cookies and browser-storage entries, all of them functional. There are no advertising or third-party analytics cookies.

Detailed tablet readings are short-lived; the summaries that make health trends visible over months are kept longer. Current windows:

Inactive accounts. If an account stays expired or suspended for 30 days, we email the account Owner a deletion notice. If the account is still not reactivated 30 days after that notice, we automatically delete its fleet data: tablet readings, health history, repair requests, diagnostics, and the coverage map. Account records, team membership, settings, and the audit log are kept, and so is the de-identified copy described below.

De-identified data we keep. Tablet condition history is what makes Grizzly IQ better at spotting a failing tablet and at mapping coverage over time, so before an organization’s fleet data is deleted (on request, or after a lapsed account) we keep a copy with every identifier removed: no organization, no tablet serial or name, no person, no ticket text, no sign-in identity, and random keys that map to nothing we store. What stays is the condition record itself: battery wear points, daily condition and connectivity summaries, connection-drop locations and times, diagnostic run summaries with the codes they flagged, ticket outcomes, self-test outcomes, and the tablet’s make, model, and software versions. We do not try to re-identify it, we may keep it for as long as we operate, and it may be transferred with the business as described in section 6.

On request. When an organization closes its account, its tablets stop reporting and the account is deactivated. On written request from the account Owner we delete the organization’s remaining data, keeping only what we must retain by law (for example invoices), security records needed to protect the service, and the de-identified copy described above.

• Every organization’s data is separated at the database level; a console user can only ever read their own organization’s records.
• All traffic between tablets, browsers, and our servers is encrypted in transit; our providers encrypt stored data at rest.
• Console sign-in is passwordless and email-verified; there are no passwords to leak.
• Tablets authenticate with their own machine credentials, and an organization can revoke every enrolled tablet in one action.
• Changes in the console are recorded in an audit log that cannot be altered.
• Our own staff access is limited to what is needed to operate and support the service.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify the affected organization without undue delay and, where the law requires, the relevant authorities and individuals.

Grizzly IQ is operated from Canada. Our service providers may store and process information in data centres outside Canada, including in the United States, where it may be subject to the laws of those countries. We choose providers that commit to strong security and confidentiality obligations.

Console users can see their account details and change their notification preferences in Settings, and can ask us to correct, export, or delete their account information. The account Owner can remove any team member.

Tablet users can see what the app collects on the disclosure screen inside the app at any time. Because the tablet and the app are provided by your employer or the organization that owns the tablet, questions about why it is installed, requests to see the information collected about a tablet, or requests to have it corrected or deleted should go to that organization first. We will support the organization in responding, and you can also write to us directly.

Depending on where you live, you may have additional rights under privacy law, including the right to complain to a privacy regulator. In Canada that is the Office of the Privacy Commissioner of Canada.

Grizzly IQ is a business service for fleet operators. It is not directed at children, and we do not knowingly collect information from anyone under 18.

When the service starts collecting something new or working with a new provider, we update this page and change the date at the top. For changes that matter to how your information is used, we will also notify account Owners by email or in the console before the change takes effect.

Grizzly IQ is responsible for the handling of personal information described in this policy. Questions, requests, or concerns about privacy, including access, correction, and deletion requests: help@grizzlytab.com. We aim to respond within 30 days.

See also our Terms of Service.