Cardata

Cardata typical implementation process:

• Discovery and program design: Cardata works with finance/HR to choose the right program type (FAVR, tax‑free allowance, CPM), model costs, and define policies, driver eligibility, and timelines.​

• Data collection and configuration: Organisations provide driver, vehicle, ZIP/postal code, and insurance data; Cardata configures Cardata Cloud, sets up reimbursement bands, and aligns settings with IRS/CRA accountable‑plan rules.​

• Driver onboarding and app rollout: Drivers receive communications and training, enroll their vehicles and insurance, download Cardata Mobile, and begin automated GPS mileage tracking and trip classification.​

• Pilot and validation: A short pilot period (often one to a few reimbursement cycles) is used to validate mileage capture, reimbursement calculations, direct‑pay timelines, and change‑management messaging before full rollout.​

• Full deployment and optimisation: Once live, reimbursements run monthly via Direct Pay, while Cardata provides ongoing support and periodic reviews to tune rates and policies; end‑to‑end implementations typically fall in the several‑week range rather than many months for most programs.​

Cardata is highly customizable across program design, policy rules, analytics, and driver management, so it can fit different industries, geographies, and fleet profiles.​

• Custom program structures: Cardata designs tailored FAVR, tax‑free allowance, or CPM programs per client, adjusting fixed and variable portions, minimum mileage thresholds, and regional cost assumptions to match budgets and driver profiles.​

• Flexible mileage bands: Employers can configure mileage bands (e.g., 5,000 to 50,000+ miles) and adjust them over time, so high‑ and low‑mileage drivers receive different fixed reimbursements aligned with actual business use.​

• Policy and compliance configuration: Reimbursement policies, driver eligibility rules, insurance requirements, and compliance workflows are tuned to each organisation’s risk tolerance, locations, and HR/finance standards.​

• Admin and driver controls: Admins can add/remove drivers, define cost centres or territories, and customise onboarding, while Cardata works with each driver to align insurance coverage and documentation with program rules.​

• Custom analytics and reporting: Cardata Intelligence provides a point‑and‑click dashboard builder, custom KPIs, region/department/driver‑cohort views, threshold‑based alerts, scheduled reports, and an AI assistant (Otto) that answers organisation‑specific questions in natural language.​

Cardata provides structured onboarding, role‑specific training, and multi‑channel support for both admins and drivers.​

• New users get guided onboarding with Customer Success, including configuration of programs in Cardata Cloud, help adding admins and drivers, and training on dashboards, approvals, and reporting; a “Getting started” help‑center section gives step‑by‑step checklists for setup, account activation, and app configuration. Drivers receive targeted onboarding communications, in‑app tutorials, and support articles covering downloading Cardata Mobile, activating accounts, enabling GPS, and logging mileage, plus guidance on insurance requirements and program rules.​

• Ongoing support is available via email ([email protected]), dedicated US and Canadian phone numbers, and an online help center powered by Zendesk, which includes FAQs, how‑to guides, and troubleshooting resources for drivers and admins. Cardata emphasises responsive service—public materials note fast response times and ongoing assistance through change management, with CSMs guiding customers through technical setup, training, and program optimisation over time.​

Cardata protects data with audited security controls, strong encryption, and privacy‑by‑design handling of location and personal information.​

• Cardata is SOC 2–certified, meaning independent auditors have verified its controls for security, availability, confidentiality, and privacy across its SaaS platform and Cardata Intelligence analytics layer. The company states that it maintains administrative, technical, and physical safeguards, uses third‑party service providers with comparable standards under contract, and aligns its security policies with frameworks like ISO while conducting regular security audits.​

• Location and trip data from Cardata Mobile is collected only with user consent, processed on‑device with technology such as PathSense, and sent to Cardata servers via end‑to‑end encryption, where it is also encrypted at rest; deleted trips are permanently and irreversibly removed. Cardata’s policies emphasise that personal information is not sold, mobile opt‑in data is not shared for marketing, users have rights to access and delete their data under applicable privacy laws, and Cardata operates as a service provider/data‑processor for customers, bound by Terms, a Data Protection Addendum, and privacy laws like GDPR.

Cardata follows an ongoing SaaS release model with frequent app and platform updates that are surfaced to customers through app stores and in‑product release notes.​

On the mobile side, Cardata Mobile for iOS and Android is updated regularly, with current versions in the 4.11.x range and recent releases adding improvements like Lock Screen Live Activity on iOS and reliability enhancements for GPS tracking. Users normally receive these through automatic updates via the App Store or Google Play, but Cardata documents how to enable auto‑updates or manually update to the latest version so drivers stay on supported builds.​

For the broader platform, major feature launches—such as the Cardata Intelligence analytics suite—are rolled out as cloud updates, meaning admins get new dashboards, AI capabilities, and reporting tools without installing anything locally. Cardata maintains an online “app release notes” article that tracks what’s in each mobile release, while Intelligence and portal enhancements are announced via blog posts, press releases, and LinkedIn updates, ensuring finance, HR, and fleet leaders can understand new capabilities and adjust processes as needed.

Cardata’s contracts state that customer organisations own their program data, while Cardata holds limited rights to use and anonymise it, and customers can export data for use elsewhere.​

• Under Cardata’s Terms, “Customer Data” covers all information clients or their users load into the platform plus data generated from use; as between the parties, the customer owns this data, while Cardata only receives a license to process it to deliver services, enforce the agreement, and create anonymised “Usage Data.” The Privacy Policy clarifies that Cardata acts as a service provider/data‑processor for this Customer Data, handling personal information of drivers under the customer’s instructions and applicable privacy laws, and it explicitly states that Cardata does not sell Personal Information without proper notice and opt‑out rights.​

• For portability, Cardata allows customers to access, report on, and export program data such as mileage logs, reimbursement amounts, and driver details through the Reports page and related tools, which can be downloaded for use in other accounting, HR, or analytics systems. Drivers have additional rights under privacy laws (such as access and deletion of personal data), and Cardata’s location‑data policy notes that trips can be deleted permanently and irreversibly from Cardata’s systems, giving end users control over their own trip histories within the bounds of the employer’s program requirements.​

Cardata uses fixed‑term SaaS agreements that auto‑renew annually, with defined notice periods, limited refund rights, and clear post‑termination data obligations.​

Term and auto‑renewal

• Commercial contracts run for an Initial Term (often one year) and then automatically extend for successive one‑year Renewal Terms unless either party gives written non‑renewal notice at least 90 days before the end of the current term. During the Term, customers must pay all agreed fees; fees are non‑refundable except where the agreement explicitly provides otherwise (for example, in some breach or service‑failure scenarios).​

• Cancellation and early termination: Either party can terminate early for material breach if the breach is not cured within the contract’s specified cure period (typically 30 days after written notice), and Cardata can suspend or terminate access under the EULA for reasons such as non‑payment, fraud, or abuse. Force majeure events that persist beyond 120 days give either party a right to terminate on notice, with the Term extended by the length of the interruption up to that point. On termination, the customer remains liable for fees for services already rendered, and regular subscription fees are not refunded pro rata unless expressly agreed.​

• Data handling after termination: After expiration or termination, each party must, on written request, either return or permanently destroy the other party’s Confidential Information within 30 days and certify completion, subject to narrow exceptions such as data kept for legal, accounting, or backup purposes. Customer‑owned data (including mileage and reimbursement records) can be exported during the Term via reporting tools, and Cardata’s privacy/data‑handling commitments continue to apply to any retained personal information until it is lawfully deleted.​

Cardata’s primary formal standard is SOC 2, supported by privacy-law alignment and location‑data controls.

• Security and audit standards: Cardata has achieved SOC 2 certification, meaning an independent auditor has assessed its controls for security, availability, confidentiality, and privacy across its SaaS platform and data-handling processes. The company highlights SOC 2 as a core safeguard for customers’ reimbursement, driver, and location data and notes that it maintains administrative, technical, and physical controls consistent with recognised security frameworks.​

• Privacy and data protection alignment: Cardata’s Privacy Policy states that it acts as a service provider/data processor for customer data and commits to complying with applicable privacy and data‑protection laws, including honoring rights such as access and deletion where required. The policy emphasises that Cardata does not sell personal information, uses subprocessors under contractual safeguards, and applies privacy‑by‑design principles to sensitive location and trip data, which can be permanently deleted at the user’s request within program constraints.