Privacy Policy

1. Who we are

Routova is a field service route planning and maintenance management service operated by PROMEC SYSTEMS LLC, a limited liability company trading as Routova, reachable at sales@routova.net. Field service companies ("companies") use Routova to plan daily routes, manage recurring maintenance work and communicate with their own customers. This policy explains what data we handle and why. PROMEC SYSTEMS LLC is the data controller for account administration, our business contacts, support and service security data: we determine why and how that information is processed. For personal data companies enter about their own customers and staff to deliver field services, those companies are the controllers and we act as their processor on their instructions.

2. Information we collect

• Account data: name, email address, role (admin, dispatcher or driver) and the company you belong to.
• Company data: company name, sending display name, reply-to email address and contact phone number.
• Operational data you enter: customers, service addresses, service agreements, visits, routes, checklists, photos, signatures, parts, quotes and invoices.
• Location data: geocoded service addresses and, where a driver records arrival, the coordinates captured at that stop.
• Technical data: IP addresses, device and browser information, usage events, authentication records and diagnostic logs needed to keep the service running and secure.
• Support data: messages, contact details and information you send when requesting help.

3. How we use information

We use the data solely to provide the service: authenticating users, scoping each company's data to that company, planning and optimising routes, generating visits, producing service reports and invoices, and sending the notifications a company chooses to send to its own customers. We do not sell personal data and we do not use it for advertising.

• Account and company contact data are used to create and administer accounts and subscriptions, authenticate users and communicate about the service. Our legal basis is performance of our contract with you, or legitimate interests in administering business accounts where your company is the contracting party.
• Operational and location data are processed to provide routing, visits, proof of work, invoices and customer notifications under our agreement and the company controller's instructions. The company is responsible for establishing its legal basis for its customer and staff data.
• Technical and usage data are used for troubleshooting, reliability and security, based on our legitimate interests in protecting and maintaining the service.
• Support messages are used to answer requests and resolve problems, based on contract performance or our legitimate interests in supporting users.
• Optional connected-account access is used only for the sending feature you authorise. We rely on contract performance to provide that requested feature and consent where applicable; you can revoke the connection at any time.
• We may retain or disclose necessary records to meet legal obligations, including accounting requirements and lawful requests.

4. Google account data and the Gmail API

A company may optionally connect its own Gmail account so that customer notifications (appointment confirmations, reminders, on-the-way alerts, service reports, review requests and invoices) are sent from the company's own address instead of ours. When a company connects Gmail:

• We request only the gmail.send scope, plus basic profile and email address, so we can display which account is connected.
• We use this access only to send the transactional messages described above, triggered by actions inside Routova.
• We never read, scan, index, download or store the contents of a mailbox, messages, drafts, labels, contacts or attachments. The gmail.send scope does not grant read access.
• We store only an encrypted access credential and the connected email address. Credentials are encrypted at rest, are never shown to any user, are never exposed in the app interface and are accessible only to the server code that sends email.
• We do not use Google user data to train or improve any generalised or artificial intelligence or machine learning model.
• We do not transfer Google user data to third parties except as needed to provide this sending feature, comply with applicable law, or as part of a merger or acquisition after obtaining explicit consent.
• A company can disconnect at any time in Routova under Settings, or revoke access directly at myaccount.google.com/permissions. On disconnection we delete the stored credential immediately.

Routova's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Other email sending options

A company may instead provide an email service API key (for example Resend) so messages send from its own verified domain. Such keys are stored encrypted, are never displayed back to any user, and are used only to send that company's own messages. If no sending account is connected, notifications are sent from Routova's verified domain under the company's own name and reply-to address.

6. Service providers

We rely on a small number of processors to run Routova: cloud hosting and database, authentication and file storage, mapping and route optimisation, email delivery, website analytics, customer support tooling, and payment processing for companies' customer invoices. Service providers acting as our processors process data on our instructions and under appropriate contractual safeguards. Card details are handled by the relevant payment provider rather than stored by Routova.

Paddle.com is our reseller and Merchant of Record for Routova subscription orders. We share necessary account, contact and subscription information with Paddle for the sale of the product, subscription management, payments, tax compliance, invoicing and refunds. Paddle acts as an independent controller for its payment and order processing, as explained in Paddle's Privacy Notice. This is separate from payments companies collect from their own field service customers.

We may also share necessary information with professional legal and accounting advisers under confidentiality obligations, and with authorities where required by law.

7. Data separation and security

Every record is scoped to a single company and enforced at the database level, so one company can never see another's data. Data is encrypted in transit and at rest. We maintain appropriate technical and organisational safeguards, including access controls. Access is limited by role, and sensitive credentials are write-only from the interface. No system can guarantee absolute security.

8. Retention

We keep operational data for as long as a company's account is active, plus any period required for legal, tax or accounting purposes. Connected sending credentials are deleted as soon as the connection is removed. On account closure, data is deleted or anonymised when no longer needed, subject to legal retention obligations. Account and contact information is kept while needed to administer the account; support and diagnostic records are kept only as long as needed to resolve requests, maintain security or satisfy legal obligations. We review retained data and delete or anonymise it when those purposes no longer apply.

9. Your rights

You may request access to, correction of, export of or deletion of your personal data, and you may object to or restrict certain processing. Contact sales@routova.net and we will respond within one month, subject to lawful extensions for complex requests. Where applicable law provides these rights, you may also request data portability, withdraw consent at any time without affecting prior lawful processing, and complain to your local data protection supervisory authority. These rights depend on the processing and applicable law. If you are an end customer of a company using Routova, please contact that company first; we act as their processor.

10. Children and changes

Routova is a business tool and is not directed at children under 16. If we change this policy we will update the date above and, for material changes, notify account admins by email.

11. Cookies and local storage

We use essential cookies or similar browser storage for sign-in, session security, saved preferences and offline functionality. You can manage or remove these through your browser settings; blocking essential storage may prevent sign-in or offline use.

We also use visitor analytics, provided through Lovable, the platform that builds and hosts Routova, to understand how many people visit routova.net, which pages they view, where they arrived from and how quickly pages load. When you open a page, an analytics script sets a cookie named session-id holding a random identifier, which expires 30 minutes after your last page view. With each page view it sends the page address, the referring page, your browser's user agent and language, an approximate country worked out from your device's time zone, and page-speed measurements. Like any web request, this also reaches Lovable with your IP address. We use this information in aggregate to improve the site; we do not use it for advertising or to build profiles of individuals. You can block or delete this cookie in your browser settings without affecting how Routova works.

We do not use advertising or marketing cookies. Paddle may use its own cookies during checkout as described in its privacy notice.

12. International transfers

Our providers may process data in countries outside your country of residence, including outside the UK or EEA. Where applicable data protection law requires safeguards, we use recognised adequacy decisions or appropriate contractual safeguards, such as EU Standard Contractual Clauses and the UK Addendum or equivalent applicable transfer arrangements. Contact us to request information about the safeguards relevant to your data.

13. Contact

Questions about this policy: sales@routova.net.