Privacy Policy

We only collect what RouteStra needs to do its job. The list below covers everything operational; nothing here is used for advertising or sold on.

• Account info: name, email, password (stored scrambled, never in readable form), phone, role and organisation. Two-factor authentication is optional; when it's switched on we also store your backup codes, again in scrambled form.
• Driver records: name, licence number and expiry, certifications, hire date, depot, employment terms (working-time-directive opt-out where applicable).
• Operational data: rotas, shift assignments, leave requests, walkaround checks, incidents, jobs, invoices and the audit trail of who changed what.
• Sign-on context: when a driver signs on we record the time, their IP address, the user agent of the device they used, and (where allowed by the device) their GPS coordinates. This is the evidence trail required for working-time and incident investigations.
• Photo evidence: walkaround photos and incident photos uploaded via the driver portal. Stored separately per organisation, and only ever served through short-lived private links. They are not publicly accessible.
• Contact / sales / support: name, email, message, optional promo code if you fill in our quote or contact form.

A few things we deliberately keep out of the platform:

• No tracking cookies, no Google Analytics, no Hotjar: we don't profile visitors.
• No advertising. We never sell or rent your data, your drivers' data or your operators' data.
• No bank-feed access on Xero / QuickBooks / Sage integrations: we read and write invoices and customers only (full scope in section 07).
• No tracking or sharing of your DVSA / DVLA lookups: vehicle searches go through RouteStra's platform credentials and the results stay scoped to your organisation.

Your data is encrypted on the way to us and while it sits with us, and your organisation's records are kept separate from everyone else's. In plain terms:

• Everything travels over an encrypted connection, and stays encrypted on our servers and in our backups.
• The most sensitive fields (integration credentials, bank details, and the keys that connect you to Xero, QuickBooks or Sage) get a second, separate layer of encryption on top.
• Passwords are stored in a scrambled form that cannot be reversed. Nobody at RouteStra can read your password, and we could not tell you what it is if you asked.
• One operator can never see another operator's data. Every record is tied to your organisation and checked on our servers before anything is returned.
• Every change to a duty, job, vehicle, incident, leave request or permission is logged: who did it, when, and what it looked like before and after.
• Admins can require two-factor authentication across the whole organisation, with one-time recovery codes issued at setup.

How long we keep things, and what happens after you cancel:

• Active accounts: data is retained for as long as your subscription is active.
• After cancellation: a 60-day grace period during which the org can be re-activated without data loss. After 60 days the organisation is automatically and permanently purged from the live database.
• Database backups: rolling daily backups held by our hosting provider for the period set in your contract. Backups are encrypted to the same standard as the live database.
• Photo evidence is purged at the same time as the organisation it belongs to.
• Where UK law requires us to retain financial / tax records for longer (typically 6 years for VAT records), we keep only the records needed to satisfy that obligation, separately from the operational platform.

You have rights under UK GDPR. We'll honour them within one calendar month of a written request:

• Access: ask us for a copy of the data we hold about you. We currently fulfil this manually. Email privacy@routestra.com and we'll send the export.
• Correction: update or correct your account or driver records, either inside the app or by emailing us if you can't self-serve.
• Deletion: cancel your subscription (auto-purges after 60 days) or email us to request immediate deletion.
• Portability: request a copy of your operational data in a machine-readable format (CSV / JSON). Currently fulfilled manually. A self-serve export is on the roadmap.
• Object / restrict: ask us to stop processing your data for a specific purpose, or restrict how we use it. We'll respond within one calendar month.
• Complain: if you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO).

Running RouteStra takes a small number of specialist suppliers: somewhere to host the platform, a way to send email, a way to take payment, and tools that tell us when something breaks. Each one only ever sees the data it needs to do its particular job, and none of them are allowed to use it for anything else. Everything we handle ourselves stays in UK or EU data centres. Broadly, they fall into four groups:

• Hosting and delivery: the servers, database and file storage the platform runs on, and the network that serves it to your browser.
• Email: sends the transactional messages RouteStra needs to send: invitations, password resets and notifications. It sees the recipient's email address, nothing more.
• Billing: handles subscription payments. Card details go straight to our payment provider and are never stored on our servers.
• Reliability and diagnostics: tells us when something errors or runs slowly so we can fix it. These tools receive technical diagnostic data (what broke, where, and how long a request took), not your operational records. Passwords, tokens and personal data are stripped out before anything is sent.
• Accounting (optional, only if you turn it on): if you connect Xero, QuickBooks or Sage, invoice and customer records flow between RouteStra and that provider. See section 07.

Connecting an accounting provider is entirely optional and is initiated by an authorised user inside the RouteStra app. We support Xero, Intuit QuickBooks Online and Sage Business Cloud Accounting. When connected:

• Data accessed from the provider: customer/contact records, invoice records, and payment status. We do not request or store bank-feed data, payroll, employees, journal entries, tax filings, or chart-of-accounts beyond the revenue/payment account codes you map.
• Data sent to the provider: invoices that you raise in RouteStra (line items, customer reference, totals, dates) and the corresponding payment records when those invoices are paid. Data sent matches what is already visible to your team inside RouteStra.
• Tokens: the credentials that link your RouteStra account to the provider are encrypted and stored only against your organisation. They are never shared between organisations and never exposed in API responses.
• Disconnect: An admin can disconnect at any time from the in-app Accounting tab. Disconnecting always stops future sync and removes our copy of the tokens within seconds. For Xero and QuickBooks we also tell the provider to revoke the connection. Sage does not offer a revocation endpoint, so if you want the authorisation withdrawn on their side too, remove RouteStra from Settings → Apps inside Sage.
• Records already synced: anything previously sent to your Xero, QuickBooks or Sage account stays in that system and is governed by that provider. We cannot delete data from inside their systems on your behalf.
• Provider privacy policies: data we send to or receive from the provider is, while in their systems, governed by their own privacy policies: Xero at https://www.xero.com/legal/privacy/, Intuit at https://www.intuit.com/privacy/ and Sage at https://www.sage.com/en-gb/legal/privacy-and-cookies/.
• Webhooks: providers may notify us when an invoice is paid in their system so we can update the corresponding RouteStra invoice. We verify the cryptographic signature on every inbound webhook before acting on it.