Legal
Privacy Policy
We believe in clear, honest language, not legalese. Here's exactly what data we collect, why we collect it, and how we protect it.
Contents
RouteWrk ("we", "us", or "our") operates the RouteWrk workflow automation platform. This Privacy Policy describes how we collect, use, store, and share information when you use our website and services. By using RouteWrk, you agree to the practices described here.
Two roles: your account data vs. the data you put into RouteWrk
For information about you and your account (your name, email, billing details, and how you use the app), RouteWrk is the controller, and this policy governs how we handle it. For the content you enter into the platform (tickets, contacts, files, and any personal data about your own customers or vendors), you are the controller and RouteWrk acts as your processor (a "service provider" under US state privacy laws). We handle that content only on your instructions to provide the Service, as described in our Terms of Service and, where applicable, a Data Processing Addendum. If you are an individual whose data was entered into RouteWrk by one of our customers, please contact that customer directly to exercise your privacy rights; they control that data, and we will assist them as their processor.
1. Information we collect
Information you provide directly
When you create an account, subscribe to a plan, or contact support, you provide us with information including your name, email address, company name, billing information, and any content you enter into the platform (workflow configurations, ticket data, contacts, and files).
Information collected automatically
When you use RouteWrk, we automatically collect certain technical data, including:
Usage data: pages visited, features used, actions taken, and timestamps
Device & browser data: IP address, browser type, operating system, and device identifiers
Log data: server logs recording requests, errors, and performance metrics
Cookies & local storage: session tokens and user preferences (see Section 7)
Information from third parties
If you connect a third-party service (such as an email provider or payment processor), we receive data from that service only as needed to provide the integration you requested. We do not purchase data from data brokers.
Categories of personal information (CCPA)
We do not collect sensitive personal information as defined by CCPA (e.g. Social Security numbers, financial account credentials, precise geolocation, health data).
2. How we use your information
We use the information we collect to:
Provide and operate the platform: run your workflows, route your tickets, and deliver the core service
Improve the product: understand how features are used and identify areas to improve
Communicate with you: send transactional emails (receipts, password resets), product updates you opt into, and respond to support requests
Ensure security: detect and prevent fraud, abuse, and unauthorized access
Comply with legal obligations: meet our obligations under applicable laws and respond to lawful requests
We do not sell or share your data. We never sell, rent, trade, or share your personal information or your customers' data with third parties for cross-context behavioral advertising or marketing purposes. This applies to all users, including California residents under CCPA/CPRA.
4. Data retention
We retain your data for as long as your account is active, or as long as needed to provide the service. Specifically:
When you delete your account we hold it for 30 days, so you can change your mind and so a stolen session can’t erase you, then purge your personal data. Three things deliberately outlive it. Your organization keeps the work you created (tickets, workflows, contacts): those are the organization’s business records, and requests about them go to whoever runs it. But if you are its only member there is no one to keep them for, so the organization and everything in it is deleted along with your account. Your name also stays where it records something you did (a note you wrote, an approval you gave), because a history that quietly loses its author is no longer an accurate account of what happened; this is your name only, never your email address. And if someone has unsubscribed or reported a message, we keep that record indefinitely, because it is the only thing that stops us contacting them again. We also retain what the law requires, such as billing records.
5. Security
We take the security of your data seriously and implement appropriate technical and organizational measures, including:
Encryption in transit & at rest
All data is encrypted via TLS 1.3 in transit and AES-256 at rest.
Access controls
Role-based access and least-privilege principles within our team.
Hosted on Supabase
SOC 2 Type II compliant infrastructure with automated backups.
Incident response
We notify affected users without undue delay after confirming a breach that affects them.
No method of transmission or storage is 100% secure. If you have reason to believe your account has been compromised, contact us immediately through our contact form.
6. Your rights & choices
Depending on your location, you may have the following rights regarding your personal data:
Request a copy of the personal data we hold about you.
Ask us to fix inaccurate or incomplete data. You can change your name, login email and password yourself at any time in Settings → Account.
Delete your account and your personal data yourself, from Settings → Account. We hold the account for 30 days first (sign back in during that window and choose "Keep my account" to cancel), then purge it. You can also ask us to do it for you through our contact form. Deleting your account does not delete your organization's tickets, workflows or contacts, which belong to the organization rather than to you, and your name stays on the entries recording what you did to them; if you are its only member, the organization is deleted along with you.
Receive your data in a structured, machine-readable format.
Object to processing of your data for direct marketing or on grounds relating to your particular situation.
Unsubscribe from marketing emails at any time via the link in any email, or by contacting us directly. California and other state residents may also opt out of the "sharing" of personal information for cross-context behavioral advertising.
California residents may request that we limit our use and disclosure of sensitive personal information to what is necessary to provide the service. (We do not collect sensitive personal information as defined by CPRA, so this right has limited practical scope.)
If we deny your privacy request, you may appeal by replying to our denial notice. We will review your appeal within 60 days and provide a written explanation. If your appeal is denied, you may contact your state attorney general.
Authorized agents
California residents may designate an authorized agent to submit requests on their behalf. We will require written proof of authorization and may verify your identity directly to protect against fraudulent requests.
Deletion and the corrections listed above are self-service; for anything else, submit a request through our contact form. We will respond within 45 days; where permitted by law we may extend this by an additional 45 days with notice. If you are in the EEA or UK, we will respond within one month, extendable by up to two further months for complex or numerous requests, as Article 12(3) GDPR requires; see Section 10. We may need to verify your identity before fulfilling your request.
8. Children's privacy
RouteWrk is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete that information promptly. If you believe a child has provided us data, please contact us through our contact form.
9. California & US state privacy rights
California (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights. In the past 12 months, we have not sold or shared personal information as defined by the CCPA. You have the right to:
Know what personal information we collect, use, disclose, and share
Delete personal information we have collected about you
Correct inaccurate personal information
Opt out of the sale or sharing of personal information (we do not sell or share)
Limit use and disclosure of sensitive personal information (we do not collect sensitive PI as defined by CPRA)
Non-discrimination: we will not deny service, charge different prices, or provide a different level of quality because you exercised your privacy rights
Virginia, Colorado, Texas, Connecticut & other states
Residents of Virginia (VCDPA), Colorado (CPA), Texas (TDPSA), Connecticut (CTDPA), and other states with comprehensive privacy laws have similar rights: access, correction, deletion, portability, opt-out of targeted advertising, and the right to appeal a denied request. We honor these rights for all US residents regardless of state. Submit requests through our contact form.
Do Not Sell or Share My Personal Information
We do not sell or share your personal information with third parties for cross-context behavioral advertising. No opt-out action is required. If you believe your data has been handled in a way inconsistent with this statement, contact us through our contact form.
10. EEA & UK residents (GDPR)
This section applies to residents of the European Economic Area (EEA) and United Kingdom. If you are not based in the EEA or UK, it does not apply to you.
Data controller
RouteWrk is the data controller of your personal information. Our contact details are in Section 12. We do not currently have an establishment in the EEA or UK; once we begin actively serving EEA/UK users, we will appoint a local representative as required by Article 27 GDPR.
Lawful basis for processing
Additional rights for EEA & UK residents
Request that we restrict processing of your data (e.g. while a dispute is resolved) without deleting it.
Where we rely on consent (e.g. marketing emails), you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
You have the right to lodge a complaint with your local data protection authority, such as the ICO (UK), CNIL (France), or BfDI (Germany), if you believe we have not handled your data lawfully.
We do not make solely automated decisions (including profiling) that produce legal or similarly significant effects on you.
We respond to your requests within one month of receipt, as required by Article 12(3). Where a request is complex or you have made several, we may extend that by up to two further months and will tell you why within the first month. The 45-day window in Section 6 is the US state-law figure and does not apply to you.
International data transfers
RouteWrk is based in the United States. If you are located in the EEA or UK, your personal data will be transferred to and processed in the US. We rely on the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) as the lawful transfer mechanism. You may request a copy of the applicable SCCs by contacting us through our contact form.
EU/UK representative
We do not currently have an EU or UK establishment. Once we actively serve users in those regions, we will designate a local Article 27 representative and update this section with their contact details.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address associated with your account) and update the "Last updated" date at the top of this page at least 14 days before the change takes effect. Your continued use of RouteWrk after the effective date constitutes acceptance of the updated policy.
12. Contact us
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out:
Contact usGeneral & data requests
Use our contact formSecurity vulnerabilities
Use our contact form