Privacy policy
Last updated: October 17, 2026
1. Who is responsible for your data?
The data controller is [COMPANY NAME TO BE COMPLETED], publisher of DropTrace (see legal notice). For any question about your personal data, write to contact@droptrace.eu.
2. What data is collected?
| Category | Examples |
|---|---|
| Account | Full name, email, password (never stored in plain text), role (driver/manager/admin/depot manager) |
| Work activity | Start-of-shift check-ins and daily reports: parcel/relay/pickup counts, mileage, vehicle plate, round/letter, timestamped photos |
| Billing | Subscription status, Stripe customer ID — card data is processed only by Stripe, never by us |
| Support | Description of a bug or suggestion, technical logs (app version, page, device) in case of a report |
| Technical | Application version, display preferences — stored locally on your device (see Cookies section) |
DropTrace does not collect your device's location. Only the delivery coordinates recorded by Colis Privé for a parcel under claim may be read, through the extension described in section 10.
3. Why (purposes and legal bases)
| Purpose | Legal basis |
|---|---|
| Providing the Service (accounts, reports, pay/revenue calculation, export) | Contract performance |
| Billing and subscription management | Contract performance / legal obligation (accounting) |
| Technical support and bug fixing | Legitimate interest (ensuring the Service works properly) |
| Transactional emails (account confirmation, trial reminder) | Contract performance |
| Follow-up emails for unconverted free trials | Legitimate interest — unsubscribe possible at any time |
4. Who has access to your data?
Access is strictly partitioned by company via our database access control (Row Level Security): a driver only sees their own data, a manager sees their agency's, an admin sees their company's, a depot manager sees the subcontractors they supervise. No one can see the data of a company they aren't attached to, including via a tampered technical request.
5. Technical processors (hosting, email sending, payment)
To operate, DropTrace relies on the following providers, each acting as a processor within the meaning of the GDPR:
| Provider | Role |
|---|---|
| Supabase | Database hosting, authentication, photo storage |
| Netlify | Site and server function hosting |
| Stripe | Payment and recurring subscription processing |
| Resend | Sending transactional emails (confirmation, reminders) |
| Anthropic | AI-assisted analysis of bug reports (report text only, at an administrator's request — never automatic and never on photos) |
| Cloudflare (Turnstile) | Anti-bot protection of the login and “forgot password” forms: checks that a human is signing in, using technical browser signals, without advertising cookies (Turnstile privacy policy) |
Some of these providers are located outside the European Union (United States). Data transfer relies on the safeguards provided by these providers (standard contractual clauses or an equivalent mechanism).
6. How long your data is kept
- Photos (start of shift, end of day): automatically deleted after 90 days (daily purge).
- Reports and figures (counts, pay, revenue): kept for the duration of the subscription, then archived for as long as required by legal accounting obligations.
- Account: kept while active; deletion on request (see rights below).
- Bug reports: kept while being processed, then archived to improve the Service.
7. Cookies and local storage
DropTrace does not use advertising cookies or third-party trackers. The application uses
your browser's local storage (localStorage) only for what is strictly necessary
for it to work: keeping your login session, display preference (desktop/mobile), app
version already seen, and remembering that an offer popup was already dismissed. None of
this is passed on to advertising networks.
8. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access and rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object, in particular to marketing follow-up emails (unsubscribe link in each relevant email)
To exercise one of these rights, write to contact@droptrace.eu. You also have the right to lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be).
9. Security
Exchanges with the application are encrypted (HTTPS). Data access is partitioned by company at the database level (Row Level Security), not only at the interface level — a modified technical request cannot bypass this isolation.
10. Chrome extension “DropTrace — Contrôle Colis Privé”
The extension is reserved for DropTrace subcontractor and depot manager customers. It only runs on the
Colis Privé route management site (gestiontournee.colisprive.com, route and parcel pages) and
on the DropTrace Gestion area, using the Colis Privé session the user opened themselves.
| What the extension reads | Why |
|---|---|
| A Colis Privé route page opened by the user: delivered parcels, returns, relay points and pickups per day | Compare with drivers' reports in DropTrace (parcel gaps) |
| The page of a parcel under claim: status, planned and actual delivery coordinates, customer call duration, signature | Check the delivery procedure and prepare the claim reply |
This information is only sent to the user's DropTrace account, on the same servers and with the same per-company isolation as the rest of the Service (sections 4 and 5). The extension reads no other site, does not read browsing history, contains no advertising and shares nothing with third parties. Its settings and local index stay in Chrome storage on the device.
Use of data obtained through the extension complies with the Chrome Web Store Limited Use policy: it is used only for the feature described above, is never sold or used for advertising, and is not read by any human other than the user, their company and, when needed, DropTrace support at their request.
11. Changes to this policy
This policy may be updated; the date at the top of the page reflects the latest version. Substantial changes will be communicated by email.