Privacy and location data
Tracker is built so that it doesn't track your operatives' working day.
What is tracked
- Only the journey to the customer. Location is shared from Start journey until arrival. Nothing is collected before setting off, between visits or after arrival.
- Operatives can set a privacy zone around their home. The app sends no location from inside it, and the zone stays on their phone. See The Tracker app.
- Customers see the minimum. The tracking page shows the operative's name, photo and position for this visit only. It never shows the customer's own details.
- Tracking links are long, random and unguessable, and stop showing a location once the visit ends.
How long it's kept
| Data | Kept for |
|---|---|
| Location trail of a visit | 24 hours after the visit ends, or up to 30 days with visit history. You can choose shorter. Then it's deleted. |
| The visit itself (customer, address, times, actual duration) | 6 to 36 months after the visit, as you choose (24 by default). Then it's deleted. |
| Messages sent to customers | 3 to 24 months, as you choose (12 by default) |
| Operative photos | Until you remove or replace them |
| Arrival-time estimates from map providers whose terms forbid storing them | Shown live only, never stored |
Your notices
You're the controller of your customers' and operatives' data, and ROCC is your processor under the Data Processing Agreement.
- Customers: the tracking page links to your visit tracking notice, filled in with your organisation and privacy contact, or to your own notice if you link one in Settings.
- Operatives: the Tracker app and share-location page link to the operative notice.
Using Tracker lawfully covers your lawful basis, DPIA and retention.
Where it's kept
Tracker runs on Cloudflare. In production the database, live journeys and photos are pinned to Cloudflare's EU jurisdiction. Map tiles, routing and messaging providers each have their own data terms, which ROCC reviews before using them.