Privacy Policy

This version of the Privacy Policy reflects two significant changes to the service. Routing24 offers user accounts and stores the route plans you save while signed in; earlier versions of this policy described an essentially stateless tool and no longer apply. Routing24 now also offers AI features, which means that, when you choose to use them, parts of your data are processed by external AI providers. Section 5 describes this in full.

Welcome to Routing24.com (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, and share information about you when you use our website and services. We are committed to safeguarding your privacy and handling your data transparently. Routing24.com is provided to you by Routinghub LLC, a Delaware company (7159503) registered at 16192 Coastal Highway, Lewes, Delaware, 19958, County of Sussex, United States.

We collect and process the following categories of information solely to provide, secure, and improve the service:

a) Account information. When you register, we collect your email address, the authentication provider you chose (email/password or Google), your declared data region, and account creation and update timestamps. For email accounts we additionally store a salted, hashed password — we never store passwords in plaintext. For Google accounts we additionally receive and store the name and profile picture URL exposed by Google’s standard profile and email OAuth scopes.

b) Google OAuth tokens (conditional). If you choose to connect optional Google features such as Google Calendar™ import, we receive and store a Google refresh token server-side so that we can call Google on your behalf for the scopes you granted. You can revoke this access at any time via your Google Account settings; doing so invalidates the refresh token we hold.

c) User content. The data you create, upload, or import while using the service is stored under your account in Google Cloud Storage in the data region associated with your account. This includes addresses, geographic coordinates, customer names and contact details, order and visit information, opening hours and time windows, fleet and vehicle data, depots, driver shifts, and the optimized routes we generate from this input.

d) Shared route links. If you choose to create a shared link for a route plan, the content of that plan is stored so that the people you authorise can open it. See Section 7 for more detail.

e) Anonymous identifier (pre-login). Before you sign in, we generate a random anonymous identifier (UID) in your browser so that the service is usable without an account. This UID is stored locally in your browser and is replaced by your account identifier when you sign in.

f) Diagnostic and product analytics data. When the service is running we collect operational data: error reports and product usage analytics. Our error tracking and part of our product analytics run on open-source software that we host ourselves, on our own infrastructure; that data stays with us and is not sent to a third party. The remaining analytics tools, and the in-app live chat you may use to contact us, are third-party services listed in Section 4, and the exact data each collects is described in its own privacy policy.

g) AI feature content. Routing24 offers a built-in AI chat and, separately, an MCP server that lets an AI assistant you already use work with your Routing24 data. Both features send content outside Routing24. Section 5 sets out which parties receive what, where the processing happens, and what your choices are. Neither feature does anything unless you choose to use it.

a) Essential session cookie. When you are signed in, our backend sets a session cookie scoped to the Routing24.com domain to authenticate your requests. This cookie is required for the service to function — without it, the backend cannot tell which signed-in user is making a request. Under GDPR Recital 30 and Article 6(1)(f), and consistent with the ePrivacy Directive’s “strictly necessary” exemption, no separate consent is required for this cookie. We do not set advertising, marketing, or cross-site tracking cookies.

b) Browser local storage. The web application keeps a small amount of state in your browser’s localStorage: an identity token (a short-lived JWT), a refresh token, the anonymous UID described in Section 1(e), and your data-region preference. This information is not a cookie, never leaves your browser automatically, and is necessary for the service to operate offline-capably and to keep you signed in across page loads. Clearing site data in your browser removes these entries.

c) Analytics cookies. Both Google Analytics and PostHog are configured to run in cookieless mode and do not set cookies on your device. Google Analytics runs in GA4 mode with strict redaction of personally identifiable information. Our self-hosted analytics, served from stats.routing24.com, is identified analytics linked to your account UID for product-improvement purposes and does not use cookies. The only cookie the service sets is the essential session cookie described in (a).

We process the data described in Section 1 for the following purposes:

Providing the service — creating and managing your account, authenticating you, storing and retrieving your route plans, and delivering optimization results. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Optional Google integrations — when you explicitly grant the calendar.readonly (or similar) scope so we can import your calendar events as orders. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time via your Google Account.

Sharing — making shared route links accessible to anyone with the link, on your instruction. Legal basis: performance of a contract.

AI features — passing your prompts and the parts of your plan the assistant needs to the AI providers described in Section 5 so that the built-in chat can answer you, and relaying tool calls and their results between an AI assistant you have connected and your own browser tab. Legal basis: performance of a contract for the built-in chat, and your consent (GDPR Art. 6(1)(a)) where you connect a third-party AI assistant, which you can withdraw at any time by revoking the connection.

Security and abuse prevention — detecting, investigating, and preventing fraud, abuse, or unauthorized access to the service. Legal basis: our legitimate interests (GDPR Art. 6(1)(f)).

Error diagnostics and product improvement — collecting error reports and aggregated usage data to identify and fix problems and improve usability. Legal basis: our legitimate interests.

Support communications — responding to messages you send us through chat, contact form, or email. Legal basis: performance of a contract and our legitimate interests.

Legal compliance — meeting our obligations under applicable law and responding to lawful requests by public authorities. Legal basis: legal obligation (GDPR Art. 6(1)(c)).

We do not sell your data or share it with third parties for their own marketing purposes. We rely on the following subprocessors to operate the service. Each has its own privacy and security commitments; we have contractual arrangements with each consistent with applicable data protection laws.

Hetzner Online GmbH — cloud infrastructure and hosting (EU).

Google Cloud Platform (Google LLC / Google Ireland Ltd) — object storage of user content and identity assertions; storage region is determined by your account’s data region.

PostHog (PostHog Inc.) — product analytics; captures product usage events to help us understand feature usage and improve the service.

Google Analytics (Google LLC / Google Ireland Ltd) — product and traffic analytics, run in GA4 mode configured for cookieless measurement with strict redaction of personally identifiable information. Not used for advertising or cross-site tracking.

Chatwoot Inc. — in-app live chat, served from app.chatwoot.com. If you initiate a chat, the contents of your messages and basic identifiers necessary to route the conversation are processed by Chatwoot.

Google Identity Services (Google LLC) — the “Sign in with Google” script served from accounts.google.com, used solely to authenticate you with Google.

Formspree (Formspree Inc.) — processing of submissions from our public contact form at formspree.io.

Cloudflare, Inc. — edge processing for our AI features only. Cloudflare authenticates the request, enforces the rate and spend limits attached to your plan, and forwards the request to the AI model provider through Cloudflare AI Gateway. The same Cloudflare layer carries the MCP traffic between an AI assistant you have connected and your browser tab. See Section 5.

Google AI Studio (Google LLC / Google Ireland Ltd) — the AI model that answers the built-in chat. See Section 5.

We may disclose information to comply with applicable laws or respond to lawful requests by public authorities.

Routing24 offers two separate AI features. Both are optional, and neither sends anything anywhere unless you use it. This section describes each one, because they involve different parties and give you different control.

a) The built-in AI chat. The chat is available only when you are signed in. When you send a message, that message and the parts of your plan the assistant needs in order to answer are transmitted out of your browser. This can include street addresses, customer names and contact details, order and visit data, vehicle and depot data, and the routes we generated. Raw geographic coordinates are not exposed to the model.

The request first reaches an edge service operated by Cloudflare, Inc., which verifies your identity token, applies the rate and spend limits attached to your plan, and forwards the request to the model provider through Cloudflare AI Gateway. Cloudflare therefore processes the content of your chat requests and the model’s replies, and it retains a rolling log of them, tagged with your account identifier and plan tier, for operational and abuse-prevention purposes. That log is capped and rolls over: the oldest entries are deleted as new ones arrive.

The model that answers is provided by Google (Google LLC / Google Ireland Ltd) through Google AI Studio, under terms that do not permit Google to use the content of these requests to train its models.

b) The MCP server and AI assistants you connect. Routing24 exposes an MCP server so that an AI assistant you already use can read and modify your Routing24 data on your instruction. Connecting an assistant requires an explicit act by you: either you mint an access key in the application, or you approve a consent screen for the client that asked. You can revoke either at any time from your account, which immediately stops all further access by that client.

While an assistant is connected, the data it requests is read from your live browser session and returned to it. It is relayed through the Cloudflare worker described above, which carries the traffic and does not store the contents of tool calls or their results.

Your AI assistant’s provider receives your Routing24 data, and we are not that provider. Depending on the assistant you choose, that provider may be Anthropic PBC, OpenAI OpCo, LLC, Microsoft Corporation, Google, or another operator. Once the data reaches your assistant, its handling is governed by the agreement between you and that provider, including their retention periods, their location of processing, and whether they use your inputs to train models. We have no contractual relationship with the provider you choose, we cannot control what it does with the data, and we cannot delete data from it on your behalf. Check your provider’s terms before connecting an assistant to an account that holds personal data about your customers.

c) Training. Routing24 does not use your data to train artificial intelligence or machine-learning models, and does not permit the providers we contract with for the built-in chat to do so. This commitment cannot extend to an AI assistant you connect yourself, for the reasons in (b).

We employ security measures to protect your data, including encryption, access controls, and regular security review. Data in transit between you, our service, and our subprocessors is protected by industry-standard TLS; data at rest in our storage is encrypted using the Advanced Encryption Standard, specifically AES-256. Only authorized personnel can access user data, and only to the extent necessary to provide and support the service.

Routing24 lets you create shared links to routes you own. Sharing is per route and off until you enable it. When you share a route, its contents, which may include customer addresses, names, and contact details you uploaded, become accessible to the email addresses you place on that route’s allow list, and to you. You are the data controller for any personal data you place in a shared plan, and you are solely responsible for ensuring you have a lawful basis to share that data. You can revoke a shared link at any time from the application. We do not actively monitor shared links, but we may remove links that violate our Terms & Conditions.

If you access our services from outside the country where our servers are located, your data may be transferred to and processed in countries with different data protection laws. Your account’s data region determines where the bulk of your account data and user content is stored. Where transfers leave the EEA, we rely on the safeguards required by GDPR, including Standard Contractual Clauses where applicable.

We retain your account information and the user content you store with us for as long as your account exists. You may request deletion of your account and content at any time by contacting our Data Protection Officer using the details in Section 13. Following identity verification, we will delete or irreversibly anonymise your account and content within 30 days of a verified request. Limited records (such as security and abuse logs, billing records, and items subject to a legal hold) may be retained for longer where required by law. Shared route links you created are revoked when your account is deleted.

For users in the European Union, the United Kingdom, and the European Economic Area, we comply with the General Data Protection Regulation (GDPR). You have the rights to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a structured, commonly used, machine-readable format (portability); withdraw consent for any processing that is based on consent; and lodge a complaint with your local supervisory authority.

For users in the United States, we provide equivalent access and deletion rights consistent with the California Consumer Privacy Act (CCPA) and other applicable state privacy laws.

To exercise any of these rights, email our Data Protection Officer using the contact details in Section 13. We will verify your identity (typically by confirming control of the account email) and respond within 30 days of a verified request. We do not charge a fee for these requests unless they are manifestly unfounded or excessive.

Routing24 is a business tool and is not directed to children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from anyone under 16. If we become aware that an account has been created by someone under 16, we will delete the account and any associated data.

We may update this Privacy Policy to reflect changes in our practices or applicable laws. The “Last updated” date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact us at:
Email: support@routing24.com
Phone: +1 (626) 879-3690

For questions or requests about our data practices under the GDPR or U.S. state privacy laws, you may contact our Data Protection Officer:
Mr. Denis Kurilov
Email: denis@routing24.com
Phone: +1 (626) 879-3690

Routing24 also offers a free Chrome extension, “Routing24 Route Optimizer for Google Maps™”, which runs in the Chrome side panel and optimizes the stop order of a Google Maps™ route. The extension requires no account and no sign-in. It does not read your Google account, your email, or your browsing history.

a) Sent to Routing24. To compute travel times and distances between the stops in your route, the extension sends their latitude and longitude to Routing24’s routing service. The request also carries a random identifier generated in your browser profile, the extension version, and a constant client label (“extension”). The identifier is not tied to a person and is used only for abuse limits. The coordinates are processed to answer the request and are not stored against a person.

b) Kept in your browser only. The extension reads the stop names from the Google Maps™ page and stores them in chrome.storage.local to label the list of stops. They leave your browser only when you click “Open in Routing24”, which creates a plan in your own Routing24 account. From then on, that plan is handled under the terms of this policy that apply to your route plans.

c) Not collected. The extension collects nothing else: no page content, no URLs, no usage statistics, no analytics. Nothing the extension handles is sold, shared with third parties, or used for advertising, creditworthiness, or lending.

d) Deletion. Removing the extension deletes everything it stored in your browser.

Google Maps™ is a trademark of Google LLC. Routing24 is not affiliated with or endorsed by Google.