Privacy Policy

1. Who we are

Trackapp is run by Trackapp FZE, a Free Zone Establishment registered in Sharjah Publishing City Free Zone, Business Centre, Sharjah, United Arab Emirates, trade licence number 4432358.01 (“Trackapp”, “we”, “us”). For anything about privacy or your data, write to privacy@trackapp.ae. Security reports go to security@trackapp.ae.

2. About this policy

This policy explains what personal data Trackapp handles, why, who else receives it, how long we keep it, and the rights people have. We wrote it to follow the UAE Personal Data Protection Law (Federal Decree Law No. 45 of 2021). We also aim to treat members and the people they work with in the United Kingdom and the European Union fairly under their data protection laws.

3. Two kinds of data, two roles

• Your own details (as a member: an Owner or someone invited to a business). We decide how these are used, and we are responsible for them.
• Details you add about the people you work with, such as clients, consignors, suppliers and partners. You decide what to add and why. Trackapp stores and uses these details only for you and on your instructions, to provide the service to you.
• Your responsibility as a member. You must have a lawful reason, and consent where the law needs it, to add these details, and you must tell the people you work with how you use them.

4. What we collect

About members and their teams

• Account: your email address, name, username and password. Your password is stored only in scrambled form, never as readable text. If you use Sign in with Google, Google gives us your email address and name instead of a password.
• Profile: a profile photo, if you add one.
• Teams: the businesses you belong to, your role in each, and the email address and role of each person you invite. Invites expire after 7 days.
• Business details you choose to add: legal name, address, registration and tax numbers, country, contact details and social media names, logo, the payment instructions you show on your documents, and a copy of your trade licence.
• Billing (for the Owner, when a plan is paid for): your plan, monthly or yearly, currency, trial and payment dates, and whether each payment succeeded, failed or was refunded. From our payment provider we receive only the card brand, the last four digits and the expiry month and year, to show them to you and to remind you before the card expires. We never receive or store your full card number or security code.
• Security and service records: sign in events, including the IP address and the device and browser used, which our sign in provider keeps; a history of who added or changed what in a business; a history of changes to payment records; counts of repeated tries, such as wrong passwords; counts of how much each plan feature is used; records of the emails we send; and small preferences, such as which tips you have already seen.
• Messages you send us, for example to support.
• How you heard about Trackapp, if you choose to tell us when you set up your business.
• The times you open the app, with the business and the account, kept for 90 days to understand how Trackapp is used.
• The times you open and use the app, with the business and the account: app openings are kept for 90 days. We use these, and the times in the sign in and activity records above, to understand how Trackapp is used.

About the people you work with (added by you)

• Contact details, such as name, phone number, email address, social media names and birthday, and your notes about them.
• Records of your dealings with them: sales, items, prices, deposits, payments, refunds, balances, purchases, consigned items, delivery details including tracking numbers, and the documents you make for them.
• Photos you add, such as photos of items or proof of payment.
• Their message choices, for example if they asked not to get reminders or group messages, the groups you put them in, and the text of reminders and messages you prepare in Trackapp.
• When they open a page or document you shared with them: that it was opened, when, and how many times (section 10). Trackapp records this; you do not add it.
• Items they leave with you for service, when this feature is offered: a description of the item and its brand, a serial or reference number if you add one, what is being done, the condition you note when you receive it, what came with it, photos of the item, the dates of each stage, where the item is (with you, or with a workshop or other business you send it to), and the price and any cost of the work.
• For suppliers and partners: name, phone number, contact person, notes and the terms you agree with them.

About consignors who sign an agreement

• Name, phone number, address and ID number, as you enter them. Trackapp never asks for or stores photos of ID documents.
• When they sign, we record: that they ticked the box confirming they have read and agree to the agreement, their drawn signature, the name they type, the date and time, whether they signed in person or through a link, their IP address, and their type of device and browser (for example “iPhone, Safari”).
• We also record: when the agreement link was first and last opened, how many times it was viewed, and a digital fingerprint of the agreement that shows whether it was changed later, and a signing fingerprint that also covers both signatures, the typed names, the dates and times and the proof of signing.
• Your own signature as the member is recorded in the same way.

Pictures, files and voice notes you ask Trackapp to read, and what you ask Trackapp

• The pictures, documents and parts of files you choose to read are sent to our reading service (see section 8) and are not kept by Trackapp after reading, unless you add a picture to a record as its photo.
• To help the reader tell you apart from your client in a chat screenshot, it also receives your own name, phone number and email address.
• We keep a short code made from each screenshot to warn you about duplicates. The picture cannot be rebuilt from it.
• Voice notes, when this feature is offered: your recording is sent to our speech to text provider (see section 8) only to turn it into text, and is not kept by Trackapp. The text is then read by our reading service to fill in a record for you to check. Trackapp does not keep the text either, unless you save it in a record.
• What you type or say to Trackapp, when this feature is offered: it is sent to our reading service only to work out what you are asking for, to fill in a form for you to check, and to choose which of Trackapp’s own searches, calculations, help answers or message drafts fits your request. Trackapp then finds the records, works out the figures and prepares any message itself, from your own records in that business, and only from what your role and plan let you see. Your records are not sent to the reading service. Trackapp keeps a count of requests for fair use, not what you typed or said.

5. Why we use data, and our legal basis

• To provide Trackapp: create and run your account, store your records, make your documents and pages, send the emails you ask for, and let your team work together. Basis: our agreement with you.
• To take payment for plans and keep billing records. Basis: our agreement with you, and the law on keeping financial records.
• To keep Trackapp and its members safe: stop misuse, fraud and break ins, and investigate problems. Basis: our legitimate interest in a secure service, and the law.
• To support you and tell you about your account, your plan and important changes. Basis: our agreement with you.
• Details of the people you work with: handled on your instructions, under our agreement with you. Your own reason and permission for collecting them are your responsibility.
• Consignment signatures and signing records: to give both sides a reliable record of who signed and when. Basis: carrying out the agreement, and the legitimate interest of both sides in proof of signing.
• To help you get started: up to three short emails in your first days, and to understand how people find Trackapp. You can stop these emails at any time with the link in each one. Basis: our legitimate interest in helping new members and growing Trackapp, and you can object at any time.

6. What we do not do

• We do not sell personal data.
• Inside the app, and on the pages and documents members share, we do not use advertising, analytics tools, tracking pixels or tracking cookies. Our public website uses analytics and advertising cookies and pixels only if you allow them (section 14).
• We do not use your business data or the details of the people you work with for anything other than providing the service to you.

7. Who receives data

• People in your business, according to the role the Owner gives them.
• People you share links and documents with. They see what that page or document shows (section 10).
• Our service providers, listed in section 8, only for the work they do for us.
• Authorities, when the law requires it, or to protect the rights and safety of Trackapp, our members or others.
• A buyer of Trackapp, if the business is sold or merged. We will tell you before your data is handled under a different privacy policy.

8. Our service providers (current list)

This is the only place in our legal pages that names our service providers. We update this list when we add or change one.

• Supabase

  What it does for us: Database, sign in, file storage and server functions

  What it receives: All account and business data and uploaded files; for sign in, IP address and device details

  Where: Database in Mumbai, India

• Vercel

  What it does for us: Hosts the website and the pages and documents you share

  What it receives: The data shown on those pages, and visitors’ IP addresses

  Where: United States, with servers worldwide

• Anthropic

  What it does for us: Reads pictures, files and what you type or say to Trackapp, to fill in records for you to check and to work out which search, figure, help answer or message your request needs

  What it receives: The pictures you choose to read, trade licence copies, and small parts of imported files (headings, sheet names, a few sample rows and short text); for chat screenshots, your own name, phone number and email; when these features are offered, what you type or say to Trackapp, as text. Under Anthropic’s commercial terms, this data is not used to train its AI models

  Where: United States

• OpenAI

  What it does for us: Turns voice notes into text, when this feature is offered

  What it receives: The voice notes you record, only to turn them into text. Under OpenAI’s API terms, this data is not used to train its models, and OpenAI does not keep the recording after turning it into text

  Where: United States

• Resend

  What it does for us: Sends email

  What it receives: The recipient’s email address, name and the email’s content: account and sign in emails, team invites, billing emails to the Owner, and automatic reminders. Reminders include the client’s name, the order and a link to it, the amount owed, the due date, your business name and your reply address

  Where: United States

• Stripe

  What it does for us: Takes payments for plans

  What it receives: Card details, typed into Stripe’s own secure fields or given through Apple Pay, which go straight to Stripe and never reach our servers; the name on the card, your email address, your business name (shown on your invoices), the plan and amount, and your IP address and browser details, which it uses to prevent fraud. Stripe keeps the invoices. If you pay with Apple Pay, Apple also handles the payment under its own terms

  Where: United States and other countries

• Cloudflare Turnstile

  What it does for us: Checks that a person, not a bot, is signing in or changing account security

  What it receives: IP address and basic browser details

  Where: Worldwide

• Google

  What it does for us: Sign in with Google, if you choose it

  What it receives: What is needed to sign you in

  Where: Worldwide

• GitHub

  What it does for us: Keeps our encrypted daily backups of the database and the uploaded files for 30 days

  What it receives: An encrypted copy of the database, without sign in sessions, and of the uploaded files

  Where: United States

• Exchange rate services (ExchangeRate API, and European Central Bank rates through Frankfurter)

  What it does for us: Currency rates

  What it receives: No personal or business data; they see only our server’s address

  Where: Not applicable

• Google (Google Tag Manager, Google Analytics and Google Ads)

  What it does for us: Measure visits to our public website, and how our adverts on Google perform, only for visitors who allow Analytics or Advertising there (section 14)

  What it receives: For those visitors: the pages they open on our website, the website or advert they came from, the buttons they tap there, IP address, device and browser details, and the codes stored in its cookies. Never anything from inside the app or from shared pages and documents

  Where: United States and other countries

• Meta (Instagram and Facebook)

  What it does for us: Measure how our adverts on Instagram and Facebook perform, only for website visitors who allow Advertising (section 14)

  What it receives: For those visitors: the pages they open on our website, the website or advert they came from, the buttons they tap there, IP address, device and browser details, and the codes stored in its cookies. Never anything from inside the app or from shared pages and documents

  Where: United States and other countries

• TikTok

  What it does for us: Measure how our adverts on TikTok perform, only for website visitors who allow Advertising (section 14)

  What it receives: For those visitors: the pages they open on our website, the website or advert they came from, the buttons they tap there, IP address, device and browser details, and the codes stored in its cookies. Never anything from inside the app or from shared pages and documents

  Where: United States and other countries

• Snap (Snapchat)

  What it does for us: Measure how our adverts on Snapchat perform, only for website visitors who allow Advertising (section 14)

  What it receives: For those visitors: the pages they open on our website, the website or advert they came from, the buttons they tap there, IP address, device and browser details, and the codes stored in its cookies. Never anything from inside the app or from shared pages and documents

  Where: United States and other countries

9. Data stored outside the UAE

Because of these providers, your data and the data you add are stored and handled outside the UAE, including in India and the United States. Each provider handles data under its own terms and data protection commitments.

10. Shared pages and documents

• What they show: each page or document shows what that document needs, such as your business name, logo and contact details, the items, totals, payments and delivery details. Some, such as receipts and statements, show only the client’s first name. Others, such as invoices, purchase confirmations and consignment agreements, show the person’s full name and the details that document needs. A signed consignment agreement shows both signatures, the consignor’s contact details and ID number, and the signing records listed in section 4. Once both sides have signed, the agreement’s web page shows only the last four digits of the ID number; the PDF shows it in full.
• How links are protected: each link uses a long code that cannot be guessed. You can switch a link off at any time. Some links can also have a PIN and an end date, and repeated wrong PINs lock the link for a while. A signed consignment agreement’s link stays open for 30 days after signing, and the business can share it again for another 30 days.
• Who can open a link: anyone who has it, so share it only with the right person.
• When a page is opened: Trackapp records when a page or document you shared is opened, and how many times. This covers every kind of shared page, such as order pages, statements, receipts, invoices, purchase confirmations and agreements. People in your business who can see that record are told, for example “Sara opened your statement”. They see it in the app and, if they turn them on, as instant notifications on their phone or computer. The name shown is the client or consignor the page was made for. Anyone with the link can open it, so the record says only that the page was opened, not who opened it. Instant notifications are delivered through the notification service of that phone or computer, can show the name on its screen, and can be turned off at any time.
• Service status pages: when this feature is offered, you can share a status page for an item a client left with you for service. It shows your business name, logo and contact details, the item, its ticket number and what is being done, the condition you noted when you received it and what came with it (unless you hide them), the dates of each stage and the expected ready date, and, when a price is recorded and you do not hide it, the price, what has been paid and what is left to pay. It never shows the name or cost of a workshop or other business you send the item to, the serial or reference number, your team’s notes, or photos you have not chosen to show. Opens are recorded as for every shared page. The link stops working when you switch it off, and at the latest 90 days after the item is collected.
• If the seller adds a payment link, their pages and documents show it. Opening it takes you to the seller’s payment provider, whose own privacy policy applies. Trackapp does not tell the provider which page you came from and does not see your payment details.
• Logos and profile photos are stored in a public place so they can appear on these pages. Anyone who has the exact address of the image can view it.

11. Emails and messages to the people you work with

• Automatic reminder emails stay off until you turn them on and confirm that your clients have agreed to receive them.
• They are sent from our email address in your business’s name. Replies go to your business.
• Every reminder email has a link the client can use to stop those reminders.
• You can turn reminders off for a client, for an order or for the whole business.
• Trackapp does not send WhatsApp messages. It can open WhatsApp on your own phone, or your own email app, with the text filled in; you decide whether to send it, from your own account, and WhatsApp’s or your email provider’s own terms apply.

12. Files, imports and downloads

• Spreadsheet and text files you import are opened on your device. Only the small parts described in section 8 go to the reading service.
• Downloads of your data are made on your device.
• Before most photos and every copy of a trade licence are uploaded, your device saves a fresh copy, which removes hidden location details. For a licence sent as a PDF, the fresh copy removes the document’s hidden details, but a picture inside the PDF can keep its own.

13. On your device

• Inside the app, Trackapp does not set cookies of its own. Our public website uses cookies only if you allow them (section 14).
• On the card form, Stripe sets its own cookies, which it uses to prevent fraud.
• Trackapp uses your browser’s storage to keep you signed in, remember which business is open, and keep small preferences.
• The installed home screen app keeps only the app itself, never your records.
• Signing out removes what Trackapp saved on that device for your account.
• Voice notes, when this feature is offered, use your device’s microphone only while you record, and only after your device asks for your permission. Recordings are not saved on your device.

14. Cookies and analytics on our website

Our public website is the home page and the Terms, Privacy, Refund and Security pages at trackapp.ae. This section is only about those pages.

• Only if you allow it. When you first open our website, a banner offers Accept all, Decline and Choose. Until you choose, our website loads no analytics or advertising tool, sets no cookies for them and sends nothing to their providers. If you tap Decline, it stays that way.
• Never in the app or on shared documents. These tools are never used inside the Trackapp app, on the sign in and sign up pages, or on any page or document a member shares, such as order pages, invoices, receipts, statements, quotes, status pages and consignment agreements. They are also not used while you are signed in to Trackapp on that device.
• Necessary. Always on. Our website saves your choice in your browser’s storage on that device, so it does not ask again. This sets no tracking cookies and sends nothing to anyone.
• Analytics. Only if you allow it. Google Analytics sets cookies (such as _ga) to count visits and show how people use our website: which pages they open and for how long, the website or advert they came from, their type of device and browser, and their approximate location, worked out from their IP address. We look at this as totals and trends.
• Advertising. Only if you allow it. Tools from Google (Google Ads), Meta (for Instagram and Facebook), TikTok and Snap (for Snapchat) set cookies (such as _gcl_au, _fbp, _ttp and _scid) to measure how well our adverts on those platforms work: for example, how many people who saw or tapped one came to our website, what they looked at, and whether they tapped Start free trial. Each provider can also use this to show our adverts to people who have visited our website, and if you have an account with that provider, it may connect your visit to that account.
• Google Tag Manager loads the tools you allowed, and only once you have allowed at least one. It passes your choices on to them, so a tool you did not allow does not run. It does not set cookies itself, but your browser contacts Google to load it, which gives Google your IP address and basic browser details.
• What the providers receive. For the tools you allowed: the pages you open on our website, the website or advert you came from, the buttons you tap there, your IP address, device and browser details, and the codes stored in their cookies. Never anything from inside the app or from shared pages and documents.
• The providers. Each provider handles this data under its own terms and privacy policy, and may handle it in the United States and other countries: Google at policies.google.com/privacy, Meta at facebook.com/privacy/policy, TikTok at tiktok.com/legal and Snap at values.snap.com/privacy.
• How long. Google Analytics cookies last up to 2 years, and advertising cookies up to 13 months, unless you delete them sooner.
• Changing your choice. Use the Cookie settings link at the bottom of any page on our website, at any time, and switch Analytics or Advertising on or off. A change applies straight away. If you switch a category off, our website removes the cookies of that category it can reach and reloads the page, so those tools stop at once. Cookies a provider keeps on its own website can be deleted in your browser’s settings.

15. How long we keep data

• Your account and business data: for as long as your account and business exist.
• Deleted records: most deleted records, such as clients, sales, purchases and consigned items, go to Recently deleted, where you can restore them for 30 days. After that, or sooner if you choose to delete them for good, they are permanently deleted, and their photos are removed from storage the next time someone in that business opens the app. Some smaller entries that you delete, such as a single payment line, are hidden and kept until the record they belong to is permanently deleted.
• Activity history and the history of payment records: kept for as long as the business exists, so it has a reliable record of its money. When a client is permanently deleted, their name and contact details are removed from the activity history.
• Signed consignment agreements: kept for as long as the business exists, even if the consignor’s other records are deleted, because both sides may need proof of what was signed. An agreement that both sides signed cannot be deleted on its own.
• Deleting a business: all of its data and files, including signed agreements, are deleted straight away.
• Deleting your account: you confirm it with your password or a fresh sign in, plus your code if you use two step sign in. Businesses that only you belong to are deleted with all their files. If other people belong to a business you own, you first hand it over or delete it. Records you added to other people’s businesses belong to those businesses and stay there, with your name in their history. If you have a paid plan, it is cancelled straight away. We email you to confirm the deletion.
• After you delete your account: we keep a coded fingerprint of your email address (never the address itself), with a note of whether a bill was left unpaid and whether a founding price had ended. We keep it only so the free trial and the founding price are used once.
• Accounts that never pay: if an account stays read only without a paid plan for 12 months, we email the account Owner before we take any further step with its data.
• Backups: an encrypted copy of the database and of the uploaded files is made daily and deleted after 30 days. Deleted data and files can stay in a backup for up to 30 days and are used only to recover from a failure.
• Service records: counts of repeated tries are deleted after a short time. Counts of feature use and records of emails sent are kept while the account exists. Our providers keep their own technical logs for a short time under their own policies.
• Invoices and payment records are kept by our payment provider under its own policies, and for as long as the law requires, also after an account is deleted.
• Legal records: we may keep the minimum records the law requires.

16. Your rights, and the rights of the people you work with

• What you can ask for: to see your personal data, correct it, delete it, receive a copy in a common format, object to or limit how we use it, and withdraw consent you gave.
• In the app: you can change your details, download your data and delete your account yourself.
• Anything else: email privacy@trackapp.ae from the email address on your account. We may ask you to confirm who you are.
• Our response: within 30 days, free of charge.
• If you are a client, consignor or someone else a member works with: please contact that member first, because they decide what is stored about you. If you cannot reach them, or need help, email privacy@trackapp.ae. We will pass your request to the member and help them answer it. You can also stop reminder emails with the link in any reminder.
• Complaints: you may also complain to your data protection authority. In the UAE that is the UAE Data Office, in the United Kingdom the ICO, and in the European Union your local authority.

17. Security

Data is encrypted in transit and, by our providers, at rest. Each business is kept separate from every other business in the database, and each person can reach only what their role allows. Two step sign in is available. Shared links use codes that cannot be guessed, repeated tries are limited, and automated checks guard sign in. Card details never reach our servers. We run automated security checks when we change the app, and backups are encrypted. Our team can access data when needed to run, support and protect the service, so we do not claim that your data is invisible to us. No system is perfectly secure. If a security problem affects your data, we will tell you and the authorities as the law requires. Report concerns to security@trackapp.ae.

18. Age

Trackapp is for people aged 18 or older.

19. Changes to this policy

We update the date at the top when this policy changes. For important changes, we tell you by email or in the app before they take effect.