Privacy Policy
Last updated 5 October 2026
Our websites at onroute.io and onrouteintelligence.ai (our website) are provided by Onroute Intelligence Inc. (we, our or us), a corporation incorporated in the State of Delaware, USA, whose registered office is at 251 Little Falls Drive, Wilmington, Delaware 19808, USA.
We are the controller of the personal data collected through our website, meaning we are the organisation legally responsible for deciding how and why it is used. This policy explains what we collect, why, who we share it with, how long we keep it, your rights, and how to contact us or a regulator if you have a complaint.
Because we offer our services to people in the United Kingdom, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 for the personal data described here. Where we offer services to people in the European Economic Area (EEA), the EU GDPR applies in the same way.
Given the nature of our website, we do not expect to collect the personal data of anyone under 13. If you believe a child's personal data has been sent to us, tell us and we will delete it.
This policy is divided into the following sections:
- What this policy applies to
- Personal data we collect on our website
- How and why we use it
- Marketing
- Who we share your personal data with
- How long we keep it
- Transfers out of the UK and EEA
- Cookies
- The Onroute Intelligence mobile app
- Onroute Intelligence as a processor for installers
- Your rights
- Keeping your personal data secure
- How to complain
- Changes to this policy
- How to contact us
What this policy applies to
This policy covers three things:
- Our website: what we collect when you visit, ask for a demonstration, or leave your details on a whitepaper page.
- The Onroute Intelligence mobile app, used by engineers in the field. The section 'The Onroute Intelligence mobile app' explains what applies to it.
- The Onroute Intelligence product used by installation businesses. There we are usually a processor acting on the installer's instructions, not the controller. The section 'Onroute Intelligence as a processor for installers' explains what that means for you.
The privacy notice for our customer portal at onr.to, which an installer's customers use to answer survey questions, send photographs and pay, is being updated. Until the updated notice is published, you can ask us about the portal using the details under 'How to contact us'.
Personal data we collect on our website
Our website has no visitor accounts and no sign-in. Apart from the request logs described below, we collect personal data only when you give it to us:
- When you request a demonstration: your name, company, email address, telephone number (optional), how many engineers you have on the road, what your business installs, and any message you add.
- When you leave your details on a whitepaper page, to sign the sheet or to download its PDF: your email address, your name where the form asks for it, and which paper you were reading.
- When you email or write to us: whatever you choose to include.
Like any website, our pages are served by a hosting provider, and each request to them is logged. The log records your IP address, the page you asked for and details of your browser. Our website is hosted by Vercel, in the United States, and Vercel sends these request logs to our log service, Axiom, in Frankfurt, Germany.
There are no analytics cookies, no advertising pixels and no tracking scripts on our website. See 'Cookies' below.
How and why we use it
Under data protection law we may only use your personal data where we have a proper reason. The reasons we rely on are set out below.
| What we use your personal data for | Our reason |
|---|---|
| Responding to a demonstration request and talking with you about Onroute Intelligence | To take steps at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in following up an enquiry you made (Article 6(1)(f)) |
| Sending you the next whitepaper in the series, because you asked for it | Your consent (Article 6(1)(a)). You can withdraw it at any time with the link in every email we send you, or by emailing us |
| Serving our website and keeping it working and secure, which is what the request logs are for | Our legitimate interest in operating and protecting our website (Article 6(1)(f)) |
| Replying to your emails and other messages | Our legitimate interest in answering the people who contact us (Article 6(1)(f)) |
| Keeping records we are legally required to keep, and complying with lawful requests from regulators, courts or law enforcement | To comply with our legal obligations (Article 6(1)(c)) |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our business and rights (Article 6(1)(f)), or to comply with a legal obligation (Article 6(1)(c)) |
| Sharing information with advisers, and with a buyer or investor and their advisers, in connection with a sale, merger, financing or restructuring of our business | Our legitimate interest in running and, if we choose, selling or financing our business (Article 6(1)(f)). Information is anonymised where that is possible and shared only where necessary |
A legitimate interest is a business reason for using your personal data that is not overridden by your own rights and interests. Where we rely on one, we have weighed it against your interests. You can ask us about that assessment using the details under 'How to contact us'.
We do not make decisions about you based solely on automated processing.
Marketing
We do not send marketing to people who have not asked for it.
If you leave your details on a whitepaper page, to sign the sheet or to download its PDF, your email address, and your name where you gave it, are added to our whitepaper mailing list, which our email delivery provider, Resend, holds for us, and your details and the paper you were reading are sent to our support mailbox. We use them only to send you new papers in that series, and for a walk through Onroute Intelligence if you ask for one. We send nothing else to you. To stop, use the link in any email we send you, or email support@onroute.io and we will take you off the list.
If you request a demonstration, we use your details to arrange it and to follow up that conversation. You can tell us to stop at any time.
We do not sell personal data, and we do not share it with other organisations for their marketing.
Who we share your personal data with
We share personal data collected on our website with:
- Our email delivery provider, Resend. A demonstration request, a whitepaper sign-up or a PDF download is sent to us as an email through Resend, and Resend holds our whitepaper mailing list, with the names and addresses on it, and sends the papers to it. Resend is a company based in the United States.
- Google, which provides our email through Google Workspace. Demonstration requests, whitepaper sign-ups, PDF downloads and the emails you send us are held in our support@onroute.io mailbox. Google is a company based in the United States.
- Our website host, Vercel, whose servers in the United States handle requests to our pages and log them.
- Our log service, Axiom, which stores the request logs from our website in Frankfurt, Germany.
These providers are also listed under 'Website' on our Trust and Compliance page.
We only allow a provider to handle your personal data if we are satisfied it protects it appropriately.
Occasionally we may also share personal data with:
- our professional advisers (such as lawyers and accountants), who are bound by confidentiality
- law enforcement agencies, courts, tribunals and regulators, to comply with our legal obligations
- a party that acquires or invests in our business, and their advisers, as described in the table above
How long we keep it
We keep personal data only for as long as we need it for the purpose we collected it for.
- Demonstration requests: we intend to keep them only while we are in contact with you about Onroute Intelligence, and then to delete them.
- Whitepaper sign-ups and PDF downloads stay on our whitepaper mailing list until you unsubscribe, with the link in any email we send you or by emailing support@onroute.io. After that your address and name are kept on the list only as unsubscribed, so that nothing more is sent to you. The notice of your sign-up or download stays in our support mailbox until you ask us to remove it. When you email support@onroute.io asking us to remove your details, we remove them from both.
- Correspondence: we intend to keep it only for as long as we need it to answer you and to deal with any question that follows from it.
- Request logs are kept by our host and our log service. The period they are kept for is being confirmed.
Where a longer period is required by law, or is needed to establish, exercise or defend a legal claim, we keep the data for that period.
For data we process for an installer as their processor, retention is set by the installer and by our Subscription Terms: during the subscription and for 30 days after it ends, the installer can export its data; after that we may delete it.
Transfers out of the UK and EEA
We are a United States company. Personal data you send us through our website is sent to us through providers based in the United States (Resend and Google), our website is hosted in the United States by Vercel, and some of our providers process personal data there.
Where we transfer personal data out of the UK or EEA to a country that has not been found to give adequate protection, we rely on a recognised safeguard where one is required: the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or, where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework and the transfer is covered by it, that framework.
For data we process for installers, the safeguards are set out in our Data Processing Addendum, which incorporates the IDTA. Where each of our sub-processors processes data is listed on our Trust and Compliance page, or marked there as being confirmed.
You can ask us for a copy of the safeguard that applies to a particular transfer using the details under 'How to contact us'.
Cookies
Our website sets no cookies. The only thing it stores in your browser is your choice of light or dark reading mode on the whitepaper pages, which is kept on your own device and never sent to us. Our Cookie Policy has the detail.
The Onroute Intelligence mobile app
The app is a work tool for engineers. You use it with an account that belongs to the company you work for. That company decides what job information is recorded and why, so it is the controller of that information and we act as its processor. We remain responsible for the account and technical data described here.
The app collects:
- Account data: the email address you sign in with (or your Google identity if you sign in that way), and the user and device identifiers we use to keep your session secure. When your device is registered, its name (for example "Sam's iPhone") is sent to us.
- Precise location, at one moment only: when a signature is captured, the app takes a single location reading so the record shows where the work was signed off. The app does not track your location in the background, and declining the location permission does not stop you capturing signatures or using any other part of the app.
- Photographs and camera access: photographs you take, images you choose to attach from your photo library, and the camera view used to scan QR codes. The app uses the camera and photo library only when you ask it to. Photographs are resized on the device before upload.
- Other content you record: notes, form and checklist answers, test results and customer signatures.
- Diagnostics: crash reports and performance data, sent to our error-reporting provider, Sentry, in Germany. We configure this so that your identity is not attached to reports, and messages that could contain personal data are removed before sending.
The app contains no advertising or analytics software, and it does not track you across other companies' apps or websites.
The app is designed to work offline. Work you record on site is kept on the device and sent to our servers when a connection returns. The sign-in session, cached jobs, and queued notes, form answers and signature details are encrypted with keys held in the device's keychain. Queued photographs, signature images and cached documents are kept as files in the app's private storage, under the device's own encryption. The queue of unsent work is deleted when you sign out. On Android, the app's data is excluded from device backup.
You can withdraw the camera, photo library and location permissions at any time in your device settings. To ask about information recorded through the app, or to exercise any of the rights below, contact us using the details at the end of this policy. Where the information belongs to jobs recorded for your employer, we will pass your request to them as controller.
Onroute Intelligence as a processor for installers
Installation businesses use Onroute Intelligence to run their jobs, and in doing so they record information about their own customers: names, addresses, phone numbers, emails, messages, photographs of properties, certificates and signatures. For that information the installer is the controller and we are its processor. We act on the installer's instructions under our Data Processing Addendum.
If you are an installer's customer and want to know what is held about you, or want it corrected or deleted, ask the installer. If you contact us directly we will pass your request to them.
The Data Processing Addendum, our list of sub-processors (the companies that help us provide the service and where they process data), and the security measures we have in place are published on our Trust and Compliance page.
Your rights
You have the following rights, which you can usually exercise free of charge:
| Right | What it means |
|---|---|
| Access | To be given a copy of your personal data |
| Correction (rectification) | To have mistakes in your personal data corrected |
| Erasure (the right to be forgotten) | To have your personal data deleted, in certain situations |
| Restriction | To have us restrict our use of your personal data in certain circumstances, for example while you contest its accuracy |
| Data portability | To receive the personal data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another organisation, in certain situations |
| Objection | To object at any time to your personal data being used for direct marketing, and in certain other situations to our continued use of it where we rely on a legitimate interest |
| Automated decisions | Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions |
| Withdrawing consent | Where we rely on your consent, to withdraw it at any time. Withdrawing consent does not affect what we did lawfully before you withdrew it |
To exercise any of these rights, contact us using the details below. Please give us enough information to identify you, and tell us which right you want to exercise and what information it relates to. The UK Information Commissioner's guidance on your rights is at ico.org.uk.
If you live in a country or state with its own privacy law that gives you further rights, contact us and we will honour them where they apply to us.
Keeping your personal data secure
We have technical and organisational measures in place to prevent personal data from being lost, or used or accessed without authority, and we limit access to the people who need it. What those measures are, in plain terms, is published on our Trust and Compliance page. We do not hold a security certification such as ISO 27001 or SOC 2, and we do not claim one.
Where the law requires it, we will notify you and the relevant regulator of a personal data breach.
How to complain
If you have a concern about how we use your personal data, contact us first (see 'How to contact us'). We hope to resolve it with you.
You also have the right to complain to a supervisory authority:
- In the UK, the Information Commissioner's Office: https://ico.org.uk/make-a-complaint, telephone 0303 123 1113.
- In the EEA, the authority in the country where you live, work, or where the alleged infringement took place. The list is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
Changes to this policy
When we change this policy we will publish the new version on this page and update the date at the top. Where a change is significant and we have a way to reach you, we will also tell you directly.
How to contact us
Onroute Intelligence Inc.
251 Little Falls Drive
Wilmington, Delaware 19808
USA
Data protection contact: support@onroute.io
Write to us at that address for any question about this policy or the information we hold about you, to exercise a right, or to make a complaint.