Effective 18 September 2026 · Version 1.1
The short version. We store the minimum needed to run an account: your email, your API keys and a count of how many stops you have used. We do not store the route data you submit — stops and addresses are processed in memory to compute your plan and are gone once the response is returned. We never see your card details, we do not sell data, and we do not use your data to train models.
iRoutify is operated by Alexei Corduneanu, sole proprietor, Republic of Moldova, contactable at alexei@iroutify.com. We are the data controller for your account data.
For the stop lists and addresses you submit to be optimized, we act as a data processor on your behalf: you decide what to submit and why, and we process it only to return your result.
| Category | What | Where from |
|---|---|---|
| Account | Email address, display name, account identifier | You, or your Google account if you sign in with Google |
| Credentials | API keys issued to you, and their scopes | Generated by us |
| Usage | Number of stops submitted, requests made, plan and remaining allowance | Generated by the Service |
| Billing | Plan, subscription status and a payment reference | Lemon Squeezy — not your card number |
| Technical | IP address, timestamps and error diagnostics in server logs | Automatically, to operate and secure the Service |
| Website analytics | On our public website only: which pages were viewed, the referring site, approximate country, device type and page-load timing. Aggregate; no cookies and no profile of you | Cloudflare Web Analytics, when you visit iroutify.com |
| Correspondence | Emails you send us | You |
Route data is not retained. The stops, addresses, coordinates, vehicles and constraints you send to the optimization API are held in memory only for as long as it takes to compute your plan, and are not written to a database. Once the response is returned they are gone. There is no stored history of your plans to browse, export or breach.
Practical consequences you should know about:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; return your route plans | Performance of a contract |
| Take payment, meter usage, enforce allowances | Performance of a contract |
| Keep the Service secure, prevent abuse and rate-limit | Legitimate interests |
| Diagnose faults and improve reliability | Legitimate interests |
| Answer your emails | Legitimate interests |
| Keep tax and accounting records | Legal obligation |
| Send product or marketing email, if you opt in | Consent — withdrawable at any time |
We do not carry out automated decision-making that produces legal or similarly significant effects about individuals.
We do not sell personal data. We share it only with the processors needed to run the Service:
| Provider | Purpose | What it sees |
|---|---|---|
| Microsoft Azure | Hosting and storage | Account data, usage counters, server logs |
| Lemon Squeezy | Payments, as Merchant of Record; invoicing and tax | Your billing details, which you give to them directly |
| Optional "Sign in with Google" | Confirms your identity and returns your email | |
| Cloudflare | Website analytics for iroutify.com | Aggregate page views, referrer, approximate country and device type - not your account, and not the stops you submit |
| Road-routing provider | Only if you enable road-distance mode | The coordinates of that request — see below |
Road-distance mode sends coordinates to a third party. By default iRoutify computes on straight-line geometry and your coordinates never leave our infrastructure. If you explicitly enable road-distance mode, the coordinates of that request are sent to an external routing provider to obtain road distances and geometry. Do not enable it for data you are not willing to disclose to a third-party routing service.
We may also disclose data where legally required, or to establish or defend legal claims.
We operate from the Republic of Moldova. Since 23 August 2026 Moldova applies Law No. 195/2024 on personal data protection, which transposes the GDPR into national law.
The European Commission has not adopted an adequacy decision for Moldova. Where you are in the EEA or the UK and personal data is transferred to us, that transfer is therefore made under the European Commission's Standard Contractual Clauses, which form part of the Data Processing Agreement we will sign with you on request.
Our infrastructure providers may process data in the European Union or the United States, under Standard Contractual Clauses or an applicable adequacy framework in their own agreements with us.
Subject to applicable law, you may request to access, correct, delete, export (portability) or restrict processing of your personal data, and you may object to processing based on legitimate interests or withdraw consent at any time.
Email alexei@iroutify.com and we will respond within 30 days. There is no charge. You also have the right to complain to your local data protection authority.
Because we do not retain route data, an access or deletion request about the contents of a past optimization cannot be fulfilled — there is nothing held to disclose or erase.
No system is perfectly secure. If we become aware of a personal-data breach affecting you we will notify you and any relevant authority as the law requires. If you believe you have found a vulnerability, please report it to alexei@iroutify.com; we will not pursue good-faith security research that respects section 7 of the Terms.
We use only what the Service needs to work: a session cookie or token to keep you signed in, and local browser storage for preferences such as whether you have seen the product tour. We do not use advertising cookies and we do not track you across other websites.
Our public website uses Cloudflare Web Analytics, which is cookieless: it counts page views without storing anything on your device and without following you to other sites. It runs on iroutify.com only - never inside the application - and it is skipped entirely if your browser sends Do Not Track or Global Privacy Control.
The Service is for business use and is not directed at children under 16. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.
We may update this policy. Material changes will be notified by email to your account address at least 30 days before they take effect, and the version and date above will change.
Alexei Corduneanu · iRoutify
Email: alexei@iroutify.com
If you need a Data Processing Agreement for your own compliance file, email us and we will provide one.