This Privacy Policy explains how Circle Routes Route Planner, trading as Circle Routes, collects, uses, stores, shares and protects personal data when you use:
- the Circle Routes website;
- the route-planning and optimization platform;
- the dispatch dashboard;
- the Circle Routes driver application;
- customer delivery-tracking pages;
- client and shipper portals (including dedicated workspace subdomains);
- APIs, webhooks and integrations;
- customer support services; and
- related products and services.
In this Privacy Policy, “Circle Routes”, “we”, “us” and “our” refer to Circle Routes Route Planner, a company established in Ajman Free Zone, United Arab Emirates.
1. Who this policy applies to
This Privacy Policy may apply to:
- representatives and employees of our business customers;
- platform administrators and users;
- drivers and delivery personnel;
- delivery recipients;
- website visitors;
- prospective customers;
- suppliers and business partners; and
- people who contact our support or sales teams.
Circle Routes is primarily a business-to-business software provider serving customers globally, with particular focus on operations in the Gulf region and the United Arab Emirates.
When a customer uploads delivery, recipient or driver information to Circle Routes, the customer generally decides why and how that information is used. In that situation:
- the customer generally acts as the data controller or responsible organisation; and
- Circle Routes generally acts as a processor or service provider on the customer’s instructions.
For information we collect directly for account management, billing, website operation, sales, security or our own business administration, Circle Routes may act as the controller.
Where required by applicable law or requested by a customer, the parties may enter into a separate Data Processing Addendum (“DPA”). Customers who need a DPA may request one at support@circleroutes.ae.
2. Personal data we collect
Depending on how you interact with Circle Routes, we may collect the following categories of information.
2.1 Account and business information
This may include:
- name;
- company name;
- job title;
- work email address;
- telephone number;
- account username;
- user role and permissions;
- billing address;
- subscription information;
- invoice and transaction information; and
- communications with our sales or account-management teams.
2.2 Delivery and recipient information
Our customers may upload or submit:
- recipient name;
- delivery address;
- map coordinates;
- telephone number;
- email address;
- delivery date and time window;
- order or reference number;
- package information;
- delivery notes and access instructions;
- delivery status;
- recipient feedback and delivery-survey responses;
- details of failed or rescheduled deliveries;
- collection or pickup details, where the customer uses those workflows; and
- cash-on-delivery amounts, currencies, collection status and related notes entered by the customer or driver.
Circle Routes records COD information only as operational data for the customer. Circle Routes does not collect cash from recipients and does not receive COD funds.
Customers should avoid including sensitive or unnecessary personal information in free-text delivery instructions.
2.3 Driver and vehicle information
We may process:
- driver name;
- telephone number;
- email address;
- employee or driver identifier;
- assigned route;
- shift, availability and overtime records entered by the customer;
- vehicle identifier, vehicle type and licence plate, where provided;
- driving-licence expiry dates, where the customer records them;
- device information;
- live or historical location information;
- route progress;
- stop arrival and completion times;
- scanning activity;
- proof-of-delivery activity; and
- driver performance information generated through the platform.
Location is personal data where it can identify or relate to a person.
2.4 Proof-of-delivery information
Depending on the customer’s configuration, we may process:
- delivery photographs;
- package photographs;
- recipient signatures;
- delivery notes;
- delivery timestamps;
- GPS coordinates;
- barcode or package scan records;
- recipient names;
- failed-delivery reasons; and
- other evidence submitted by a driver.
Customers are responsible for configuring and using proof-of-delivery features appropriately and for giving recipients any legally required notices.
2.5 Device and technical information
We may automatically collect:
- IP address;
- browser type;
- operating system;
- device model;
- device identifiers;
- application version;
- language;
- time zone;
- login times;
- pages or features used;
- crash reports;
- diagnostic logs;
- API activity;
- security events; and
- approximate location derived from an IP address.
2.6 Precise location information
The driver application may collect precise device location when the driver enables location permissions on their device.
Location may be collected while a route is active, including when the application is in the background, if the driver has granted the relevant device permission. It may also be collected while the driver is using the application, or when needed to update route progress and customer tracking.
Location information may be used to:
- display route progress;
- provide navigation support;
- calculate or update ETAs;
- confirm arrival at a stop;
- support dispatch operations;
- display a delivery vehicle’s approximate position on tracking pages;
- analyse operational performance;
- investigate delivery issues; and
- improve route and ETA calculations.
Customers are responsible for ensuring drivers understand device permissions and applicable workplace policies.
2.7 Website, cookies and analytics information
When you visit our marketing website, we may collect information through cookies and similar technologies, including:
- pages visited;
- referring website;
- time spent on pages;
- interactions with website features;
- device and browser information;
- approximate location;
- campaign or referral information.
More information is provided in Section 12.
2.8 Communications and support information
When you contact us, we may collect:
- your name and contact details;
- the content of your request;
- screenshots or files you provide;
- support-ticket history;
- in-app driver-support messages and attachments between drivers and the customer’s dispatch team;
- records when a driver opens WhatsApp from the driver application, including the template and pre-filled message text; and
- technical information needed to investigate an issue.
Please avoid sending personal data that is not necessary for us to assist you.
2.9 Information from integrations
Where a customer connects Circle Routes to another service, we may receive information from:
- e-commerce platforms;
- customer order-management systems;
- warehouse systems;
- spreadsheets;
- mapping and geocoding services;
- automation platforms;
- customer APIs; and
- other authorised integrations.
The information received depends on the integration and the permissions selected by the customer.
3. How we collect personal data
We may collect personal data:
- directly from you;
- from the organisation you work for;
- from a Circle Routes customer arranging a delivery;
- from a driver or dispatcher;
- through the Circle Routes platform or driver application;
- through customer tracking pages;
- through cookies and analytics tools on our website;
- from connected third-party services; and
- through communications with our sales or support teams.
4. Why we use personal data
We may use personal data for the following purposes.
4.1 Providing the service
This includes:
- creating and administering accounts;
- importing and managing delivery orders;
- planning and optimizing routes;
- assigning routes and stops;
- calculating ETAs;
- displaying route progress;
- supporting warehouse dispatch;
- scanning packages;
- recording proof of delivery;
- providing recipient tracking;
- sending delivery notifications by email and SMS;
- providing WhatsApp message templates that open the driver’s WhatsApp app with pre-filled text;
- recording cash-on-delivery amounts and collection status entered in the Service;
- generating operational reports;
- supporting APIs and integrations; and
- providing technical support.
Circle Routes may send operational notifications configured in the Service by email and SMS when those channels are enabled. Circle Routes does not automatically send WhatsApp messages to recipients. Where enabled, the driver application opens the driver’s WhatsApp app (via a wa.me link) with a pre-filled template message. The driver decides whether to send the message. Circle Routes may log that a driver opened WhatsApp from the app (for example driver, stop, template used and message text) for audit and support purposes.
4.2 Managing customer relationships
We may use personal data to:
- respond to enquiries;
- arrange demonstrations;
- provide onboarding;
- manage subscriptions;
- issue invoices and keep billing records;
- communicate service changes;
- provide customer support; and
- maintain business records.
Subscription fees for self-serve plans are charged by card through Stripe, our payment processor. Stripe may process card details, billing address, and transaction metadata on our behalf. We store subscription status, invoices, and limited payment references (for example last payment amount and invoice links). We do not store full card numbers on Circle Routes servers.
Enterprise customers may pay by invoice / bank transfer when agreed in writing.
Cash collection from delivery recipients remains the customer’s responsibility. Circle Routes does not receive those funds.
4.3 Security and fraud prevention
We may use information to:
- authenticate users;
- detect unauthorised access;
- investigate suspicious activity;
- prevent fraud and abuse;
- protect accounts and systems;
- maintain logs;
- enforce our terms; and
- respond to security incidents.
4.4 Service improvement and analytics
We may analyse product usage and operational information to:
- improve platform features;
- improve route optimization;
- improve travel-time and ETA models;
- understand service performance;
- identify technical errors;
- develop new functionality;
- conduct internal testing; and
- generate anonymised or aggregated statistics.
Where possible, we use aggregated or anonymised information that does not reasonably identify a person.
Circle Routes does not sell identifiable customer data to third parties.
4.5 Legal and regulatory purposes
We may process information to:
- comply with applicable laws;
- respond to lawful government or court requests;
- establish, exercise or defend legal claims;
- maintain accounting and tax records;
- investigate breaches of contract;
- protect the rights and safety of Circle Routes, our customers or third parties; and
- comply with regulatory obligations.
4.6 Marketing
Where permitted by law, we may use business contact information to:
- provide product updates;
- share service information;
- invite prospective customers to demonstrations;
- send relevant marketing communications; and
- measure marketing effectiveness using website analytics tools.
You may unsubscribe from marketing emails at any time through the unsubscribe link or by contacting us.
We do not use delivery-recipient information uploaded by our customers to market Circle Routes directly to those recipients.
Once a customer agreement is in place, Circle Routes may include the customer’s name and logo in customer lists and online marketing materials, subject to the customer’s right to opt out of future marketing use as described in our Terms of Service.
5. Legal grounds for processing
Depending on the circumstances and applicable law, we may process personal data based on:
- consent;
- performance of a contract;
- steps requested before entering a contract;
- compliance with a legal obligation;
- protection of rights or legal claims;
- legitimate business interests where permitted; or
- instructions from a customer acting as controller.
Where processing depends on consent, consent may be withdrawn, although withdrawal does not affect processing that was already lawful.
Our customers are responsible for identifying and documenting the appropriate legal basis for personal data they submit to the Service.
6. Automated route planning
Circle Routes uses algorithms and automated processing to produce:
- route sequences;
- driver or vehicle recommendations;
- estimated arrival times;
- workload distributions;
- performance metrics;
- stop priorities; and
- other operational recommendations.
These outputs support human decision-making. Customers remain responsible for reviewing routes, driver assignments and operational outputs before acting on them.
8. International data transfers
Circle Routes uses cloud, mapping, email, SMS, media-storage, monitoring and analytics service providers located outside the UAE.
As a result, personal data may be stored or processed in countries other than the UAE, including Singapore, the United States and countries in the European Union.
Production systems are primarily hosted in Singapore unless an order form states otherwise.
Where personal data is transferred internationally, we take measures required by applicable law, which may include using contracts that require appropriate privacy and security safeguards, relying on recognised transfer mechanisms, or obtaining consent where legally required.
Customers may contact us for information about the locations or safeguards applicable to their data.
9. Data retention
We retain personal data only for as long as reasonably necessary for the relevant purpose.
Retention depends on:
- the duration of the customer relationship;
- account and product settings;
- contractual requirements;
- the type of information;
- customer instructions;
- legal and regulatory requirements;
- security needs; and
- backup and disaster-recovery processes.
General retention principles:
- Active account information: for the duration of the account. This includes users, drivers, saved customers, depots, zones, settings, templates and branding.
- Customer delivery and operational data: kept for up to 12 months, then deleted. This includes completed routes, orders, tracking links, delivery messages, surveys and related history. Live and in-progress work is not deleted.
- Driver location data: kept for up to 12 months, then deleted.
- Proof-of-delivery records: photographs and signatures are kept for up to 12 months, then deleted.
- Billing and transaction records: for the period required by tax, accounting and legal obligations.
- Payroll and overtime records: for the period required by tax, accounting and labour obligations.
- Support records: in-app driver-support messages and attachments are kept for up to 12 months after the last message, then deleted.
- Security and access logs: kept for up to 12 months.
- Marketing leads and trial data: for a shorter period; trial or promotional data may be deleted if the customer does not convert to a paid subscription.
Export any operational history you need to keep before it ages past 12 months. Circle Routes does not currently offer a full self-service archive of all account data.
After termination: Circle Routes does not provide post-termination access to customer operational data. During an active subscription, customers can export available operational reports and other data the product makes available (for example insights and dispatch reports). If you need help exporting available data, request it while the account is active. After termination, Circle Routes may delete customer data from active systems. Residual copies may remain in encrypted backups for a limited period until overwritten in the ordinary course.
10. Data security
We use reasonable technical and organisational safeguards intended to protect personal data against unauthorised access, unlawful processing, accidental disclosure, alteration, loss, destruction and misuse.
Measures may include:
- access controls and role-based permissions;
- authentication;
- encryption in transit;
- encryption at rest for core application data and backups;
- tenant separation between customers;
- secure hosting;
- logging and monitoring;
- backup procedures;
- vulnerability management;
- employee and contractor confidentiality obligations; and
- incident-response processes.
No internet or electronic-storage system can be guaranteed to be completely secure.
Customers are responsible for securing their user accounts, using strong passwords, controlling user permissions, protecting API keys, maintaining secure devices, removing access from former users and informing us promptly of suspected unauthorised access.
11. Data breaches
Where we become aware of a personal-data breach, we will:
- investigate the incident;
- take reasonable steps to contain and remediate it;
- assess the potential effects;
- notify affected customers where required; and
- notify relevant authorities or individuals where required by applicable law.
Where Circle Routes acts as a processor, we will provide the relevant customer with available information reasonably required for the customer to meet its obligations.
13. Your privacy rights
Depending on applicable law and the circumstances, you may have the right to:
- receive information about how your personal data is processed;
- request access to personal data;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to certain processing, including direct marketing;
- withdraw consent; and
- submit a complaint to the relevant authority.
These rights may be subject to legal exceptions, including where information must be retained for legal claims, security, contractual obligations or regulatory requirements.
14. How to exercise your rights
You may contact us using the information in Section 21.
Please provide:
- your name;
- your contact details;
- your relationship with Circle Routes;
- the relevant customer or delivery, where applicable;
- the right you wish to exercise; and
- enough information for us to locate the relevant data.
We may need to verify your identity before responding.
Where Circle Routes processes information on behalf of a customer, we may forward the request to that customer or ask you to contact the customer directly. The customer may be better placed to handle requests concerning delivery recipient information, driver records, tracking pages, proof-of-delivery records or delivery-history data.
We will not charge a fee for ordinary requests unless permitted by law, such as where a request is manifestly unfounded, excessive or repetitive.
15. Driver location notice
Customers using driver tracking must ensure that drivers receive a clear notice explaining:
- what location information is collected;
- when tracking is active;
- why location is needed;
- who can view it;
- how long it is retained; and
- how the driver may raise a privacy request.
Drivers enable location sharing through their device settings and permissions. Customers are responsible for complying with applicable employment, labour and privacy requirements relating to employee or contractor monitoring.
Circle Routes does not control how a customer uses reports or location information after it is made available through the Service.
16. Delivery recipients
Where you receive a tracking link because a company is delivering an order to you, that company is generally responsible for the delivery and for deciding how your information is used.
Circle Routes provides the software used to support the delivery.
Questions concerning the original order, delivery instructions, cancellation, refund or correction of order information should normally be directed to the company from which you ordered.
You may contact Circle Routes where your concern relates specifically to the operation or security of the Circle Routes Service.
17. Children’s data
Circle Routes is not directed toward children and is intended for business and delivery-management use.
Customers should not intentionally submit children’s personal data unless it is genuinely necessary for a lawful delivery purpose, the customer has an appropriate legal basis, and the information is limited to what is necessary.
We do not knowingly use children’s personal data for Circle Routes marketing.
18. Sensitive personal data
Customers should not upload sensitive personal data unless necessary and legally permitted.
This may include information concerning health, disability, religious beliefs, ethnicity, biometric identifiers, criminal records or other sensitive characteristics.
Where a delivery requires an accessibility, medical or safety instruction, customers should use the minimum information reasonably necessary.
19. Third-party links and services
Our website, tracking pages or platform may contain links to third-party websites, maps, navigation tools or applications.
This Privacy Policy does not govern third-party services. We recommend reviewing the privacy information provided by the relevant third party before using it.
20. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to our services, new features, changes in service providers, legal or regulatory developments, security improvements or changes in our processing practices.
We will publish the revised version and update the “Last updated” date.
Where changes materially affect how we use personal data, we will provide additional notice where required, including notifying active administrators where appropriate.
21. Contact us
For privacy questions or requests, contact:
Email: support@circleroutes.ae Company: Circle Routes Route Planner Address: Ajman Free Zone, United Arab Emirates
Where applicable, you may also submit a complaint to the UAE Data Office or another competent data-protection authority.
Your commercial relationship is outlined in our Terms of Service.