Privacy Policy

Trakto is a GPS tracking platform operated by Trakto Software Ltd, a company registered in England and Wales ("Trakto", "we", "us"). This policy explains how we collect, use and protect personal data when you use the Trakto website at traktomap.com, the Trakto web app, and our mobile apps available on the Apple App Store and Google Play Store — including the Trakto tracking app and the Trakto Events app.

You can contact us about anything in this policy at privacy@trakto.uk, or by post to Trakto Software Ltd, United Kingdom.

The Trakto mobile apps are developed and distributed under licence from Trakto Ltd, which has licensed Trakto Software for app development and distribution. Trakto is a registered trademark.

• The Trakto website and web app (including the mobile web app and the Trakto Events web app).
• The Trakto tracking app for iPhone (App Store) and for Android (Play Store), used to view trackers, history, alerts and settings.
• The Trakto Events app for iPhone (App Store) and for Android (Play Store), used by event attendees to share their name, photo and location with an event they have joined.
• The Trakto customer API used by third-party platforms you connect to your account.

Account information.

When you create an account we collect your name, email address, company name, password (stored only as a secure hash), and your account settings and preferences. If you invite colleagues to your account we hold their names and email addresses too.

Tracker and location data.

The core of the service: we receive positions from your GPS trackers — location, speed, direction, altitude, ignition and battery status, and the date and time. We store this history so you can view past journeys, trips and reports. Tracker names, groups, plates and driver names you add are also stored.

Places, zones, routes and alerts.

Saved places, zones, routes and alert rules are stored on your account, along with a record of the alerts that have fired.

Event attendee data (Trakto Events).

When someone joins an event using an Event Code, we collect the name and role they enter, a photo if they choose to add one, their phone's location while they share it, and their device's push notification token if they allow notifications.

Mobile app and device data.

Our mobile apps collect the device push notification token (so we can send alert notifications through Apple Push Notification service or Firebase Cloud Messaging), the app and device names you may optionally provide, and your sign-in session. If a mobile phone is registered as a tracker, its location is handled as tracker data above.

Payment information.

Subscriptions are handled by our payment provider. We never see or store your full card details; we hold only your subscription plan, status and billing history.

Support and service data.

If you contact us for support we keep your messages. We also keep short technical logs (such as error reports) needed to run and troubleshoot the service.

We use personal data to:

• Provide the tracking service — displaying live and historic positions, journeys, reports, alerts and maps.
• Run events — showing attendees' shared names, photos and locations to the people the event organiser permits.
• Send notifications — alert pushes to your registered phones and, if enabled, Pushover notifications.
• Manage your account, subscriptions and billing.
• Provide support and keep the service secure and working.
• Meet legal obligations, and to prevent abuse of the service.

We do not sell personal data, and we do not use it for third-party advertising.

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) we rely on:

• Contract — to provide the service you have signed up for.
• Legitimate interests — to secure and improve the service, and to prevent misuse.
• Consent — for optional things such as push notifications, a phone sharing its location, or photos added by event attendees.
• Legal obligation — where the law requires us to keep or share information.

Vehicle, plant and worker tracking can involve monitoring people. If you use Trakto to track vehicles or devices used by your employees or contractors, you are responsible for doing so lawfully — this normally means telling them what is tracked and why, and having a lawful basis for it. Guidance is available from the Information Commissioner's Office (ICO). We provide the tools; the decision to track and the notice you give remain yours as the controller of that data.

For data collected through the Trakto Events app and the Trakto Events web app — attendees' names, photos, roles and shared locations — the event organiser is the data controller and Trakto acts as its processor. We process that data only to provide the event features, on the organiser's instructions, and delete it when the organiser removes it or closes the event. Attendees should contact the event organiser for their rights over this data; we will help the organiser respond.

We share personal data only with the companies that help us run the service:

• Our hosting and database provider, which stores account data on servers in the European Union/United Kingdom.
• Our tracking-data provider, which relays positions from your GPS trackers to Trakto.
• Apple and Google, to deliver push notifications to your devices.
• Pushover, if your account chooses Pushover notifications.
• Our payment provider, to process subscriptions.
• Map and satellite imagery providers, to display maps (map imagery is requested by your device).

We may also share data where the law requires it, or to protect the rights and safety of Trakto, our customers or other people.

We keep personal data in the United Kingdom or the European Economic Area wherever we can. Some of the providers above (for example Apple, Google and Pushover) operate outside the UK. When data is sent to them we rely on the UK's approved safeguards, including the UK extension to the EU standard contractual clauses.

Tracker history and account data are kept for as long as your account is active. When an account is deleted, its trackers, devices, users, events and sites are removed with it. Event attendee data is deleted when the organiser removes it or the event is deleted. Push notification tokens are deleted when the app reports them invalid or when you sign out of the app. We may keep billing records for the period UK tax law requires (six years), and short technical logs for a limited period.

Access to the service is over encrypted connections (HTTPS). Passwords are stored only as secure hashes. Tracking-service credentials, encryption keys and payment secrets are held server-side only and are never sent to your device. Account access is protected by role-based permissions, and row-level security restricts each user to the data their account permits.

The website does not use advertising or tracking cookies. We use essential browser storage (localStorage) to keep you signed in and to remember preferences you choose — such as your remembered email on the sign-in page and your map display settings. These are not used to follow you across other websites. You can clear them in your browser settings at any time.

Under UK data protection law you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong.
• Ask us to delete your data (erasure).
• Ask us to limit or object to how we use your data.
• Ask us to move your data to another provider (portability).
• Withdraw consent where we rely on it (for example, push notifications or location sharing).

You can exercise most of these yourself from your account settings, or by emailing privacy@trakto.uk. We will respond within one month.

We may update this policy as the service changes. The date at the top shows the latest version, and significant changes will be announced in the app before they take effect.