Privacy Policy

Version of October 11, 2026 · Effective from that date · The Russian version is the governing text; this translation is provided for convenience

In short:

We only collect what a tool-tracking service needs: account details and what your company itself puts into the service.
Data is stored on servers in Russia. We don't sell it, don't use it for advertising and don't share it with outsiders.
Data your company enters about its staff and sites belongs to the company: it decides what happens to it, and we process it on the company's behalf.
You can get a copy of your data, correct it or delete it. A company admin can delete the company with all its data in the settings.

1. Who we are

The controller is Maxim Eduardovich Lipatnikov, individual entrepreneur (Russia), taxpayer ID (INN) 434587543075 ("we", "us"). For any question about personal data, write to support@draftroute.app.

This policy covers DraftRoute: the website draftroute.app, the web app app.draftroute.app and the DraftRoute mobile apps (the "Service"). It follows Russian Federal Law No. 152-FZ "On Personal Data" and, for users in the European Union and the United Kingdom, the General Data Protection Regulation (GDPR and UK GDPR).

2. Roles: when we are the controller and when we act for your company

The Service is used by businesses (each a "Customer") that register their company and add staff.

We are the controller of the account data of the admin who registers a company, and of technical data about how the Service is used (sections 3.1 and 3.3).
The Customer is the controller of the data it enters about its employees, foremen, clients and sites (section 3.2). We process that data on the Customer's behalf as a processor (Art. 28 GDPR; Art. 6(3) of 152-FZ), only to run the Service and under the Terms of Service. The Customer is responsible for having a lawful basis to enter such data, including people's consent where required.

3. What data we process

3.1. Account data

name, email address, phone number (if given), profile photo (if uploaded);
role in the company (admin, foreman), company name and logo;
password — only as an irreversible hash; we never store or see the password itself;
the date you accepted the Terms of Service and gave consent to personal data processing, and the version of those documents.

3.2. Data the company enters

warehouses and sites: names, addresses and coordinates, clients, responsible people and foremen, links to project documents and cameras;
tools and equipment: names, inventory numbers, quantities, prices, photos, descriptions, files;
activity history: who moved or changed what, and when (staff member's name and time).

3.3. Technical data

IP address, browser and device type, request times — in server logs;
a sign-in cookie (section 9) and interface settings stored in your browser.

We do not collect special categories of personal data (health, beliefs and the like) or biometric data. Please don't enter them into the Service.

4. Why we process data and on what legal basis

Purpose	Data	Legal basis
Sign-up, sign-in, running the Service	3.1, 3.2	Performance of a contract — the Terms of Service (Art. 6(1)(b) GDPR); consent and performance of a contract (Arts. 6 and 9 of 152-FZ)
Service emails: password reset, staff invitations, notices of changes to the terms	name, email	Performance of a contract (Art. 6(1)(b) GDPR)
Customer support	3.1, your message	Performance of a contract; legitimate interest (Art. 6(1)(f) GDPR)
Security: preventing break-ins and abuse, backups	3.3	Legitimate interest in protecting the Service and customers' data (Art. 6(1)(f) GDPR); our duty to protect data (Art. 19 of 152-FZ)
Complying with the law	as required	Legal obligation (Art. 6(1)(c) GDPR)

We make no decisions about people based solely on automated processing and do no profiling. We send no marketing emails; if we ever do, only with your separate consent.

5. Where data is stored and who receives it

Data is stored and processed on servers in the Russian Federation (Moscow), which also meets Russia's data localisation requirement for its citizens (Art. 18(5) of 152-FZ).

We don't sell data or share it with third parties for their own purposes. Only those who help run the Service receive data, and only as much as they need:

Timeweb JSC (Russia) — server hosting and the mail service used to send service emails;
OpenStreetMap Foundation (United Kingdom) — background map tiles on the Map page: when you open it, your browser loads map tiles from OpenStreetMap servers, which see your IP address. Site coordinates are not sent to them;
public authorities — only when lawfully required.

Users outside Russia

If you use the Service from another country, your data is transferred to and stored in Russia. The European Commission has not adopted an adequacy decision for Russia. The transfer is necessary to perform the contract you enter into when you sign up (Art. 49(1)(b) GDPR): the Service cannot work without it. We protect data with the measures in section 7 regardless of where users are.

6. How long we keep data

Account and company data — for as long as the account or company exists.
When an admin deletes the company in the settings, all its data and files are deleted immediately. They remain in backups until those are overwritten: database backups are kept for 14 days, file backups for 3 days.
Server logs are kept in a limited volume and are automatically overwritten by newer entries.
Password reset links work for 1 hour, invitations for 7 days.
Longer only where the law requires it.

7. How we protect data

encrypted connections (HTTPS/TLS) for the website, the app and email;
passwords stored only as bcrypt hashes; links in emails stored only as hashes;
companies' data is isolated: staff only see their own company, and permissions depend on their role;
short sign-in sessions, revoked on sign-out and password change;
limits on sign-in attempts and other requests;
daily backups.

If a breach may affect your rights, we will notify the Russian data protection authority (Roskomnadzor) within the legal deadlines (Art. 21 of 152-FZ) and the Customer without undue delay, so it can meet its own obligations as controller.

8. Your rights

You have the right to:

know what data of yours we process and get a copy, including in a machine-readable format (Excel export is available in the Service);
have inaccurate data corrected — most of it you can change in the Service yourself;
have data erased or its processing restricted;
object to processing based on legitimate interest;
withdraw your consent to personal data processing at any time, without affecting processing before the withdrawal. We will then stop processing and delete the data unless another legal basis applies; the Service cannot be used without account data;
lodge a complaint with a supervisory authority: in Russia — Roskomnadzor (rkn.gov.ru); in the EU and the UK — the data protection authority of your country.

To exercise your rights, write to support@draftroute.app from the email address of your account. We reply within 10 business days (Art. 20 of 152-FZ), and to users in the EU within one month at the latest. If the data was entered by your employer (a Customer), we may forward the request to them as controller and help them fulfil it.

9. Cookies and browser storage

We only use what the Service can't work without:

the rt cookie keeps you signed in for up to 30 days. Page scripts can't read it (HttpOnly), it's sent only over secure connections and only to the sign-in service;
browser storage (localStorage) and the app cache — language, theme, label printing settings, and app files for fast loading.

There are no analytics, advertising or third-party cookies, so no consent banner is needed. If that ever changes, we'll update this policy and ask for consent first.

10. Children

The Service is meant for businesses and is not intended for anyone under 18. We do not knowingly collect their data.

11. Changes to this policy

We may update this policy, for example when we add features or the law changes. The current version is always on this page, with its date at the top. We will notify company admins of material changes by email or in the Service at least 14 days before they take effect.

12. Contact

Maxim Eduardovich Lipatnikov, individual entrepreneur
INN 434587543075
Moscow, Russia
Email: support@draftroute.app