Who this is about
Route Desk CRM is delivery-management software made by Digital Upscalers. Furniture retailers use it to plan deliveries, assign them to vans and drivers, and keep their customers informed. It is a tool for a business's own staff — it is not a service members of the public sign up to.
This policy explains what information the software handles, why, and what is never done with it. It applies to routedeskcrm.com and to the Route Desk CRM application.
Information the software handles
About a retailer's customers. When a shop takes an order, the following is recorded so the delivery can actually happen:
- Name, telephone number and email address
- Delivery address, and the map coordinates worked out from it so a route can be planned
- The items ordered, their prices, and any assembly requested
- Delivery date, delivery status, and notes a driver or agent adds
- Photographs taken at delivery, and a signature where one is collected
- Messages sent through the website chat, and any file attached to them
This information belongs to the retailer who collected it. Digital Upscalers holds it on their behalf and does not use it for any purpose of its own.
About the staff who use it. A name, an email address, a role, and a password stored only as a cryptographic hash — never in a readable form. Failed sign-in attempts are recorded briefly so repeated guessing can be stopped.
Google Calendar and Google Drive
Connecting Google is optional. The software works fully without it, and the connection can be withdrawn at any time without losing anything already in the CRM.
A retailer may choose to connect the Google account on which they keep their bookings diary. When they do, the software asks for permission to read:
- Google Calendar — the events on the connected calendar: title, date and time, location, description, colour, and any file attached to an event. This is used for one thing: turning a booking written in the diary into a delivery order inside that retailer's own CRM, so it appears on the dispatch board and can be routed.
- Google Drive — only files that are attached to those calendar events, which are usually photographs of the furniture being delivered. These are copied into the order so warehouse staff and drivers can see what they are loading. No other file in the Drive is read, listed or touched.
Both permissions are read-only. Nothing is created, changed or deleted in anyone's Calendar or Drive.
Limited Use. Route Desk CRM's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In plain terms, data obtained from Google is used only to provide the delivery features described above. It is never sold, never used for advertising, never used to train artificial intelligence or machine learning models, and never given to anyone else except where the law requires it.
Withdrawing access. A retailer can disconnect Google from within the CRM at any time, or revoke it directly at myaccount.google.com/permissions. Once withdrawn, no further calendar data is read. Orders already created in the CRM stay there, because they are the retailer's own delivery records.
Who can see the information
Only the retailer's own staff, through their own logins, and only the parts their role allows — a driver sees the stops on their run, not the business's accounts.
Nothing is sold. Nothing is shared with advertisers or data brokers. Information is disclosed to others only in these cases:
- Service providers who make the software work — the hosting company that runs the server, and, where the retailer has switched them on, the email and text-message services used to notify customers about their delivery.
- Mapping services — a delivery address is sent to OpenStreetMap's geocoding and routing services to find its position and work out a sensible driving order. Only the address is sent: no name, no telephone number, no order details.
- The law, where a valid legal requirement obliges disclosure.
Where it is kept, and for how long
Information is held in a database on servers operated by the hosting provider. Those servers may be located outside Canada, and information stored on them is subject to the laws of the country in which they sit.
Delivery records are kept for as long as the retailer needs them for their business and tax obligations. A retailer can ask for their data to be exported or deleted at any time, and Digital Upscalers will act on that request.
How it is protected
- Everything travels over an encrypted connection (HTTPS), and the site refuses unencrypted connections outright.
- Passwords are stored only as cryptographic hashes.
- Sign-in is rate-limited, so passwords cannot be guessed at speed.
- Each member of staff sees only what their role permits.
- Uploaded files are verified to be genuine images before they are stored, and the server is configured so nothing in the uploads area can ever be executed.
No system is perfectly secure, and no one can promise otherwise. What is promised is that these protections are in place and are kept up to date.
Your rights
If you are a customer of a retailer that uses Route Desk CRM and you want to see, correct or delete what is held about you, please contact that retailer first — the records are theirs. They can act on it directly, and Digital Upscalers will assist them if needed.
Children
This software is a business tool and is not directed at children. No information is knowingly collected from anyone under the age of 13.
Changes
If this policy changes, the revised version will be posted here with a new date at the top.
Contact
Questions about this policy, or about information held in the software, can be sent to farooqakhter1234@gmail.com.