Privacy Policy

The controller responsible for the processing of personal data described in this Privacy Policy, unless stated otherwise, is:

Phone: +49 152 34115276
Email: hello@pestrouting.com
Support: support@pestrouting.com

We have not appointed a separate Data Protection Officer, as we currently believe that the statutory requirements under Art. 37 GDPR and § 38 BDSG do not apply.

For any privacy-related questions, you can contact us at hello@pestrouting.com or support@pestrouting.com.

Depending on the context, we may process personal data either as controller or as processor.

3.1 Processing as Controller

We generally act as controller when we process personal data for our own purposes, including:

• operating our website;
• handling demo requests and contact inquiries;
• managing customer relationships;
• managing user accounts;
• providing support;
• sending service-related emails;
• managing subscriptions and billing-related communication;
• securing and improving our services;
• using website and product analytics;
• complying with legal obligations.

3.2 Processing as Processor

We generally act as processor where we process Customer Data on behalf of our business customers in order to provide PestRouting.

This may include data imported from FieldRoutes or other customer-authorized systems, such as customer, end-customer, technician, employee, office, appointment, route, service-location, subscription, skill and service-type data.

Where we act as processor, the customer remains the controller responsible for the lawfulness of the processing, the legal basis for providing the data to us, information obligations toward data subjects and responding to data subject requests. In these cases, the processing is governed by our Data Processing Agreement unless another valid data processing agreement has been concluded.

Depending on how you interact with PestRouting, we may process the following categories of personal data.

4.1 Website Visitor Data

When you visit our website, we may process:

• IP address;
• date and time of access;
• requested pages or files;
• referrer URL;
• browser type and version;
• operating system;
• device information;
• language settings;
• approximate location derived from technical data;
• cookie and consent preferences;
• interaction events, where analytics consent has been given.

4.2 Contact and Lead Data

When you contact us, request a demo, submit a form, book a call or interact with our sales process, we may process:

• name;
• email address;
• phone number;
• company name;
• job title or role;
• message content;
• demo request details;
• meeting details;
• CRM notes;
• communication history;
• metadata such as timestamp, IP address and user agent.

4.3 Account and User Data

When you create or use an account, we may process:

• name;
• email address;
• company or tenant name;
• user role and permissions;
• login information;
• authentication and session data;
• account status;
• subscription status;
• usage data;
• support requests;
• audit logs and security logs;
• user settings and preferences.

4.4 Customer Data from FieldRoutes and Other Integrations

Through your connected FieldRoutes account or other integrations, PestRouting may access, import, process, store and, where enabled, write back data such as:

• customer and service-location data, including customer names, service addresses, contact details and customer flags;
• appointment data, including scheduled and completed appointments, dates, status and technician assignments;
• subscription data, including recurring service agreements, service frequencies, contract details and cancellation reasons;
• employee data, including technician and office-staff records, roles, active status and, where enabled, commission data;
• office data, including branch and office locations;
• route data, including planned and completed routes and assigned technicians;
• appointment-slot or spot data, including time slots associated with routes;
• service-type data, including service definitions and associated service durations;
• skill data, including technician qualifications;
• configuration data, integration settings, IDs, mappings and related operational data.

The exact data categories depend on your configuration, enabled features, FieldRoutes permissions, API availability and future product development.

4.5 Integration Credentials

Where necessary to provide the service, we may process and store:

• API keys;
• access tokens;
• refresh tokens;
• integration credentials;
• authentication metadata;
• permission scopes;
• connection status.

We store such credentials for the duration of your use of the relevant integration, unless earlier deletion is requested or required.

4.6 Billing and Subscription Data

Payments for PestRouting are processed through Paddle.

We may receive and process billing-related data from Paddle, such as:

• customer name;
• company name;
• billing email;
• billing address;
• subscription status;
• purchased plan;
• billing interval;
• transaction ID;
• invoice or receipt reference;
• tax status;
• payment status;
• refund or cancellation status.

We do not directly process full payment card details.

4.7 Support, Security and Monitoring Data

When you use the application or contact support, we may process:

• support messages;
• bug reports;
• screenshots or files you provide;
• error logs;
• stack traces;
• request metadata;
• browser and device information;
• user ID or account ID;
• IP address;
• session and event data;
• security logs;
• system performance data.

We use this data to provide support, fix bugs, investigate incidents, improve reliability and secure PestRouting.

We process personal data for the following purposes and legal bases.

5.1 Providing the Website and Application

Purpose: providing our website, app, login, dashboard, routing features, audit flows and SaaS functionality.

Legal basis: Art. 6 (1) (b) GDPR where processing is necessary for a contract or pre-contractual measures; Art. 6 (1) (f) GDPR for our legitimate interest in operating a secure and functional website and application.

5.2 Providing PestRouting Services

Purpose: providing routing optimization, scheduling analysis, dashboards, audits, simulations, analytics, FieldRoutes sync, write-back functionality, onboarding, implementation and support.

Legal basis: Art. 6 (1) (b) GDPR for contract performance where we process data of our direct customer contacts and users; Art. 6 (1) (f) GDPR for legitimate interests in providing and improving the service; Art. 28 GDPR where we process Customer Data as processor on behalf of our customer.

5.3 Processing Customer Data on Behalf of Customers

Purpose: importing, analyzing, optimizing, displaying and syncing customer-authorized FieldRoutes or integration data.

Legal basis: where we act as processor, the customer determines the legal basis. Processing is performed under a Data Processing Agreement and customer instructions.

5.4 Demo Requests, Sales and Customer Relationship Management

Purpose: handling inquiries, scheduling demos, managing leads, communicating with prospects and customers, documenting communication and following up on business opportunities.

Legal basis: Art. 6 (1) (b) GDPR for pre-contractual steps; Art. 6 (1) (f) GDPR for our legitimate interest in efficient B2B customer relationship management.

5.5 Billing, Subscriptions and Paddle Payments

Purpose: managing subscriptions, billing communication, customer payment support, tax-related communication, refund or cancellation support and account status.

Legal basis: Art. 6 (1) (b) GDPR for contract performance; Art. 6 (1) (c) GDPR for legal obligations; Art. 6 (1) (f) GDPR for our legitimate interest in managing payments and subscriptions.

5.6 Support and Communication

Purpose: responding to support requests, troubleshooting issues, investigating bugs, communicating about the service and providing customer assistance.

Legal basis: Art. 6 (1) (b) GDPR for contract-related support; Art. 6 (1) (f) GDPR for legitimate interests in providing reliable support and improving the service.

5.7 Analytics and Product Improvement

Purpose: understanding website and product usage, improving usability, identifying errors, measuring feature adoption and improving PestRouting.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG where consent is required for non-essential cookies or comparable technologies; Art. 6 (1) (f) GDPR where processing is strictly necessary for service security, debugging or product operation.

5.8 Security, Fraud Prevention and Abuse Prevention

Purpose: securing our services, preventing unauthorized access, detecting misuse, monitoring system integrity and responding to incidents.

Legal basis: Art. 6 (1) (f) GDPR based on our legitimate interest in secure and reliable services; Art. 6 (1) (c) GDPR where processing is required by law.

5.9 Legal Compliance

Purpose: complying with tax, commercial, accounting, regulatory, legal and dispute-resolution obligations.

Legal basis: Art. 6 (1) (c) GDPR for legal obligations; Art. 6 (1) (f) GDPR for legitimate interests in establishing, exercising or defending legal claims.

Our website and application may use cookies, local storage, session storage and similar technologies.

6.1 Essential Technologies

Essential technologies are required to provide the website, application, login, security, session management, consent management and core functionality.

Legal basis: § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.

6.2 Non-Essential Technologies

Non-essential technologies, including analytics and certain tracking tools, are used only where required consent has been obtained through our consent banner or consent settings.

Legal basis: § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

You can withdraw your consent at any time with effect for the future through the available consent settings or by resetting your browser/site settings where applicable.

Our application, database and core infrastructure are hosted on servers provided by Hetzner.

According to our current setup, our Hetzner server and database are hosted in Finland, within the European Union.

We process hosting and server log data to provide, secure and maintain PestRouting.

Server logs may include IP address, timestamp, request details, browser information, operating system, status codes and technical metadata. Logs are used for security, troubleshooting and operational reliability.

Legal basis: Art. 6 (1) (f) GDPR.

We may use Hostinger for email hosting and Resend for sending transactional or service-related emails.

Such emails may include:

• account emails;
• login or verification emails;
• onboarding emails;
• support communication;
• service notifications;
• subscription-related communication;
• system or security notices.

Processed data may include name, email address, company, message content, delivery metadata and related technical information.

Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR.

We use HubSpot for customer relationship management, demo requests, lead management and sales communication.

Processed data may include name, email address, company, phone number, role, communication history, demo request details, CRM notes and related metadata.

Purposes: managing B2B leads, customer communication, follow-up, sales pipeline and customer relationship management.

Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR.

HubSpot may process data in the United States. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses or other legally recognized transfer mechanisms.

We use Cal.com for scheduling demo calls, customer calls and onboarding meetings.

Processed data may include name, email address, company, meeting time, calendar details, booking form information and communication metadata.

Purposes: scheduling, confirming and managing appointments.

Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR.

We use PostHog for analytics, product usage insights and debugging.

We use PostHog EU Cloud.

Depending on configuration and consent, PostHog may process:

• user ID or account ID;
• email address or contact information where needed for debugging or customer support;
• company or tenant ID;
• event data;
• page views;
• clicks and interactions;
• device and browser information;
• technical metadata;
• feature usage;
• error-related context.

We use PostHog to understand usage, improve the product, detect problems, troubleshoot issues and, where necessary, contact affected users or customers about errors.

Where PostHog is used for non-essential analytics, processing is based on consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

Where PostHog is used for strictly necessary operational debugging, security or service reliability, processing may be based on Art. 6 (1) (f) GDPR.

We use Sentry for error monitoring, application reliability and debugging.

Sentry may process technical error data, such as:

• error messages;
• stack traces;
• browser and device information;
• timestamps;
• request metadata;
• user ID or account ID;
• IP address;
• contextual data needed to reproduce and fix errors.

We configure Sentry to reduce unnecessary personal data collection where possible and use available privacy and PII-reduction settings.

Purpose: detecting, investigating and fixing technical errors and improving application stability.

Legal basis: Art. 6 (1) (f) GDPR.

We use Laravel Nightwatch for application monitoring, performance monitoring and debugging.

Processed data may include technical request data, performance data, application events, error context, user or tenant identifiers and metadata needed to operate, secure and improve the application.

Purpose: monitoring application health, identifying errors, improving performance and supporting secure operation.

Legal basis: Art. 6 (1) (f) GDPR.

We may use Google Maps and Google Places APIs, including autocomplete functionality, for address search, address completion, geocoding, mapping, route-related features and location-related functionality.

Depending on your use of the feature, Google may process:

• address search input;
• selected addresses;
• coordinates or location-related data;
• IP address;
• device and browser information;
• technical metadata.

We currently use Google Places autocomplete functionality. Users should avoid entering unnecessary personal information into address search fields.

Purpose: address completion, mapping, geocoding and route-related functionality.

Legal basis: Art. 6 (1) (b) GDPR where required to provide the service; Art. 6 (1) (f) GDPR for our legitimate interest in reliable address and mapping functionality.

Google may process data outside the European Economic Area. Where required, such transfers are protected by appropriate safeguards.

Payments for PestRouting are processed through Paddle.

Paddle acts as Merchant of Record or reseller for our orders and may process payment, billing, invoice, tax, refund, chargeback and subscription data according to Paddle’s own terms and privacy documentation.

We may receive billing-related information from Paddle, such as:

• customer name;
• company name;
• billing email;
• billing address;
• subscription status;
• purchased plan;
• billing interval;
• transaction ID;
• invoice or receipt reference;
• tax status;
• payment status;
• cancellation status;
• refund status.

We do not directly process full payment card details.

Legal basis: Art. 6 (1) (b) GDPR, Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR.

PestRouting may connect to FieldRoutes or other customer-authorized third-party systems.

If you authorize such an integration, we may import, process and store data from that system and, where enabled, write data back into that system.

Processed data may include the FieldRoutes data categories described in Section 4.4.

We may also store integration credentials such as API keys, access tokens or refresh tokens for the duration of your use of the integration.

Purpose: providing routing optimization, scheduling analysis, audits, simulations, dashboards, sync, automation and write-back functionality.

Where we process such data on behalf of our customer, we act as processor under a Data Processing Agreement.

The customer is responsible for ensuring that it is allowed to connect FieldRoutes or another third-party system to PestRouting and that it has a valid legal basis for providing the data to us.

FieldRoutes and other customer-connected systems are generally customer-authorized third-party integrations rather than subprocessors controlled by us.

Depending on your plan, settings and enabled features, PestRouting may write data back to FieldRoutes or another connected system.

This may include:

• new route or scheduling suggestions;
• changed routes;
• technician assignments;
• appointment dates and times;
• route, appointment or scheduling updates;
• other changes supported by the connected system and enabled features.

Such write-back actions are performed only where the customer enables, approves, triggers, configures or otherwise authorizes the relevant functionality.

Customers remain responsible for reviewing, validating and authorizing operational changes and for the consequences of applying automated or manual changes in their systems.

As of the Last Updated date of this Privacy Policy, PestRouting does not process identifiable Customer Data through artificial intelligence APIs and does not use Customer Data in AI prompts.

We do not use identifiable Customer Data to train artificial intelligence models.

If we introduce AI-powered features that process Customer Data, we will update this Privacy Policy, the applicable Data Processing Agreement and related product documentation as required.

We may use aggregated, anonymized or otherwise non-identifying data to operate, analyze, improve, secure and develop PestRouting and related services.

Such data will not identify you, your customers, your employees, your technicians or other individuals.

We may share personal data with service providers and processors where necessary to operate, provide, secure, monitor, analyze, support and improve PestRouting.

These may include:

• hosting and infrastructure providers;
• database and server providers;
• email and transactional email providers;
• analytics providers;
• error monitoring providers;
• CRM providers;
• appointment scheduling tools;
• payment and billing providers;
• mapping and location service providers;
• security and monitoring tools;
• professional advisors, where necessary;
• public authorities, where legally required.

Current service providers may include:

• Hetzner;
• Hostinger;
• Resend;
• HubSpot;
• Cal.com;
• PostHog;
• Sentry;
• Laravel Nightwatch;
• Google Maps / Google Places APIs;
• Paddle;
• Cloudflare, if enabled in the future.

More details may be provided in our Subprocessors page and Data Processing Agreement.

Some service providers may process personal data outside the European Economic Area, in particular in the United States.

Where personal data is transferred outside the European Economic Area, we rely on legally recognized transfer mechanisms where required, such as:

• an adequacy decision by the European Commission;
• the EU-U.S. Data Privacy Framework, where applicable;
• Standard Contractual Clauses;
• additional technical and organizational safeguards;
• other transfer mechanisms permitted under GDPR.

You may request further information about relevant safeguards by contacting us.

We store personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.

Typical retention periods include:

• website server logs: generally up to 14 days unless longer retention is necessary for security or evidentiary purposes;
• contact and demo inquiries: for as long as necessary to respond and manage the business relationship, unless legal retention obligations apply;
• CRM and customer relationship data: for the duration of the business relationship and as long as required for legitimate business, legal or compliance purposes;
• account and subscription data: for the duration of the account or subscription and applicable legal retention periods;
• billing and tax-related data: according to applicable commercial and tax retention requirements;
• support data: for as long as necessary to resolve the request and maintain service history, unless longer retention is required;
• Customer Data processed as processor: generally for the duration of the subscription and up to 90 days after the end of the paid subscription term, unless longer retention is required by law or necessary for legal, billing, tax, security, compliance or dispute-resolution purposes;
• backup data: retained for a limited period and overwritten or deleted according to our backup and retention procedures once implemented.

You may contact support@pestrouting.com to request export or deletion assistance. Export or deletion assistance may depend on technical feasibility, applicable law, security requirements, your plan and the applicable Data Processing Agreement.

Subject to the legal requirements, you have the following rights regarding your personal data:

• right of access under Art. 15 GDPR;
• right to rectification under Art. 16 GDPR;
• right to erasure under Art. 17 GDPR;
• right to restriction of processing under Art. 18 GDPR;
• right to data portability under Art. 20 GDPR;
• right to object under Art. 21 GDPR;
• right to withdraw consent under Art. 7 (3) GDPR;
• right to lodge a complaint with a supervisory authority under Art. 77 GDPR.

If processing is based on consent, you may withdraw your consent at any time with effect for the future. The lawfulness of processing before withdrawal remains unaffected.

To exercise your rights, please contact us at hello@pestrouting.com or support@pestrouting.com.

Where we process Customer Data as processor on behalf of a customer, we may need to forward your request to the relevant customer or ask you to contact that customer directly, because the customer is responsible for handling the request as controller.

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority competent for us is:

Website: https://www.baden-wuerttemberg.datenschutz.de

We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

These measures may include:

• TLS/SSL encryption;
• access controls;
• authentication mechanisms;
• role and permission controls;
• logging and monitoring;
• restricted access to production systems;
• secure credential handling;
• error monitoring and incident investigation;
• subprocessors subject to contractual safeguards;
• backup and recovery procedures once implemented;
• regular improvements based on technical and operational requirements.

No system can be guaranteed to be completely secure. Customers are responsible for maintaining secure user accounts, permissions, API credentials, connected third-party systems and endpoint devices.

We do not use automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

PestRouting may generate routing recommendations, simulations, optimization outputs, analytics or planning suggestions. These outputs are decision-support tools and should be reviewed by the customer before operational use.

We may update this Privacy Policy from time to time to reflect changes in our services, processing activities, subprocessors, legal requirements or technical setup.

The current version is always available on this page.

If changes are material, we will make reasonable efforts to notify affected users or customers, for example by email, in-app notice or website notice.

For privacy-related questions, requests or concerns, please contact:

Email: hello@pestrouting.com
Support: support@pestrouting.com