Privacy notice

Routed is run by Steve Taylor, trading as Routed. Contact us about anything in this notice at routed@itaylorweb.co.uk.

• Your account. For your sign-in details and how you use Routed, we decide how the data is used, so we are the controller.
• Your workspace’s content. Requests, comments and custom field values belong to the organisation that owns the workspace. We process them on its behalf and only on its instructions, so we are a processor and the organisation is the controller. If you raised a request at work, contact your organisation first about that content.

• Account details: your name, email address and profile picture (from Google or Apple if you sign in that way).
• Sign-in and security: linked sign-in methods, an encrypted two-factor secret, hashed recovery codes, and a log of security events such as sign-ins, failed codes and two-factor resets.
• Workspace data: the requests, comments, fields, teams and settings you and your colleagues create.
• Technical data: the cookies listed below and standard server logs (IP address, browser and time) kept by our hosting provider for security and troubleshooting.

We don’t use advertising or analytics trackers, and we don’t sell personal data.

“Continue with Google” is optional. If you use it, Google shares only your name, email address and profile picture with Routed, and confirms your email is verified. We ask for no other Google permissions: we can’t see your Gmail, Drive, Calendar, contacts or anything else in your Google account.

• How we use it: to create your Routed account, sign you in, and show your name and picture to colleagues in your workspace.
• Where it’s stored: in our database in London, with your Google account ID so we can recognise you next time. We don’t store your Google password or access tokens.
• Sharing: we don’t sell Google user data or share it with anyone, other than the hosting and database providers listed below that run Routed for us. We don’t use it for advertising or to train AI models.
• Removing it: email us to delete your account and the Google data with it. You can also remove Routed’s access at any time from your Google account, under Security → Third-party apps and services.

Routed’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide the service you signed up for: creating your account, signing you in, and storing and routing requests (contract).
• To keep accounts secure: two-factor authentication, lockouts after wrong codes and security logs (legitimate interests in protecting you and the service).
• To send service emails such as sign-in links and invitations (contract). We don’t send marketing without your consent.
• To meet legal obligations, such as tax records once billing starts (legal obligation).

When you write a request, its text and your workspace’s team, category and field names are sent to the Jev AI model through OpenRouter. The model suggests the team, priority and field values, and checks for missing details. It doesn’t make decisions about you: every suggestion can be changed by a person, and we show which values the AI set.

We don’t use your content to train AI models. Workspace admins can turn AI off in Settings, and a built-in rules engine is used instead, which keeps the text inside Routed.

We use these providers (sub-processors) to run Routed. Each is bound by a contract to protect the data and use it only to provide their service to us.

We may also disclose data if the law requires it, or to a buyer if the business is sold, in which case this notice would continue to apply.

Your workspace data is stored in London. Some providers above are based in the USA, so some data passes through or is processed there. Where that happens we rely on the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum, which require the same level of protection as in the UK.

• Account and security data: while your account is open. When you ask us to delete your account, we delete it within 30 days.
• Workspace content: until the workspace owner deletes it or closes the workspace, then within 30 days.
• Backups are replaced on a rolling basis, so deleted data disappears from them within a further 30 days.
• Invoices and payment records, once billing starts, are kept for 6 years to meet tax law.

We only use cookies that are strictly necessary for Routed to work, so we don’t ask for consent:

• Session cookie (authjs.session-token): keeps you signed in, for up to 30 days.
• Security cookies (authjs.csrf-token, authjs.callback-url): protect sign-in and remember where to return you.
• Workspace cookie (routed_ws): remembers which workspace you’re in.

Every account uses two-factor authentication. Data is encrypted in transit and at rest, two-factor secrets are encrypted separately, and each workspace’s data is kept apart from every other workspace’s.

Under UK data protection law you can ask to:

• get a copy of your personal data;
• correct data that’s wrong;
• delete your data;
• restrict or object to how we use it;
• receive your data in a portable format.

Email routed@itaylorweb.co.uk and we’ll reply within one month. For content in a workspace your organisation owns, we’ll pass your request to them. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Routed is a workplace tool and isn’t intended for anyone under 16.

If we make a significant change, we’ll tell workspace admins by email or in the app before it takes effect. The date at the top shows the latest version. See also our Terms of service.