Skip to content

Free plan available — track your first 100 shipments at no cost. Start free

Legal

Privacy Policy

Effective date: August 24, 2026

WINDCODEX INC (“we,” “our,” or “us”) operates TrackLogy(“the Service”), available at tracklogy.com and my.tracklogy.com. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.

By creating an account or using TrackLogy, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Data Controller

The data controller for personal data processed through the Service is:

Our infrastructure is hosted by Contabo GmbH, Germany (EU).

2. Information We Collect

We collect the following categories of information:

  • Account information — Your name, email address, company name, and password when you register. Billing contact details when you subscribe to a paid plan.
  • Payment metadata — We use Stripe to process payments. We do not store or receive your full card number, CVV, or bank account details. Stripe retains payment instrument data under their own privacy policy. We receive only a billing confirmation and the last four digits of your card for display purposes.
  • Shipment data — Tracking numbers, carrier codes, order IDs, shipment statuses, and customer contact details (name, email, phone, shipping address) that you submit to the Service on behalf of your customers.
  • Usage data — Log data including IP address, browser type, pages visited, timestamps, and referring URLs, collected automatically when you use the Service.
  • Analytics data — Aggregated behavioural data collected via Google Analytics / Google Tag Manager. This is collected only with your consent (see Section 7).
  • Support communications — Emails, chat messages, and other communications you send to our support team.

3. How We Use Your Information

  • To create and manage your account and provide access to the Service.
  • To track shipments and retrieve status updates from carrier APIs on your behalf.
  • To send automated email and SMS notifications to your customers as configured by you.
  • To process subscription payments and manage your billing history.
  • To communicate with you about your account, service updates, and support requests.
  • To detect and prevent fraud, abuse, and security incidents.
  • To improve the Service using aggregated, anonymised analytics (with consent).
  • To comply with legal obligations under applicable law.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases under GDPR Article 6:

  • Contract performance (Art. 6(1)(b)) — Processing necessary to provide the Service you signed up for: account management, shipment tracking, customer notifications, and billing.
  • Legitimate interests (Art. 6(1)(f)) — Security monitoring, fraud prevention, and internal service improvement using aggregated data. We have assessed that these interests are not overridden by your rights.
  • Consent (Art. 6(1)(a)) — Analytics cookies (Google Analytics / GTM) and live chat functionality (Crisp) are activated only after you grant consent via our cookie banner. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)) — Retaining financial records and responding to lawful requests from authorities.

5. Third-Party Services and Sub-processors

We share data with the following third parties to operate the Service. Each is contractually bound to process data only as instructed and to maintain appropriate security. A full sub-processor list is available at tracklogy.com/legal/subprocessors.

  • Stripe, Inc. (United States) — Payment processing. Data transferred under Standard Contractual Clauses (SCCs).
  • Contabo GmbH (Germany, EU) — Cloud infrastructure and hosting. All primary servers reside in the EU.
  • Brevo SAS (Sendinblue) (France, EU) — Transactional email delivery for account and system emails.
  • Google LLC (United States) — Google Tag Manager and Google Analytics for usage analytics. Activated only with your consent. Data transferred under SCCs.
  • Crisp IM SAS (France, EU) — Live chat support. Activated only with your consent.
  • Carrier tracking providers — Tracking numbers are forwarded to carrier APIs and aggregators (such as 17track or direct carrier integrations) solely to retrieve shipment status updates.

We do not sell your personal data to any third party.

6. International Data Transfers

Some of our sub-processors (Stripe, Google) are based in the United States. Where personal data is transferred outside the EEA or UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on an applicable adequacy decision.

Our primary infrastructure is hosted within the EU (Contabo GmbH, Germany). Transactional email is processed within the EU (Brevo, France).

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies. Cookies fall into three categories:

  • Essential cookies — Required for authentication, session management, and core platform functionality. These cannot be disabled without breaking the Service.
  • Analytics cookies — Google Analytics / GTM. Activated only after you grant consent via our cookie banner. You may withdraw consent at any time from the Cookie Settings link in the footer.
  • Functional cookies — Crisp live chat. Activated only after consent.

For a full list of cookies we use, see our Cookie Policy.

8. Data Retention

  • Account data — Retained while your account is active and for 2 years after account closure or deletion, unless a longer period is required by law.
  • Shipment and tracking data — Retained for 2 years from the date of the last status update.
  • Payment records — Retained for 7 years to comply with financial and tax regulations.
  • Support communications — Retained for 2 years from the date of the last message.

You may request deletion of your account and associated data at any time by emailing [email protected]. We will action the request within 30 days, subject to any legal retention obligations.

9. Your Rights

EEA, UK, and Switzerland (GDPR / UK GDPR)

You have the right to:

  • Access — Request a copy of the personal data we hold about you.
  • Rectification — Ask us to correct inaccurate or incomplete data.
  • Erasure — Ask us to delete your personal data (“right to be forgotten”).
  • Portability — Receive your data in a structured, machine-readable format.
  • Restriction — Ask us to restrict processing while a dispute is resolved.
  • Objection — Object to processing based on legitimate interests.
  • Withdraw consent — Withdraw consent for analytics or chat cookies at any time via Cookie Settings.
  • Lodge a complaint — With your local data protection authority.

California Residents (CCPA / CPRA)

You have the right to:

  • Know what personal information we collect and how it is used.
  • Request deletion of your personal information.
  • Opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising.
  • Non-discrimination for exercising your privacy rights.

India (Digital Personal Data Protection Act, 2023)

As a data principal, you have the right to:

  • Access a summary of the personal data we process and the purposes of processing.
  • Correct or update inaccurate personal data.
  • Erasure of personal data that is no longer necessary for the purpose it was collected.
  • Grievance redressal — contact us using the details in Section 13.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Security

We implement industry-standard security measures including HTTPS encryption for all data in transit, access controls limiting employee access to personal data on a need-to-know basis, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

If you believe your account has been compromised, contact [email protected] immediately.

11. Children's Privacy

TrackLogy is a business-to-business (B2B) platform intended for use by ecommerce businesses and their authorised personnel. The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, contact us at [email protected] and we will delete it promptly.

12. Data Processing Agreement

If you use TrackLogy to process personal data belonging to your customers on behalf of your business, you act as a data controller and we act as a data processor. Enterprise and business customers who require a signed Data Processing Agreement (DPA) for GDPR compliance may request one at tracklogy.com/legal/dpa or by emailing [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by email to your registered address or by posting a prominent notice on the Service. The updated policy will show a new effective date at the top of this page. Continued use of the Service after the effective date of a change constitutes acceptance of the updated policy.

14. Contact

For privacy-related enquiries or to exercise your rights:

Last updated: August 24, 2026Terms of Service →