Legal
Privacy policy
This policy explains what Winch Labs FZ-LLC ("Winch Labs", "we") collects through this website and through Dropwize, why we collect it, and what you can ask of us.
Two roles matter throughout. For this website and for the accounts we run, we are the controller. For the data a company puts into Dropwize, that company (the "customer") is the controller and we process the data on its behalf and on its instructions. The customer decides what it records about its own customers, drivers and staff.
This policy was prepared by Winch Labs and may be updated. The current version is always on this page.
1. What we collect on this website
Demo, pilot and contact requests. When you send a form, we store your name, company, e-mail, phone, message, the kind of request (demo, pilot or contact), the time, the page you sent it from, your browser's user-agent string, and a salted one-way hash of your IP address. We use these details to answer you. We do not add you to a mailing list.
Abuse prevention. The hash of your IP address is used only to limit repeated submissions (five an hour) and cannot be turned back into your address. We never store the address itself.
Your preferences. The site remembers your theme (light, dark or system) and the trade you picked in your browser's localStorage, under the keys dw-theme and dw-trade. They never leave your browser. Clear your site data to remove them.
What we do not do. The site has no analytics, no advertising pixels, no session recording and no cookies. There is no cookie banner because there is nothing to consent to.
Hosting. The site and its form service run on Cloudflare. Cloudflare keeps operational logs at its edge under its own policy.
2. What the Dropwize service processes
Account data. For each user of the console or the app: name, e-mail or phone used to sign in, role (admin, dispatcher, sales or driver), the company the user belongs to, and a record of the actions the user takes on jobs. Sign-in is handled by Google Firebase Authentication.
Customer records. The names, phone numbers, addresses, map pins and notes of the people and businesses the customer delivers to or visits. The customer enters or imports these and controls them.
Jobs. Job type, time window, goods lines and counts, collected items, cash amounts due and confirmed, service descriptions, the assigned driver and vehicle, and the history of each job.
Driver location. The driver app collects the phone's location only while the driver is on shift. It starts when the driver opens a shift and stops when the shift ends. While it runs, the phone shows a notification that location is being shared. With each batch of points the app also sends the phone's battery level, so dispatch can see a phone about to die. Location is used to show vehicles on the live map, to update arrival times and to suggest the nearest driver.
Proof of delivery and service. Photos, the receiver's signature and name, per-line counts, the cash confirmation, and the location and time the proof was taken. For service visits, the signed service report.
Devices. A push token for each signed-in phone, so we can notify drivers and sales users about their jobs. Push messages are delivered by Google Firebase Cloud Messaging.
Operational logs. Server logs with request times, errors and user identifiers, used to run and fix the service.
3. Why we process it, and on what basis
Website requests: to answer you (your request, and our legitimate interest in replying). Account data: to provide the service the customer signed up for (contract) and to keep it secure (legitimate interests). Data in the customer's Dropwize workspace: only to provide the service to that customer, on its instructions. The customer is responsible for having a lawful basis for what it records, including telling its drivers that the app shares their location during shifts.
We do not sell personal data. We do not use it for advertising. We do not train models on it. Dropwize suggests assignments and routes; a dispatcher decides.
4. How customer data is kept apart
Every customer has its own workspace. The database enforces this with row-level security, so a user only ever reads the rows of their own company. Within a company, roles limit what each user can do: drivers see their own jobs, sales users see the jobs they booked, dispatchers and admins run the day.
Data travels over TLS. The database and the proof storage are encrypted at rest. Photos and signatures are stored privately and opened through short-lived links.
5. Subprocessors and recipients
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting for Dropwize: API, database, proof photos and signatures, maps and routing | United States (US East, N. Virginia, us-east-1) |
| Google Firebase | Sign-in (Firebase Authentication) and push notifications (Firebase Cloud Messaging) | United States and Google's global infrastructure |
| Cloudflare | This website and its form service; not used for Dropwize customer data | Global edge |
We will tell customers before we add a subprocessor that receives their data.
Premium customers who run Dropwize in their own cloud account or on their own servers choose where their data lives. In that case the customer operates the hosting, and the table above applies only to what we run for them.
6. Where data is stored
Dropwize is hosted today in the AWS US East region (N. Virginia). It is not hosted in the UAE. If you are in the UAE or elsewhere, your data is transferred to the United States. We rely on the data-protection terms of AWS and Google, including their standard contractual clauses, and on the safeguards the UAE Personal Data Protection Law requires for transfers out of the UAE.
7. Retention
| Data | Kept |
|---|---|
| Website form requests | Until you ask us to delete them |
| IP hash and user agent of a form request | Kept with the request, deleted with it |
| Theme and trade preference | In your browser until you change them or clear site data |
| Jobs, customer records, proof and location history | For the life of the customer's account, unless the customer asks us to delete it sooner |
| Database backups | 14 days, then they expire on their own |
| Server logs | 14 days |
| After a customer leaves | An export window, then deletion from live systems; backups expire on their own schedule |
8. Export and deletion
A customer can export its data at any time. Reports already export to CSV; for a full export, write to us and we will provide it. A customer can ask us to delete specific records or its whole workspace. We delete them from live systems and confirm in writing when it is done. Database backups expire on their own after 14 days; older stored versions of proof files are removed when we process the request.
9. Your rights
Depending on where you live, including under the UAE Personal Data Protection Law and the EU and UK GDPR, you may have the right to access, correct or delete your personal data, to restrict or object to its processing, to receive a copy in a portable form, and to complain to a data-protection authority.
Write to hello@winchlabs.io with "Privacy" in the subject. We verify the request and reply within 30 days.
If you are a driver, or a customer of a company that uses Dropwize, that company controls your data. Ask the company first. If you write to us, we pass your request to the company and help it answer.
10. Breach notification
If a personal-data breach affects customer data, we tell the affected customer without undue delay, with what we know and what we are doing about it. Where we are controller, we notify the competent authority and the people affected when the law requires it.
11. Children
Dropwize is a tool for businesses. It is not meant for children, and we do not knowingly collect their data.
12. Changes
We may update this policy as the product changes. The date at the top shows the latest version. If a change affects how we process customer data, we tell customers before it takes effect.
13. Contact
Winch Labs FZ-LLC, Dubai, United Arab Emirates. hello@winchlabs.io, with "Privacy" in the subject.