Privacy Policy

This is a translation; in case of discrepancy the Italian version prevails.

Last updated: 27 October 2026

1. Introduction

This policy describes how PathFlow collects, uses and protects users' personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian law.

2. Data Collected

• Account data: email address and encrypted password, used for authentication.
• GPS location data: geographic coordinates of the tracking devices associated with your account, received in real time via the MQTT protocol.
• Device tokens: identifiers used to send push notifications (FCM tokens).
• Usage data: anonymous logs and crash data, used to improve the service (Firebase Analytics and Crashlytics).

3. Purposes of Processing

• To provide the real-time GPS tracking service and map display.
• To send push notifications about vehicle events.
• To keep the history of the routes travelled.
• To improve the performance and user experience of the App.
• To comply with legal obligations.

4. Legal Basis

Processing is based on the performance of the service contract (Art. 6(1)(b) GDPR), on the user's consent (Art. 6(1)(a) GDPR) and on compliance with legal obligations (Art. 6(1)(c) GDPR).

5. Third-Party Services

• Firebase / Google Cloud Platform (Google LLC) — hosting, database, authentication, analytics and push notifications.
• Flespi (Gurtam) — MQTT platform used to receive GPS data from the tracking devices.
• Mapbox (Mapbox Inc.) — map display and geocoding.
• Resend (Resend Inc.) — sending of service emails: welcome, alerts, confirmations of requests and of orders.
• Stripe (Stripe Payments Europe Ltd.) — card payments of the subscriptions and of the online shop; card details are handled by Stripe and never reach us.
• Express couriers — delivery of the devices bought online: they receive the name, address and phone number of the recipient.

We do not sell or transfer personal data to third parties for marketing purposes.

6. Transfers of Data outside the EU

Some services (Firebase, Mapbox, Resend, Stripe) may involve the transfer of data to the United States, on the basis of the Standard Contractual Clauses approved by the European Commission.

7. Data Retention

Location data is retained for the duration of the active subscription. When the service ends, the data is deleted within 90 days, unless the law requires otherwise.

8. Your Rights

You have the right to:

• Access your personal data.
• Obtain its rectification or erasure.
• Restrict or object to its processing.
• Request data portability.
• Withdraw your consent at any time.
• Lodge a complaint with the Italian Data Protection Authority, the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

To exercise your rights: privacy@pathflow.it

9. Security

We adopt appropriate technical and organisational measures to protect personal data, including encryption of data in transit and at rest, secure authentication and restricted access to our systems.

10. Changes

We reserve the right to update this policy. Any changes will be published on this page together with the date of the update.

11. Quote requests and contacts from the website

When you fill in the contact form or the quote request page, we collect the data you enter (name, company, phone, email, number and type of vehicles, town, notes) to answer you and prepare your quote (pre-contractual measures, Art. 6(1)(b) GDPR). The data reaches info@pathflow.it, is stored on Firebase and is not passed on to anyone; we keep it for 24 months from the last contact, unless you become a customer.

If you arrive from the «Prova la demo» or «Richiedi il preventivo» buttons of one of our emails, the link carries a code with your company's name: we record when you open the demo or the quote page, to know whether you would like to be contacted again (legitimate interest, Art. 6(1)(f) GDPR). We use neither cookies nor invisible images to know whether you open our emails.

Only if you ask for it with the dedicated box do we send you PathFlow news from time to time (consent, Art. 6(1)(a) GDPR): you can unsubscribe at any time by replying «NO» to one of our emails or by writing to privacy@pathflow.it.

12. Information emails about PathFlow

We send our presentation email to those who asked us for it, in person, on the phone, on LinkedIn or by email (consent, Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code). Sometimes we also send it as a first contact to companies that use vehicles for work, at the address they publish to be contacted (our legitimate interest in making our services known to businesses, Art. 6(1)(f) GDPR); in that case the email says clearly why we are writing. We record name, company, email, how we got in touch (your consent, or where we found the address), the emails we sent you and whether you open the demo or the quote page from their buttons. The email leaves from our domain news.pathflow.it through the provider Resend; replies reach info@pathflow.it.

Every email has a link to receive no more, or you can reply «NO»: from then on we do not write to you again. We only keep your address in the list of people who want no emails, to be sure not to write to you again (legitimate interest, Art. 6(1)(f) GDPR). We keep the other data for 24 months from the last contact.

13. Purchases in the online shop

When you buy a device in the shop we collect the order data: name, email, phone, delivery address, the device and options chosen, your acceptance of the terms of sale and, only if you ask for an invoice, the billing details (tax code or VAT number, recipient code or PEC, address). We use them to perform the contract: to prepare and ship the device, activate it on your account, arrange the installation and assist you (Art. 6(1)(b) GDPR); and for tax and accounting obligations (Art. 6(1)(c) GDPR).

Payment takes place on Stripe's page: card details are handled by Stripe and never reach us. We pass name, address and phone to the courier for delivery. We keep the data of paid orders for 10 years, like accounting records (Art. 2220 of the Italian Civil Code); the data of an unpaid order is deleted within 30 days.