Privacy & Compliance Policy

Last Updated: October 2026

QuickTrack by Store Technology Group is committed to protecting your privacy and ensuring the security of your data. This policy outlines how we collect, use, store, and protect information in our asset tracking and recovery platform.

Authentication & Access

QuickTrack is a B2B enterprise application available at quicktrackv2.com. Anyone may create an account using email/password or Google Sign-In, but access to application data requires administrator approval. Newly registered accounts are placed in a restricted state until a system administrator assigns organizational permissions. Without approval, authenticated users cannot view any asset, store, or operational data.

Authentication is powered by Base44 and supports:

Email & Password — credentials managed by Base44's secure auth infrastructure.
Google Sign-In (OAuth 2.0) — we receive only your Google account email address and display name. We do not receive your Google password, contacts, calendar, or any other Google data.

Authentication tokens are stored securely and are not shared with third parties outside of Base44's platform infrastructure.

Information We Collect

Account Information

Name and email address
Organization affiliation
Site and logo assignments
User role (admin, user, driver)

Asset Tracking Data

GPS coordinates and location history
Device telemetry (battery voltage, temperature)
Asset identifiers and metadata
Geofence entry/exit events
Recovery route history

Information Collected on a Driver's Phone

Recovery drivers use the app (signed in under My Routes) or a time-limited report link (no account). When a driver uses these features, the following is collected only at the moment they use them:

Precise location (GPS): captured when a driver updates a cart's status or logs an untracked cart, to confirm where the cart was found. Location is not tracked in the background.
Photos: taken with the phone camera as optional recovery evidence. Photos are stored privately and are visible only to authorized users of the owning organization.
Voice commands: if the driver taps the microphone, speech is processed by the phone's built-in speech recognition to update cart statuses. QuickTrack does not store audio recordings.
Status updates and notes: recovered / not found status, optional notes, cart counts, and timestamps.
Driver Assistant chat: questions a driver types to the in-app help assistant and its replies, linked to the driver's route.

Drivers can decline camera, location, or microphone permission in their phone settings and still use the rest of the app. Report links are time-limited and require no PIN or account.

Usage Data

Page views and feature usage
Session information
Actions performed (routes created, emails sent)
Error logs and system diagnostics

How We Use Your Information

•Asset Tracking: Monitor and locate shopping carts and equipment in real-time
•Recovery Operations: Generate optimized routes for asset recovery
•Alert Notifications: Send geofence exit alerts and status updates
•Analytics: Improve service quality and understand usage patterns
•Account Management: Authenticate users and enforce permissions
•Support: Respond to inquiries and resolve technical issues

Data Security

We implement robust, industry-standard security measures aligned with leading cloud security frameworks to protect your data:

Encryption (Transit & Rest): All data is encrypted in transit using HTTPS/TLS, and data exported to Google Cloud Storage is protected at rest with Google-managed AES-256 encryption. Application databases use platform-managed encryption at rest.
Authentication & MFA: Secure login via email/password or Google OAuth 2.0, with multi-factor authentication available (2FA for platform administrators via authenticator app/SMS; app-user MFA enforced through the identity provider when SSO is enabled).
Authorization (Zero-Trust RBAC): Strict role-based access control and row-level security ensure users and internal systems only see data for their explicitly assigned logos and sites — one organization cannot access another's data.
Threat Protection: Continuous input validation to prevent injection attacks, rate limiting against denial-of-service attempts, and regular automated vulnerability scanning of application source.
API & Infrastructure Security: Webhook endpoints protected with API key authentication; cloud resource access uses short-lived, scoped service-account tokens — never long-lived static keys.
Secret Management: All API keys and cloud credentials are stored in a platform-managed secrets vault and injected into backend functions at runtime — never committed to source code or exposed to the client.
Audit Logging: Comprehensive security and diagnostic logs are maintained (API error logs, operational automation logs, and BigQuery analytics) to detect and investigate unauthorized activity.

Data Sharing & Third Parties

We do not sell or rent your personal information. We share data only with:

Service Providers

• SendGrid: Email delivery service
• Google Maps: Routing and geocoding services
• Mapbox: Map display (map tiles are requested based on the area being viewed)
• Google Cloud (BigQuery & Firestore): Storage and analysis of asset location history and current asset state
• AI assistant providers: Driver Assistant and in-app assistant messages are processed to generate replies
• Google Cloud Storage (GCS): Secure object storage (AES-256 at rest) for geofence exports and device registries, accessed via scoped service-account tokens
• Base44: Cloud infrastructure, database hosting, auth, and secrets management

Your Organization

Data is shared within your organization based on assigned permissions (logos and sites).

Legal Requirements

We may disclose information if required by law or to protect our legal rights.

Your Rights

You have the right to:

•Access: Request a copy of your personal data
•Correction: Update or correct inaccurate information
•Deletion: Request deletion of your account and data (subject to retention requirements)
•Portability: Export your data in a machine-readable format
•Opt-Out: Unsubscribe from non-essential email notifications

Account Deletion

You may request deletion of your account and associated personal data at any time by using the Request Account Deletion option in the App's Settings menu. Requests are processed within 1–2 business days. Asset tracking records (which are business records belonging to your organization) may be retained separately per your organization's data policy.

Data Retention

•Asset Location Data: Retained as long as asset is active, with historical data for analytics
•User Accounts: Retained while account is active and for legal compliance period after deletion
•Recovery Reports: Retained for business records and compliance purposes
•Error & Diagnostic Logs: Automatically cleaned after 30 days (last 100 errors retained); operational automation logs retained on a rolling basis
•Security Audit Logs: Diagnostic and access logs maintained to monitor system access and data integrity; a persistent access-audit trail for administrative actions is on the security roadmap

For questions about this privacy policy or to exercise your rights, please contact:

Store Technology Group

Privacy & Compliance Department

storetechgroup.com

Changes to This Policy

We may update this privacy policy from time to time. We will notify users of any material changes by email or through the application. Your continued use of QuickTrack after such changes constitutes acceptance of the updated policy.

QuickTrack Asset Tracking & Recovery Platform