Privacy Policy

Route Balance LLC (“Route Balance,” “we,” “us”) provides back-office software to independent mobile tool franchise operators (“Franchisees”) who serve their own customers (“End Customers”) under a franchise agreement with a national tool brand. This Privacy Policy explains what data we collect, how we use it, and the rights you have.

This policy applies to:

• —Franchisees who subscribe to Route Balance.
• —End Customers whose data Franchisees process through Route Balance.
• —Visitors to routebalance.com.

For data Franchisees upload about their End Customers, Route Balance acts as a data processoron behalf of the Franchisee. The Franchisee is the data controller. The Data Processing Agreement (“DPA”) governs that relationship.

1. What We Collect

1.1 Franchisee account data

Name, email, business name, mailing address, phone, franchise dealer code, and authentication credentials when you sign up.

1.2 Subscription billing data

Stripe customer ID, subscription plan, billing history. Card details are stored by Stripe — Route Balance holds only Stripe-issued tokens.

1.3 Operational data Franchisees upload

• —End Customer contact information (name, business name, phone, email, mailing address).
• —Account balances, payment history, promises to pay, credit decisions.
• —Stop histories, queue items, product delivery records.
• —Source exports from your franchisor's operating system and your accounting software.

1.4 Payment processing data (Stripe Connect)

When a Franchisee enables payment collection, we facilitate transactions through Stripe Connect Standard accounts. We receive:

• —Connected Stripe account IDs (acct_*) and onboarding status.
• —Charge, payment intent, checkout session, and invoice object IDs.
• —Payment method tokens (never raw card numbers — those remain with Stripe).
• —Payout, balance transaction, refund, and dispute event records.

1.5 Bank verification data (Plaid)

When an End Customer pays by ACH, bank account information is collected and verified by Plaid, Inc. through its Auth product. Route Balance stores only the tokenized payment method reference (Stripe payment method ID). Raw account and routing numbers are never stored on Route Balance servers.

1.6 Identity verification data

When a Franchisee initiates a credit decision on an End Customer, identity verification is performed by Stripe Identity. The vendor collects and processes identity documents and, where applicable, a selfie biometric for liveness matching. See Section 4 (Biometric Information) below.

1.7 Generated activity data

Collections logs, dispute notes, audit entries, briefing acknowledgments, and other actions taken inside the Route Balance application.

1.8 Service operation data

Server logs (IP address, request method, URL, timestamp, response code), feature usage per tenant, authentication tokens, session identifiers, error and diagnostic data.

1.9 Contact inquiries

If you fill out our contact form, we collect your name, email, company, and message.

1.10 What we do NOT collect

• —Raw payment card numbers, CVV, or full account credentials (held by Stripe, PCI-DSS compliant).
• —Raw bank routing or account numbers (held by Plaid).
• —Identity document images (held by Stripe Identity; we receive pass/fail signal and metadata only).
• —Data from children under 13.

2. How We Use Your Data

2.1 What we do NOT do with your data

• —We do not sell or share Personal Information for cross-context behavioral advertising (CPRA definition).
• —We do not transfer your data to data brokers.
• —We do not share your data with your franchisor, equipment suppliers, or any other third party for their business purposes.
• —We do not use one Franchisee's data to inform another Franchisee's briefings, reports, or models.
• —We do not train machine-learning models on Franchisee or End Customer data.
• —We do not send raw payment data or End Customer PII to third-party large language model providers.

3. Cross-Tenant Isolation

Route Balance is single-tenant by design. One Franchisee’s data is never visible to another Franchisee. Tenant isolation is enforced by row-level security policies in our Postgres database, by signed authentication tokens, and by audited support access controls.

Where Route Balance computes aggregate, fully de-identified product metrics (e.g., total active accounts, anonymized feature usage rates), no individual Franchisee or End Customer is identifiable in those metrics.

4. Biometric Information (BIPA Notice)

This Section applies to End Customers in Illinois and to Franchisees who operate routes in Illinois.

What is collected.When you complete identity verification, Stripe Identity captures a selfie image and may generate a biometric template for liveness matching against your government-issued ID photo. Route Balance does not directly collect, store, or possess the biometric template — it is generated and held by Stripe Identity under their privacy policy.

Purpose. Identity verification for fraud prevention and credit decisioning. We do not use biometric information for advertising, profiling, or any other purpose.

Retention. Biometric data is retained by Stripe Identity for the retention period specified in Stripe Identity's Data Processing Agreement (see stripe.com/legal/identity-privacy), after which it is permanently destroyed.

No sale. Route Balance does not sell, lease, trade, or otherwise profit from biometric information.

Consent. Identity verification is initiated only after the End Customer accepts a standalone biometric consent disclosure presented before the IDV flow begins.

5. Financial Privacy Notice (GLBA)

Route Balance LLC qualifies as a financial institution under the Gramm-Leach-Bliley Act (“GLBA”) for purposes of facilitating Franchisee credit decisions, payment processing, and bookkeeping.

Information we collect about consumers (End Customers)

• —Information from credit-decision and IDV processes.
• —Information from payment and account activity.
• —Information from third parties such as Stripe and identity verification providers.

Information we share

• —With service providers under contract (see Section 6).
• —With the Franchisee who initiated the credit decision (their End Customer).
• —As required by law or to respond to lawful process.
• —Never for marketing purposes.

Right to opt out of sharing for joint marketing or with non-affiliates

Route Balance does not share nonpublic personal information with non-affiliates for joint marketing or for the non-affiliate’s own use. No opt-out is required because no such sharing occurs.

Our security commitment

We maintain administrative, technical, and physical safeguards as required by the GLBA Safeguards Rule. See Section 10.

6. What We Share — Service Providers (Sub-Processors)

We share data only with service providers necessary to operate Route Balance. Each is bound by contract to use data only on our instruction and to maintain appropriate security.

We update this list as our service providers change. Material changes will be communicated under Section 12.

7. Data Retention

Crypto-shredding

On termination or upon a verified erasure request, Route Balance deletes the per-Franchisee Data Encryption Key (DEK) that decrypts stored PII. This renders the encrypted PII permanently irrecoverable, satisfying GDPR Article 17.

NACHA conflict notice

Where applicable state privacy law (e.g., the Texas Data Privacy and Security Act) grants a deletion right that conflicts with the 2-year NACHA retention requirement for ACH authorization records, the federal NACHA rule controls during the retention window. Records are flagged for deletion at the retention mark and purged thereafter.

8. Your Rights

8.1 GDPR (EU / EEA / UK)

• —Access (Article 15) — request a copy of your data.
• —Rectification (Article 16) — correct inaccurate data.
• —Erasure (Article 17) — delete your data (fulfilled by crypto-shredding for PII).
• —Restriction (Article 18) — limit how we process your data.
• —Portability (Article 20) — receive your data in machine-readable form.
• —Objection (Article 21) — object to legitimate-interest processing.
• —Withdraw consent — where processing is based on consent.

Response time: 30 days from receipt.

8.2 CPRA (California)

• —Right to know — categories and specific pieces of Personal Information collected.
• —Right to delete — fulfilled by crypto-shredding.
• —Right to correct — request correction of inaccurate Personal Information.
• —Right to opt out of sale or sharing — Route Balance does not sell or share Personal Information; no opt-out mechanism is required.
• —Right to limit use of Sensitive Personal Information — request that use be limited to necessary service provision.
• —Right to non-discrimination — exercise CPRA rights without discrimination in service or price.

Response time: 45 days from receipt (extendable by an additional 45 days with notice).

8.3 Other US state privacy laws

Where applicable (CO, CT, VA, UT, TX, OR, MT, IA, IN, TN, FL, DE, NH, NJ, MN, MD, RI), residents have substantially similar rights. Submit requests through the contact method in Section 13 and reference your state.

8.4 How to submit a request

Email [email protected] with the subject line “Privacy Request — [your state / regulation].” Include your full name, the email address on file, and a description of your request. We may request identity verification before processing.

We will not charge a fee unless the request is manifestly unfounded or excessive.

9. Cookies and Tracking

10. Security

• —Encryption at rest: PII fields (phone, email, address) encrypted at the application layer using authenticated encryption with per-Franchisee Data Encryption Keys; database-level encryption by the hosting provider for all other fields.
• —Encryption in transit: TLS 1.2 or higher for all client and inter-service traffic.
• —Access control: Route Balance staff access PII only through an audited, role-restricted admin module. Every access is logged.
• —Quarterly audit: Access logs are reviewed quarterly for unauthorized or anomalous activity.
• —Anomaly detection: Automated monitoring on payment activity and operational events with alert escalation.
• —Incident response: In the event of a data breach, affected Franchisees will be notified within 72 hours.
• —PCI scope: PAN data is collected exclusively on Stripe-hosted pages; Route Balance is eligible for SAQ-A.

No system is 100% secure. If you believe your account has been compromised, contact us immediately.

11. International Data Transfers

Personal Data is stored in the United States (Supabase US East / N. Virginia; AWS us-east-1). If Personal Data is transferred from the EEA or UK to the United States, Route Balance relies on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate transfer mechanisms under GDPR Chapter V.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated by email or in-app notice at least 30 days before they take effect. Continued use of Route Balance after the effective date constitutes acceptance.

13. Contact

Privacy Contact: Route Balance LLC
Email: [email protected]
Mailing address: Route Balance LLC, 1311 Commerce Lane, Suite 4, Jupiter, FL 33458

GDPR Supervisory Authority: EU/EEA residents may lodge a complaint with their local data protection authority.

California Privacy Protection Agency: California residents may contact CPPA at cppa.ca.gov.