1. Introduction and Data Controller
The QueueFlow platform is operated by Drive Cars Global ("we", "us" or "our"), a business registered in the United Arab Emirates. Drive Cars Global is the data controller responsible for personal data processed through this platform.
We are committed to protecting the privacy of our customers and the end-customers of businesses that use our platform. This Privacy Policy explains what information we collect, the legal basis on which we process it, how we use it, and the rights you have over it.
QueueFlow is developed by the same team behind DriveGlobal. Subscription billing and payment processing for both products are handled through the same Paddle merchant account operated by Drive Cars Global.
2. Information We Collect
Account information: When you register, we collect your name, email address, company name, country, phone number and payment details (processed by Paddle — we do not store card numbers).
Business operational data: Data you enter into the platform, including branch records, services, queue tokens, customer names and contact details, appointment records, and staff information. This data belongs to you and is processed on your behalf.
Usage data: Anonymised data about how you use the platform (page views, feature usage) to help us improve the Service.
Technical data: IP address, browser type, device information and cookies necessary for the platform to function securely.
3. How We Use Your Information
We process your personal data only where we have a valid legal basis to do so, including:
- Creating and maintaining your account and providing the Service (performance of contract)
- Processing subscription payments via Paddle (performance of contract; legal obligations)
- Sending transactional emails (account verification, queue notifications, invoices)
- Service updates and product announcements (legitimate interests; you may opt out where required)
- Detecting and preventing fraud, abuse and security incidents (legitimate interests)
- Complying with tax, financial and regulatory obligations (legal obligation)
- Improving platform features through anonymised usage analytics (legitimate interests)
We will never sell your personal data to third parties for marketing purposes.
4. Data Storage and Security
Your data is stored on Supabase (built on PostgreSQL) with encryption at rest and in transit (TLS 1.2+). We apply row-level security to ensure tenant data isolation — one tenant can never access another's data.
We take industry-standard precautions including access controls, audit logs and regular security reviews. However, no internet-based service can guarantee 100% security.
5. Third-Party Services
We use the following third-party providers to deliver the Service:
- Supabase Inc. — database, authentication and file storage (data processor). Data is hosted on servers within the EU/US.
- Paddle.com Market Limited — Merchant of Record and payment processor (independent data controller). Paddle processes your payment information directly; their use of payment data is governed by Paddle's Privacy Policy.
- Resend Inc. — transactional email delivery from noreply@drivecarsglobal.com (data processor).
- Twilio Inc. — optional SMS/WhatsApp notifications configured by tenants using their own accounts (data processor when enabled).
6. Data Retention
Operational queue data retention depends on your subscription plan: Basic keeps 7 days of detailed queue history and 6 months of summary analytics; Pro keeps 90 days and 24 months; Premium keeps 365 days and 60 months. Records outside these windows are deleted automatically from QueueFlow.
Payment transaction detail is stored by Paddle (Merchant of Record). QueueFlow keeps daily payment summaries for dashboard analytics within your plan window, and loads full transaction history from Paddle when you view your wallet.
We retain your account profile and billing records for as long as your account is active or as needed to provide the Service. If you cancel your subscription, we retain your data for 30 days to allow for re-activation or export. After that period, data may be permanently deleted.
Account holders can download a JSON export of their workspace from Settings → Privacy & data at any time. You can also request a full export by contacting us.
7. GDPR and European Users
If you are in the European Economic Area (EEA), United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) and equivalent UK law apply to our processing of your personal data.
Lawful bases: We process account and billing data to perform our contract with you (Art. 6(1)(b) GDPR). Security, fraud prevention and product improvement rely on our legitimate interests (Art. 6(1)(f)). Tax and legal obligations are processed where required by law (Art. 6(1)(c)).
Processor role: When you use QueueFlow to manage queues and appointments, you act as an independent controller for your end-customers' data. We process that data only on your instructions to deliver the Service. A Data Processing Agreement is available on request for business customers at legal@drivecarsglobal.com.
Supervisory authority: You may lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concern.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your data ("right to be forgotten")
- Object to or restrict processing of your data
- Data portability — receive your data in a machine-readable format
To exercise these rights, email us at privacy@drivecarsglobal.com. We will respond within 30 days.
9. Cookies
We use strictly necessary cookies to maintain your login session and preferences. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this may affect the functionality of the platform.
10. International Transfers
Your data may be processed in countries outside your own. We ensure such transfers comply with applicable data protection laws, including through standard contractual clauses where required.
11. Children's Privacy
The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.
13. Contact and Data Controller Details
The data controller responsible for your personal data is:
Drive Cars Global
United Arab Emirates
Email: privacy@drivecarsglobal.com
For privacy-related enquiries or to exercise your rights, email privacy@drivecarsglobal.com. We aim to respond within 30 days.