Privacy Policy
Contents
- 1. Introduction
- 2. Data Processing Role
- 3. Information We Collect
- 4. How We Use Your Information
- 5. Sub-Processors
- 6. Third-Party Analytics & Security Services
- 7. Data Security
- 8. Data Retention
- 9. Jurisdiction & Server Location
- 10. Your Legal Rights
- 11. Cookies and Tracking
- 12. Analytics on Our Website
- 13. Changes to This Privacy Policy
- 14. Contact Us
1. Introduction
This Privacy Policy ("Policy") constitutes a binding data processing agreement between the subscribing business entity ("User," "Data Controller," or "You") and HoopoTrack ("Data Processor," "We," "Us," or "the Platform"). This Policy governs the collection, processing, storage, and transfer of personal data in connection with the use of the HoopoTrack platform. By accessing or using the Platform, You acknowledge that You have read, understood, and agree to the terms set forth herein.
2. Data Processing Role
HoopoTrack operates solely as a Data Processor with respect to the personal data of end-customers entered into the Platform by the User. The roles and responsibilities are defined as follows:
The User, the business using HoopoTrack (shop, atelier, garage, laboratory or other service business), acts as the Data Controller. The User determines the purposes and means of processing end-customer personal data and is solely responsible for ensuring that all data submitted to the Platform has been collected lawfully and with appropriate consent.
HoopoTrack acts as the Data Processor. HoopoTrack processes end-customer personal data exclusively on behalf of, and in accordance with the documented instructions of, the Data Controller. HoopoTrack shall not process personal data for any purpose other than the delivery of the agreed-upon services.
The User warrants and guarantees that they have obtained all required legal consents from end-customers prior to entering any Personally Identifiable Information (PII), including but not limited to phone numbers, names, and device details, into the HoopoTrack platform.
3. Information We Collect
In the course of providing services, HoopoTrack collects and processes the following categories of personal data:
-
Identity Data: full legal name, business name, and username of the User.
-
Contact Data: email address, telephone number, and business address of the User.
-
Technical Data: IP address, browser type and version, device identifiers, operating system, and access timestamps.
-
Usage Data: records of Platform interactions, features accessed, pages visited, and session duration.
-
Communication Preferences: the User's elected preferences regarding receipt of service notifications and updates.
-
Service Data: service tickets, status information, tracking page data, and end-customer PII submitted by the User.
-
Payment Records: the prices, quotes, payments received, refunds and payment methods that the User records against its service tickets, and any note written on them. These records are kept on the User's behalf, for the User's own bookkeeping. HoopoTrack does not take, hold or process these payments, and asks for no card details.
4. How We Use Your Information
Personal data is processed strictly for the following lawful purposes:
-
Provisioning and activation of User accounts
-
Delivery, operation, and maintenance of Platform services
-
Communication regarding account matters, technical support, and service notifications
-
Platform improvement, feature development, and performance optimization
-
Provision of relevant service recommendations based on usage patterns
-
Ensuring the security and integrity of service tracking and communication channels
-
Aggregated analytics for system performance monitoring and capacity planning
5. Sub-Processors
HoopoTrack engages the following sub-processors to deliver its services. The User acknowledges and consents to the engagement of these sub-processors for the processing of personal data:
Meta Platforms, Inc. (WhatsApp Business API)
Provides the WhatsApp Business messaging infrastructure used for delivering transactional notifications to end-customers. Data processed includes end-customer phone numbers and message content.
Hosting
Provides the servers on which the HoopoTrack platform and its database run. Our primary servers are located in the European Union, in Amsterdam, the Netherlands.
Email delivery
Delivers the emails HoopoTrack sends, to end-customers and to businesses. Data processed includes email addresses and message content.
Content delivery and file storage
Carries traffic to and from HoopoTrack, which involves processing IP addresses and requests, and stores ticket photos, business logos and encrypted backups.
Video hosting
Streams the product videos on our public website. When a visitor's browser loads or plays a video, the video host and the content-delivery services its player draws on process the visitor's IP address and playback requests. The player sets no cookie and collects no viewing analytics.
Application monitoring
Monitors the platform for errors and slow requests. Data processed includes request details and the technical context of errors, which can contain personal data.
Server management
Used to deploy HoopoTrack and manage its servers, with administrative access to them. It is not used to process personal data, but it can technically reach the data stored on those servers.
Browser push services (Google, Apple, Mozilla, Microsoft)
Relay push notifications to the devices that turned them on. The content is encrypted before it leaves our servers, so these services pass it on without being able to read it.
Subscription payments
Businesses pay for their HoopoTrack subscription through a payment provider that acts as the merchant of record. For that payment the provider is not our sub-processor: it collects and processes the business's billing and payment details as an independent controller, under its own privacy policy. HoopoTrack does not receive card details.
HoopoTrack shall notify the User of any material changes to the list of sub-processors with reasonable advance notice. The User may object to the appointment of a new sub-processor by providing written notice within fifteen (15) days of notification.
A current list of our sub-processors, with their names, is available on request, using the contact details in Section 14.
6. Third-Party Analytics & Security Services
HoopoTrack integrates the following third-party analytics and security services. The User acknowledges and consents to the data processing activities described herein:
Google Analytics
HoopoTrack utilizes Google Analytics for aggregated usage analytics on its public website, under the consent rules in Section 12. Data collected may be transferred to and processed on servers located in the United States, subject to Google's data processing terms and applicable safeguards.
Users may opt out of Google Analytics data collection by installing the Google Analytics Opt-out Browser Add-on.
Microsoft Clarity
HoopoTrack uses Microsoft Clarity on its public website for behavioral analytics, including heatmaps and session replays, to identify usability issues. It runs under the consent rules in Section 12, and interaction data is processed by Microsoft in accordance with Microsoft's Privacy Statement.
Meta Pixel
HoopoTrack uses the Meta Pixel on its public website to record page views, so that it can measure which of its advertisements bring visitors. It runs under the consent rules in Section 12, and the data is processed by Meta in accordance with Meta's Privacy Policy.
Cloudflare Turnstile
HoopoTrack uses Cloudflare Turnstile to tell people from automated abuse: on sign-up, sign-in, password reset and the contact form of its website, and when someone creates a ticket or a client in the app. It checks signals from your browser and your IP address, without tracking cookies and without showing ads. It does not run on the ticket tracking and queue pages that customers open.
Push notifications
If you turn on updates from a ticket's tracking page, or if you use HoopoTrack and allow notifications, your browser gives us a subscription address for that device. We use it only to send the notifications you asked for. Their content is encrypted before it leaves our servers, so the browser's delivery service (such as Google, Apple, Mozilla or Microsoft) passes it on without being able to read it. We delete a customer's subscription 30 days after the ticket is completed, or sooner if the ticket is deleted or the customer is anonymized. We delete a user's when they turn notifications off, sign out on that device, or their account is removed. You can turn notifications off at any time from the tracking page or in your browser's settings.
7. Data Security
HoopoTrack implements appropriate technical and organizational security measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include, but are not limited to, encryption of data in transit and at rest, role-based access controls, regular security audits, and secure development practices.
Access to service tracking pages may be further restricted through PIN protection, which the User is responsible for configuring. HoopoTrack ensures that all personnel with access to personal data are bound by appropriate confidentiality obligations.
8. Data Retention
HoopoTrack retains personal data as follows:
-
End-customer data associated with service tickets is retained for as long as the business's account remains active, or until the business deletes the ticket or anonymizes the client. A deleted ticket remains recoverable by the business for 30 days and is then permanently and irreversibly removed from all active systems.
-
When an end-customer checks in through a business's check-in form, their details are kept as a pending check-in until the business confirms it. A check-in the business does not confirm within the period it has chosen (24 or 48 hours) stops being shown to the business at the end of that period and is then permanently deleted at the next scheduled cleanup. A confirmed check-in becomes part of the ticket data described above, and the pending check-in's own copy of those details is erased at confirmation.
-
User account data is retained for the duration of the active subscription. Upon account termination, account data is deleted within thirty (30) days, except where retention is required by applicable law.
-
Records of the WhatsApp and email notifications sent to end-customers, and the activity log of changes made within an account, are retained for six (6) months and then permanently deleted. The personal content of those notification records is removed sooner if the ticket is permanently deleted or the client is anonymized. These records include the text of each message as it was sent, with any PIN code hidden. That text is kept for the same six (6) months and is removed sooner if the ticket is permanently deleted or the client is anonymized. If a customer's details are erased, the log of messages already sent to them keeps the language each one was sent in until that log is deleted, 180 days after sending.
-
When an end-customer asks to stop WhatsApp messages (for example by replying STOP), HoopoTrack keeps their phone number only in a coded form (a keyed hash), together with internal reference numbers only, for as long as that request stands, so that it is honoured for every business on the Platform. The coded form is used only to honour that request: to recognise the number wherever the Platform sends to it, shows it or hears from it (for example before a message is sent, when a business enters or opens a customer or ticket with that number, or when the number replies STOP or START or WhatsApp reports that it blocked our messages). HoopoTrack does not convert it back into a phone number, export it, or offer any search by it. If the end-customer later asks to receive messages again, the record is permanently deleted six (6) months after that.
-
System access logs and technical data are retained for as long as is necessary for security monitoring, fraud prevention, and the operation of the Platform.
-
Backup copies of data may persist for up to thirty (30) additional days following deletion from active systems to allow for disaster recovery processes.
Where a retention period applies, personal data is securely deleted or anonymized upon its expiry, in accordance with industry-standard data destruction protocols. Independently of any such period, the User may at any time delete a service ticket or anonymize an end-customer from within the Platform; anonymization permanently erases that customer's name, email address and telephone number while leaving the service record itself intact. If that end-customer has asked to stop WhatsApp messages, only the coded form of their number described above is kept after anonymization, so that their request continues to be honoured.
9. Jurisdiction & Server Location
HoopoTrack's primary servers, which run the platform and its database, are located in the European Union, in Amsterdam, the Netherlands. Some of the sub-processors listed in Section 5 may process personal data outside the European Union; where they do, the safeguards described below apply.
All data processing activities conducted by HoopoTrack comply with Moroccan Law 09-08 relative to the protection of individuals with regard to the processing of personal data, as administered by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).
Where personal data is transferred to sub-processors or third-party services located outside the Kingdom of Morocco, HoopoTrack ensures that appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms approved under Moroccan law.
10. Your Legal Rights
Under applicable data protection legislation, including Moroccan Law 09-08, the User and their end-customers are entitled to the following rights:
To exercise any of these rights, please submit a written request to the contact information provided in Section 14 below. HoopoTrack shall respond to all valid requests within thirty (30) days.
12. Analytics on Our Website
This section covers the public HoopoTrack website only: the pages that present the service, such as the home page, the pages for each trade and this policy. On those pages we measure how the website is visited and how our advertisements perform.
On those pages we measure:
-
The pages you view, and the page or advertisement that brought you here
-
Your approximate location, at country level, worked out from your IP address
-
Your device type and browser
-
How pages are used, such as clicks and scrolling, so that we can find what is hard to use
-
Whether a visit came from one of our advertisements, so that we can see which ones bring visitors
These measurements are made by Google Analytics, Microsoft Clarity and the Meta Pixel, all loaded through Google Tag Manager. The same choice also controls instant.page, a small script that starts loading a page when you point at its link, so that it opens faster.
None of these tools runs inside the HoopoTrack app: not on the pages a business signs in to, and not on the tracking and waiting-room pages its customers open. The app sets only the cookies it needs to work and stay secure, such as the one that keeps you signed in.
Depending on the country you are visiting from, these tools either wait for your permission or run from the start. We work out that country from your IP address when the page is served.
In the regions listed below, nothing described in this section is loaded until you allow it on the cookie banner. We apply the same rule whenever we cannot tell which country you are in.
The European Union, including its outermost regions (French Guiana, Guadeloupe, Martinique, Mayotte, Réunion and Saint Martin) and the Åland Islands; Iceland, Liechtenstein and Norway; Switzerland; the United Kingdom, Gibraltar, Jersey, Guernsey and the Isle of Man; the Faroe Islands, Monaco, San Marino, Vatican City and Andorra; Brazil, Türkiye, South Africa, Canada, South Korea and China; and the territories that follow European rules.
Everywhere else, these tools run by default and a short notice on the website says so. You can opt out from that notice at any time, and none of them is loaded on the pages you open after that. Opting out also deletes the analytics cookies these tools set on our site; cookies they set on their own sites are outside our control.
Whichever way you choose, we also pass your choice to Google's tools and to Microsoft Clarity as a consent signal, so they respect it.
Outside the regions listed above, a Global Privacy Control signal from your browser is treated as an opt-out, unless you press OK while the signal is on. In those regions, an explicit Accept on the banner applies.
Your choice is remembered on that browser for 13 months, or until you clear or change it. It applies to that browser only, so another browser or device will ask or notify you again.
You can change your choice at any time from the Cookie settings link in the site footer.
13. Changes to This Privacy Policy
HoopoTrack reserves the right to amend this Privacy Policy at any time. Material changes shall be communicated to Users via email or prominent notice on the Platform, and the "Last updated" date shall be revised accordingly.
Continued use of the Platform following the publication of any amendments constitutes the User's acceptance of the revised Policy. Users are advised to review this Policy periodically.
14. Contact Us
For any inquiries, data subject requests, or communications regarding this Privacy Policy, please contact us at: