Privacy

Who is responsible

Orangelab AB, org.nr 559042-9832, Broddgränd 5, 129 46 Hägersten, Sweden. VAT SE559042983201. is the data controller. Questions go to [email protected].

What we store and why

Your account. Your email address and preferred language, so you can sign in and get receipts. Legal basis: our agreement with you.

Your tags. What you enter for each tag: headline, message, language, phone number and email address. Only what you tick is shown on the tag page. Legal basis: our agreement with you.

Your orders. Which pack, the amount, currency, VAT, country and the payment reference. We keep these for bookkeeping. Legal basis: legal obligation under the Swedish Bookkeeping Act.

Sign-in links. Stored only as a scrambled hash and deleted within a day after they expire.

Card details. Handled by Stripe. We never see or store them.

People who scan a tag

We do not log who scans a tag. Tag pages have no cookies and no scripts. Our hosting provider Cloudflare handles technical data such as IP addresses to deliver the page and protect it against attacks.

Cookies

The only cookie is the one that keeps you signed in on app.thingstag.com, for up to 30 days. It is strictly necessary, so there is no cookie banner. The public website sets no cookies.

To count visits, the website and app.thingstag.com use Cloudflare Web Analytics. It sets no cookies, does not store your IP address and does not follow you across sites. Tag pages are not counted.

Who else handles data

Cloudflare runs our hosting, database, file storage and visitor statistics on its global network, under the EU–US Data Privacy Framework and standard contractual clauses.

Stripe handles payments and is responsible for payment data under its own privacy policy.

Amazon Web Services sends our emails, from its EU region in Ireland.

Sentry receives error reports from its EU region in Germany. Error reports leave out form content, cookies and contact details.

How long we keep it

Your account and tags: until you ask us to delete them. Orders: seven years, as bookkeeping law requires. Sign-in links: at most a day after they expire. Error reports: 90 days. Backups: 90 days, so deleted data is gone from them within 90 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and get it in a portable format. Email [email protected]. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY).

Changes

If we change this policy in a way that matters to you, we tell you by email.