Made in Sweden · hosted in the EU
Inventory and equipment tracking, made in Sweden, hosted in the EU.
ItemTally is built by Ethereal Labs AB, a small company in Göteborg. Your register is stored in the EU with Hetzner. This page says where every piece of your data goes, including the parts that don't stay in Europe, so you can answer your own data-protection questions without a sales call.
- Company
- Ethereal Labs AB, org.nr 559380-1698
- Registered
- Gyllenkrooksgatan 23, 412 82 Göteborg, Sweden
- Register database
- Hetzner, EU data centres (Germany, Finland)
- Terms governed by
- Swedish law
Where your data lives
Four kinds of data, in four places. The register itself, which is most of what you put in, stays in the EU.
The register
Items, quantities, folders, custom fields, the logbook, people you lend to, reservations, kits, and your account.
PostgreSQL on Hetzner in the EU. The database has no public address; only the ItemTally server talks to it.
Photos, documents and signatures
Item photos, attached documents such as receipts and manuals, and the signature drawn at a hand-over.
Cloudflare R2 object storage. Documents are served only to signed-in members of your workspace.
Invites, receipts, reminders before something is due, digests and alerts you turned on.
Sent through Resend. The message passes through Resend on its way to the recipient.
Billing
Your billing name, address and card details, on a paid plan only.
Held by Polar and its card processor, Stripe. We never see your card number.
Who processes what
Every company that handles data from your workspace, what it sees and where. Some are US companies, and we name them rather than hide behind the word "EU".
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Hetzner Hetzner Online GmbH, Germany | Runs the servers and the database. | Everything in your register and your account. | EU (Germany, Finland) |
| Cloudflare Cloudflare, Inc., USA | Serves this website and the web app, protects the API from attacks, and stores files in R2. | Requests pass through its network encrypted. R2 holds photos, documents and signature images. | Global network |
| Resend Plus Five Five, Inc., USA | Sends e-mail. | Recipient address and the message, which can name items and people. | USA |
| Polar Polar Software, Inc., USA | Sells paid plans as merchant of record and handles VAT. Uses Stripe for cards. | Billing details only. Never your register. | USA |
| Sentry Functional Software, Inc., USA | Error reports when something breaks in the app or the API. | Technical details of the error, such as the page and the browser. | USA |
| Anthropic Anthropic, PBC, USA | Ask ItemTally, photo suggestions and receipt import, only when someone in your workspace uses them. | The question, photo or receipt, and the register details needed to answer it. | USA |
This website counts visits with Umami, which we run ourselves on Hetzner in Germany. It sets no cookies and builds no profile. Last reviewed 16 October 2026; when this list changes, we update it here and in the privacy policy.
For your register, we're the processor
Your organisation decides what goes into the register and why, so you're the controller. Ethereal Labs AB is the processor: we store and handle that data only to run ItemTally for you, and we don't use it for anything else.
For your account, we're the controller
Sign-in details, billing and how you use the service are ours to look after as controller. We use them to run your account, send the e-mail you'd expect and take payment. The privacy policy has the detail.
Take everything with you
Any editor can download the whole workspace as one ZIP of plain CSV files: items, archived items, the full logbook, people, folders, reservations and kits. It works on every plan, including the free one, and on the day you leave. That's written into the pledge.
Delete it for good
The workspace owner closes the workspace from settings. It stays recoverable for 30 days in case you change your mind, then the workspace and everything in it is deleted. For a single person, editors can correct or archive them in the app; for anything else, e-mail [email protected].
The security basics
- All traffic to ItemTally is encrypted with TLS.
- Passwords are stored as one-way hashes, never in the clear. The session cookie is HTTP-only, so page scripts can't read it.
- Single sign-on with OpenID Connect, such as Google Workspace, Microsoft Entra or Okta.
- Roles and room keys: owners and admins edit, borrowers take and return, viewers look, and a room key limits someone to their own folders.
- The logbook is append-only. Every quantity is the sum of its history, and nothing is silently overwritten.
- Rate limits on the API, daily database backups kept off-site, and a restore drill that checks a backup actually restores.
More on how it's run, and how to report a problem, on the security page.
For schools and public bodies
Schools, councils and public bodies usually fill in a data-protection checklist before buying anything. These are the questions we see most, answered. Copy them into your form.
- Who is the supplier?
- Ethereal Labs AB, a Swedish limited company, org.nr 559380-1698, Göteborg. Our terms are governed by Swedish law.
- Where is the data stored?
- The register database is with Hetzner in the EU. File storage, e-mail and billing use the providers in the table above, with their countries named.
- What personal data does it hold about pupils or members of the public?
- A name, and an e-mail address only if you add one. Borrowers don't need an account: their My things link shows what they hold and lets them return it.
- Can staff sign in with our identity provider?
- Yes, with any OpenID Connect provider. SAML isn't supported.
- Is there an audit trail?
- Yes. The logbook records every change with who, what and when, and it can't be edited after the fact.
- Can we get all our data out?
- Yes, on every plan. One click downloads a ZIP of plain CSV files: items, archived items, the whole logbook, people, folders, reservations and kits.
- What happens when we stop?
- The owner closes the workspace in settings. You have 30 days to change your mind, then it's deleted with everything in it.
- Do you hold SOC 2 or ISO 27001?
- Not yet. We'd rather say so than show a badge we haven't earned. The security page describes what we do instead.
- How do we pay?
- Paid plans are sold through Polar as merchant of record, so the receipt and the VAT treatment come from Polar. The free plan needs no payment details.
Running a school register? See ItemTally for schools.
Questions about data and Europe
Is ItemTally GDPR compliant?
No software is GDPR compliant on its own; it depends on how you and we handle the data. What we do: the register is stored in the EU, we act as your processor and use it for nothing else, we name every sub-processor on this page, and you can export or delete everything yourself.
Is my data hosted in Sweden?
No. The company is Swedish, and the register is hosted in the EU with Hetzner, in Germany or Finland. We say EU-hosted because that's what it is.
Does any data leave the EU?
Some does, and the table above says which. Requests pass through Cloudflare's global network, and photos are stored in Cloudflare R2. E-mail goes through Resend, payments through Polar and Stripe, error reports to Sentry, and Ask ItemTally questions to Anthropic. Cloudflare, Resend, Polar, Sentry and Anthropic are US companies.
What about the US CLOUD Act?
Ethereal Labs AB and Hetzner are European companies, which is why the register database lives with Hetzner. The US providers in the table are subject to US law for the data they handle. If that rules them out for you, tell us which parts matter and we'll tell you plainly what we can and can't change.
Do you use our data to train AI?
No. Ask ItemTally sends a question and the register details needed to answer it to Anthropic only when someone uses it, and Anthropic's commercial terms don't let it train models on that data.
Who at ItemTally can see our register?
Alex, the founder, when you ask for help with something specific. Nobody browses customer registers.
How do we exercise data-subject rights for a borrower?
Editors can correct or archive a person in the app, and the CSV export gives you a copy of what's held about them. For anything you can't do yourself, e-mail support and a person will do it.
Something on your checklist that isn't here? E-mail [email protected] with the question. I'll answer it in writing, and if it's a common one it goes on this page. Alex
A Swedish company. Your register in the EU.
Free forever for one editor and ten borrowers. Export everything any day.
Free for one editor and ten borrowers, with unlimited items. No card needed.