The short version: we collect what’s needed to run your inventory and your account, keep it in the EU, and never sell it or use it for advertising. You can export it or delete it at any time. Everything below is the detail behind that.
Who we are
ItemTally is a product of Ethereal Labs AB (org.nr 559380-1698), a company registered at Gyllenkrooksgatan 23, 412 82 Göteborg, Sweden, run by its founder, Alex. For the purposes of the GDPR, Ethereal Labs AB is the data controller for your account data and the data processor for the inventory data you put into the app. You can reach a real person at [email protected].
What we collect
- Account details - your name, email address, workspace name, and a hashed password (we never store it in the clear).
- Your inventory - the items, quantities, folders, tags, photos, custom fields, the people you check gear out to, and the movement history you create. This is yours; we only hold it so the app works.
- Billing details - on a paid plan, your billing information is handled by Polar, our merchant of record, which uses Stripe for cards. We never see or store your card number.
- Basic technical logs - IP address and timestamps, kept briefly for security and to keep the service running. No advertising profile of you is built anywhere.
Cookies & analytics
The app uses a single session cookie to keep you signed in. That’s it - no advertising cookies, no cross-site trackers. Our marketing site uses cookieless, privacy-friendly analytics (self-hosted Umami) to count visits in aggregate; it sets no cookies and builds no personal profile, which is why you won’t see a cookie banner.
How we use your data
Only to run the service you asked for: showing you your inventory, sending the emails you’d expect (verification, invites, alerts you turned on, and receipts), providing support, taking payment, and keeping the service secure. We do not sell your data, rent it, advertise against it, or use it to train anything.
Who we share it with
Only the services that make ItemTally work, each seeing only what its job needs: Hetzner (hosting, Germany or Finland), Cloudflare (network delivery for the app and API, and storage for photos, documents and signatures), Polar (billing, as merchant of record, with Stripe for cards), Resend (e-mail such as receipts and reminders), Sentry (error reports, when switched on) and Anthropic (only when you use an AI feature). Some of these are US companies. The full list, with what each one sees, is on the EU hosting page. Beyond that, we only disclose data if the law genuinely requires it, and we’d push back on anything overreaching.
Connected assistants
If you connect an assistant such as Claude or ChatGPT, it can read what you could read in the one workspace you chose, and nothing else. It only receives what its questions return, at the moment it asks. Changes it prepares are written only after you confirm them, and each is logged under your name. Once an answer reaches your assistant, its provider handles it under your account with them; we send them nothing on our own initiative, and we don't keep or read your conversations. You can disconnect any assistant at once in Settings → API and MCP, and connections end automatically when you leave the workspace.
Where your data lives
Your register (items, people, movements and settings) lives in a database hosted in the EU, on Hetzner in Germany or Finland. The services listed above handle specific parts of it, and some of them are outside the EU; the EU hosting page says exactly which. More on how it’s protected on the security page.
How long we keep it
For as long as your account is active. If you close your workspace, there’s a 30-day grace period in case it was a mistake; after that your data is deleted from our live systems and then rotates out of our backups. You can export everything as CSV before you go, see below.
Your rights
Under the GDPR you can, at any time:
- Access and export your data - full CSV export is built in, on every plan, free.
- Correct anything that’s wrong - mostly you can just edit it in the app.
- Delete your account and data - cancelling is a button, not a phone call.
- Object or restrict how we process it, and ask for a copy in a portable format.
To exercise any of these, or to complain, email [email protected]. You also have the right to lodge a complaint with your local data-protection authority.
How we protect it
Everything is encrypted in transit (HTTPS), backups run daily and are restore-tested, and payments run through Polar and Stripe, so we never touch card data. The full picture is on the security page.
Nobody at ItemTally browses your register. If you ask us for help, our support may open your workspace read-only for up to 24 hours, with a stated reason. Every access, and its reason, appears in your workspace’s activity log. Account details such as your name, e-mail and plan are visible to us so we can run your account and help you.
Children
ItemTally is a business tool and isn’t directed at children. We don’t knowingly collect data from anyone under 16.
Changes to this policy
If this policy changes, we’ll update the date above and, for anything material, tell you by email. In the spirit of the pledge, we won’t quietly weaken your protections.
Contact
Questions or requests: email [email protected] and a human, usually Alex, will answer. We’re preparing a standard Data Processing Agreement; if you need one, write to us and we’ll send it as soon as it’s ready.