Security & your data

Your data. Kept in the EU, kept simple.

Here’s exactly what we collect, where it lives, who can see it, and what we’d never do with it - in plain words, because that’s the point.

The short version

Your items are never metered. Your price never rises on you. Your data is never held hostage. Everything below is just us showing our work.

What we store

The stuff you’d expect: your items, quantities, folders, tags, the people you check gear out to, movement history, and your account details. That’s it. We don’t track your customers, and there’s no advertising profile of you being built in the background.

Where it lives

ItemTally is hosted in the EU on European infrastructure - not “an EU region of a US cloud,” actually EU-hosted. Your data doesn’t leave it. If you’re in Europe and tired of the fine print, this is the whole point.

How it’s protected

Everything is encrypted in transit (TLS) and at rest. Backups run automatically every day, are kept off-site, and we test that they actually restore - a backup you’ve never restored isn’t a backup. Payments run through Stripe, so we never see or store card numbers.

Who can see it

A very short list. Me (Alex, the founder) for support when you ask - and that’s essentially it. ItemTally is self-hosted on European infrastructure, so your inventory isn’t handed out to a pile of third-party subprocessors. The one exception is Stripe, which handles payments if you’re on a paid plan and only ever sees your billing details - never your inventory.

We never sell your data, never advertise against it, and never use it to train anything.

Your data is yours - and you can prove it

Export everything to CSV any time, no support ticket required. Cancel and it’s still yours on the way out. Delete your account and your data is gone from our systems within 30 days. No hostage-taking, ever - it’s in the pledge.

Why should you trust me?

Fair question. Here’s the honest part: ItemTally is a small, founder-run company. We don’t have a SOC 2 report or an ISO certificate yet - those come as we grow, and I’d rather tell you that than paste a badge I haven’t earned. What we do have is a simple, legible setup you can actually understand, a real person accountable for it, and a public track record. Trust the mechanisms, not the marketing.

Compliance & the paperwork

ItemTally is built GDPR-first. Need a signed DPA for your records? Email us and you’ll have one. The stack is deliberately small, so there’s little to disclose - ask and I’ll walk you through exactly what runs and where.

Found a problem?

Email [email protected]. A human - usually me - reads it, and you’ll get a real reply, not a ticket number.