Privacy.

1 · Who we are

The data controller is Digikamu Oy, Business ID 3588277-9, Finland. Contact: open the chat assistant in the corner of any page and click Email us; the message reaches us directly. We don't have a separate DPO; use the contact form for GDPR requests.

2 · What data we collect

We try to collect as little as possible. The categories below are everything we collect today.

• Account data — email address, hashed password (or one-time tokens used for invites and password resets), and a workspace name when you sign up.
• Workspace data — company name, business ID, country, optional VAT/EORI, optional public contact and registered address. These appear on your public passport pages when you choose to publish.
• Product / passport data — the product names, materials, photos, and other ESPR fields you enter. This is published only when you set a passport to Active.
• Passport views — aggregate opens of your public passports, from links and QR scans together, including repeat visits (country-level, no IP storage, no cookies). Used to show passport activity, not unique people or QR-only traffic.
• Site and app usage — aggregate page views, page performance and counts of actions such as starting signup or downloading a QR. Analytics events do not include your email, product name or a persistent visitor identifier.
• Signup attribution — the referring site and campaign tags visible on the signup page, plus the country your connection came from at signup (derived from IP; the IP itself is not stored). Kept with your workspace so we can tell which channels bring customers.
• Billing data — Stripe or Shopify handles payment, depending on your workspace's billing channel. We store plan, customer, subscription and checkout identifiers, plus the company and contact details, selected billing options and attempt state needed to resume a checkout safely. We never see or store card details.
• Operational logs — Vercel keeps short-lived access logs for security and reliability. Sentry stores application errors and, when an error occurs, a session replay with all text masked and media blocked. Both retain data for 30–90 days.
• Support messages — your contact details, message, source page and any conversation you submit with it, plus the team's email replies and delivery records. These are available only to the team in a private support inbox, not on public passports.

3 · What we don't collect

• No advertising cookies, Meta Pixel or Google Ads website tag.
• No Google Analytics or LinkedIn insight tag.
• No reading of your inbox, files, or anything outside the app.
• No sale of personal data to anyone — ever. (We don't even have a business model that would let us.)

4 · Where it's stored

Database and file storage are in the EU. Some processors below involve transfers outside the EU, including internal notifications and AI assistance when you choose to use it.

• Database & file storage: Supabase, Stockholm (Sweden).
• Web hosting & edge: Vercel, EU regions.
• Transactional email: Resend, EU.
• Error tracking: Sentry, hosted in the EU (Germany). When an error occurs, a session replay may be recorded with all text masked and media blocked; no replay is recorded for sessions without errors. If you prefer not to have errors logged at all, email us and we can disable it for your account.
• Billing: Stripe (Ireland).
• Internal notifications: Discord (US). When a workspace is created or its first passport goes live, our team receives a short notification with the company name, country and signup source — never your email address or passport contents. Support handoffs and daily reminders link to the private support inbox; contact-form alerts and the daily count do not include the customer's message or email address.
• AI assistance: Anthropic. AI-fill sends the text or image you provide to Anthropic's API (US-hosted). The product assistant and support-message check also use that API. When the team chooses to prepare a support reply with AI, it sends the message, relevant conversation and operator context to generate a draft. A person reviews the draft before sending. Anthropic does not train on API traffic.

5 · Cookies

Necessary cookies keep you logged in and protect requests. Vercel Web Analytics and Speed Insights report aggregate page and performance data without analytics cookies. Campaign tags may travel in links while you browse our public pages. When you sign up, we may record those tags and the referring site with your account to measure signups and subscriptions from a campaign.

We do not use advertising cookies or send account and subscription events to Meta or Google. Internal campaign attribution does not use advertising identifiers, tracking cookies or persistent browser storage. We remove first-party advertising cookies and measurement settings left by our retired optional advertising tags when you return. This does not erase information already received by the providers.

6 · Legal basis for processing

• Contract (GDPR Art. 6(1)(b)) — account data, workspace data, product data are processed to deliver the service you signed up for.
• Legal obligation (Art. 6(1)(c)) — billing records retained for Finnish accounting law (6 years).
• Legitimate interest (Art. 6(1)(f)) — operational logs and error tracking, narrowly scoped, to keep the service available and secure; limited signup source and campaign information to understand which channels bring customers, without cross-site tracking or sharing customer identities with advertising platforms.

7 · How long we keep it

• Account & workspace data: while your account is active and for 30 days after deletion (recoverable on request).
• Passport data: kept while the passport is a Draft, Live, Deactivated or Archived — a passport that has been published retains a resolvable QR destination after deactivation. Permanently deleting one removes it from the database and storage immediately.
• Billing records: 6 years (Finnish accounting law).
• Operational logs: 30–90 days, then automatically purged by the provider.

8 · Your rights under GDPR

You can ask us to:

• Access — a copy of the data we hold about you.
• Rectify — fix anything that's wrong.
• Erase — delete your data (subject to retention obligations above).
• Restrict — pause processing while a complaint is resolved.
• Object — to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.

Open the chat assistant on any productpasses.com page and click Email us to send your request through to the team. We respond within 30 days. If you're not satisfied, you can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

9 · Public passport data

Anything you publish on a passport page (product details, materials, your company name as the brand) becomes public at productpasses.com/p/<slug>. That's the point — DPP is about consumer-visible traceability. Deactivated passports stay scannable for your grace period, then show a read-only “no longer active” page. They never 404. That read-only record (product name, subtitle, passport ID) stays public for the retention period above. Permanently deleting the passport is the only thing that removes the data.

10 · Children

productpasses.com is a business tool. We don't knowingly create accounts for anyone under 16. If you believe a child has created an account, email us and we'll delete it.

11 · Changes

When we update this page meaningfully, we'll bump the “last updated” date and notify existing customers by email. Cosmetic edits don't trigger a notification.

12 · Plain-English summary

We collect what we need to run your account. We store it in the EU. We don't sell it. Optional Meta and Google ad measurement stays off unless you allow it, and you can withdraw that choice. You can delete your data whenever you want. Questions: ask the chat assistant on any page; if the bot can't answer, “Email us” in the chat routes to a human.