Privacy Policy

The short version

We hold two kinds of information: the details of your own subscription, and the register you keep inside the app. The first is ours to look after. The second is yours — we hold it on your behalf and only do what running the service requires.

We set no cookies. We run no analytics, no advertising pixels and no third-party scripts. We never see your password, and we never see a card number.

We do not sell personal information, we do not share it for advertising, and we do not use it to train anything.

Which of us is responsible for what

For your subscription — the business name, the people you give access to, the billing record — we decide what is collected and why. In European terms we are the controller.

For what you put in the register — the contractors, companies, phone numbers and the history of who took what — you decide. We act on your instructions. In European terms you are the controller and we are the processor.

That matters if somebody in your directory asks to see or delete their details: they should ask you, and you can do it yourself in the app. If they ask us, we will point them to you.

What we collect

• Your people. Name, sign-in email address, an identifier from Google, their role, and which offices they work at.
• Your business. Business and office names, contact email, country and time zone, your plan, and any logo you upload.
• Your directory. The companies and contractors you lend to — name, company, phone number and email address, as you enter them.
• Your register and its history. What was taken, by whom, when, when it was due, when it came back, and any notes made at the counter.
• Alert recipients. The name, email and mobile of anyone you nominate to be told about overdue items.
• Billing. The PayPal transaction, the payer email PayPal gives us, what was bought and when. No card details. Those go to PayPal on their own pages and never reach us.
• An activity log. Who did what in the app and when, so a record can be accounted for later.
• Error reports. When something fails, what failed and roughly where. We keep these short and they are not used to build a picture of anybody.

What we do with it

• Run the service: show you your register, send the reminders you have asked for, and let the right people sign in.
• Take payment, issue invoices, and tell you about your subscription.
• Answer you when you contact us for help.
• Keep the service working and secure — finding faults, preventing abuse, and taking backups.
• Meet our own legal obligations, such as keeping financial records.

Why we are allowed to (for the UK and EU)

Where the UK or EU GDPR applies, we rely on: performance of a contract for everything needed to give you the service you have paid for; legitimate interests for keeping the service secure, preventing abuse and improving it, balanced against your rights; and legal obligation for financial records.

We do not rely on consent for any of it, because none of it is optional extra — and so there is no consent banner to click through.

Who else sees it

Only the services needed to run it, listed below. Each is bound to use the information only to provide their part, and none of them may use it for their own purposes.

We will also disclose information if the law requires it. If we are compelled to hand over a subscriber’s data we will tell them, unless we are forbidden to.

Where it is held

The application and its database run in the United States. Text messages are sent through a provider in Australia, and email through a provider in the United States.

If you are in the UK or the EU, that means your information is transferred outside it. Those transfers rely on Standard Contractual Clauses with each provider.

How long we keep it

History older than two years is set aside as a file you can download, and then removed from the live register. That is deliberate: a record nobody will ever look at is a record that can only ever be a liability.

Your directory, register and settings stay while your account is open, because they are what the service is.

After an account closes we keep everything for 90 days in case the closure was a mistake, then delete it. Financial records are kept for as long as tax law requires.

Your rights

You can ask us for a copy of the personal information we hold about you, to correct it, to delete it, to restrict or object to what we do with it, or to receive it in a portable form. Much of it you can do yourself in the app, immediately, without asking.

Write to privacy@itemtrak.com. We will answer within 30 days. We will not charge you and we will not treat you differently for asking.

If you are unhappy with how we handle it you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or — in the UK or EU — to your own data protection authority.

Security

Sign-in is through Google, so we never hold a password. Each request is checked against the session it belongs to, and every request loads only the data of the business it is for.

Traffic is encrypted in transit. The database is backed up.

No system is perfectly secure. If we become aware of a breach that is likely to cause serious harm, we will notify those affected and the relevant regulator as the law requires.

Children

This is a tool for workplaces and is not directed at children. Where a school records that a student has borrowed something, that record is the school’s and is held under the school’s own obligations, not ours.

Changes to this policy

If we change this policy in a way that matters, we will email the contact address on your account before it takes effect. The date at the top always says when it last changed.