Privacy Policy

1. Information We Collect

Account Information

• Email address (required for account creation)
• Display name (optional)
• Bio (optional)
• Password (stored securely, never in plain text)

Inventory Data

• Asset information (names, descriptions, categories, quantities, values)
• Location data you create within the app
• Custom fields and field templates
• Images you upload for assets
• Brands, statuses, categories, and types you define

Payment Information

When you subscribe to a paid plan, payment details (such as your name, email, and payment method) are collected and processed directly by our payment processor, Stripe. We do not store your full payment card details on our servers. We may receive limited billing information from Stripe (e.g., last four digits of your card, billing email) for invoice and support purposes.

Usage Data

• Scan history (stored locally on your device)
• UI preferences (theme, sidebar state)
• Export history
• Analytics data via Google Analytics (pages visited, session duration, device/browser type) — only if you consent to analytics cookies

2. Lawful Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)) — Processing your account data and inventory data is necessary to provide the My Pro Inventory service you signed up for.
• Consent (Art. 6(1)(a)) — You provide consent when creating your account and agreeing to our Terms of Service and this Privacy Policy. Analytics cookies (Google Analytics) are only activated with your explicit consent via the cookie banner. You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)) — We may process limited data (e.g., usage preferences, export history) to improve service reliability and user experience. This processing is proportionate and does not override your rights.

3. How We Use Your Information

We use your information solely to:

• Provide and maintain the inventory management service
• Authenticate your identity and secure your account
• Store and display your inventory data
• Generate analytics and reports on your inventory
• Process subscription and plan management
• Communicate important service updates

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Data Storage & Security

Your data is stored securely using Supabase, a cloud-hosted database platform built on PostgreSQL. We employ the following security measures:

• Row Level Security (RLS) policies ensuring users can only access their own data
• Encrypted connections (HTTPS/TLS) for all data in transit
• Passwords are hashed and never stored in plain text
• Authentication tokens with automatic expiration

5. International Data Transfers

Our infrastructure provider, Supabase, may store and process data in data centres located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission
• A Data Processing Agreement (DPA) with Supabase ensuring GDPR-compliant data handling
• Technical security measures including encryption in transit and at rest

6. Cookies & Local Storage

We use essential cookies and local storage for core functionality, and optional analytics cookies (Google Analytics) to understand how the application is used. Analytics cookies are only activated with your explicit consent. For detailed information, please see our Cookie Policy.

7. Third-Party Services

We use the following third-party services:

• Supabase — database hosting, authentication, and file storage. A Data Processing Agreement (DPA) is in place to ensure GDPR-compliant processing of your personal data.
• Stripe — payment processing for subscriptions. Stripe acts as a data processor and handles payment card details, billing email, and transaction data on our behalf. A Data Processing Agreement (DPA) is in place. Stripe's privacy policy is available at stripe.com/privacy.
• Google Analytics (GA4) — analytics service provided by Google Ireland Limited, used to understand how visitors interact with the application (pages visited, session duration, device type). Analytics data is collected only with your explicit consent. Google may process this data on servers outside the EEA under Standard Contractual Clauses. Google's privacy policy is available at policies.google.com/privacy.

We do not use any third-party advertising or social media tracking services.

8. Your Rights (GDPR Art. 12–23)

Under the GDPR, you have the right to:

• Access (Art. 15) — View all data we hold about you through the application
• Rectification (Art. 16) — Update your profile and inventory data at any time
• Erasure (Art. 17) — Request complete deletion of your account and all associated data through your profile settings
• Restriction (Art. 18) — Request restriction of processing in certain circumstances
• Portability (Art. 20) — Export your data in standard machine-readable formats (JSON, CSV)
• Objection (Art. 21) — Object to processing based on legitimate interests
• Withdraw consent — Withdraw consent at any time by deleting your account, without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at customer@heratoon.com. We will respond to your request within 30 days.

Right to lodge a complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

9. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data (profile, assets, categories, locations, custom fields, and other inventory data) is permanently removed from our systems.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Swedish supervisory authority (IMY) within 72 hours of becoming aware of the breach, as required by Art. 33 GDPR
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by Art. 34 GDPR
• Document the breach, its effects, and the remedial actions taken

11. Children's Privacy

My Pro Inventory is not intended for use by children under the age of 16 (as per GDPR Art. 8 and Swedish law). We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: