# Privacy Policy – StoreControl
**Last updated:** May 23, 2026
Hasic App ("we", "us") respects your privacy. This policy explains what information we collect when you use the StoreControl app, how we use it, and what rights you have.
## 1. Data Controller
**Hasic App**
Business registration number: 937 544 588
Norway
Contact: privacy@storecontrol.no
## 2. What information we collect
**Account information:**
- Email address (for one-time-code login)
- For employees in a team room: an anonymous user ID without email
**Content you enter in the app:**
- Expiry dates of items
- Photos of items
- EAN barcodes
- Categories and subcategories
- Notes
- Tasks and routines
- Room / store name
**Technical information:**
- Push notification token (for expiry alerts)
- Device information (operating system, app version) for troubleshooting
**Crash reports (via Sentry):**
- Stack trace when the app crashes or encounters an unexpected error
- Device model, OS version, app version
- Navigation history within the app just before the crash (screen names only, not their content)
- IP address, user ID, and the contents of your items are NOT collected
We do not collect location, contacts, microphone data, or any other information beyond what is listed above.
## 3. Why we process your data
We process your personal data to:
- Deliver the app's features (store your items, send alerts)
- Provide real-time team sharing between members of the same room
- Send expiry date notifications
- Maintain and improve the service
- Comply with legal obligations
**Legal basis** (GDPR Article 6):
- Contract (performance of the service you use)
- Legitimate interest (security and bug fixing)
- Consent (push notifications — can be withdrawn in app settings or your operating system)
## 4. Sharing with third parties
We share data with the following data processors that help us deliver the service:
- **Supabase** – database and file storage
- **OpenFoodFacts** – EAN code lookups (only the EAN code is sent, no personal data)
- **Expo (EAS)** – app builds and push notification delivery
- **Google FCM** – push notifications on Android
- **Apple APNs** – push notifications on iOS
- **Cloudflare** – email handling for support
- **RevenueCat** – payment and subscription management
- **Sentry** (Functional Software, Inc.) – crash reporting and error diagnostics. Data is stored on servers in EU/Germany and automatically deleted after 30 days. DPA: sentry.io/legal/dpa
We never sell your personal data to third parties.
## 5. Transfers outside the EU/EEA
Some of our data processors are located outside the EU/EEA, primarily in the United States. Such transfers are based on the EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework, which ensure adequate protection of personal data.
## 6. Data retention
We retain personal data as long as you have an active account. When you delete your account, all your personal data and content you have entered is deleted within 30 days.
Aggregated and anonymous product data (such as EAN-to-category mappings in the global product database) may be retained to improve the service for all users, as this cannot be linked back to you as a person.
## 7. Your rights
Under GDPR, you have the right to:
- **Access** the data we hold about you
- **Rectify** inaccurate information
- **Delete** your account and all your personal data
- **Restrict** processing
- **Data portability** – receive your data in a machine-readable format
- **Object** to processing
- **Withdraw consent** at any time
Requests should be sent to: **privacy@storecontrol.no**
You may also file a complaint with the **Norwegian Data Protection Authority (Datatilsynet)** at [datatilsynet.no](https://datatilsynet.no).
## 8. Security
We use industry-standard encryption (HTTPS/TLS) for all data transfers between the app and our servers. Passwords and authentication tokens are never stored in plain text. Access to data is restricted through Row Level Security, ensuring users only see their own data and data shared with them.
## 9. Children
StoreControl is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and discover that your child has provided us with personal data, contact us at privacy@storecontrol.no and we will delete it.
## 10. Changes
We may update this policy. Material changes will be announced in the app before taking effect. The date of the last update is shown at the top.