Privacy Policy
Effective date: September 09, 2026
1. Who is responsible for your data
The controller for personal data processed through the MyItems mobile app, the MyItems web application and myitems.com (together, the “Service”) is:
Assetment Software AS, Ellingstranda 24, 1642 Saltnes, Norway
Organisation number: 917 723 621
Email: hello@myitems.com
2. Summary
- We process the data you give us to run your account and store the items and receipts you register.
- We do not sell your data and we do not use your items, photos or receipts for advertising.
- Payments are handled by Apple, Google or Stripe – we never see your full card number.
- You can access, export, correct and delete your data yourself in the app.
- Data is stored in [the EEA / country]; where we use providers outside the EEA, transfers are protected by approved safeguards.
3. What data we process and why
| Purpose | Data | Legal basis (GDPR art. 6) |
| Creating and running your account – login, sync between devices, support | Email address, name, password (hashed), language, country, account settings | Contract (art. 6(1)(b)) |
| Storing your items and documents – the core function of the Service | Item descriptions, categories, values, purchase dates, photos, receipts, warranties, notes and any other content you upload. Receipts and photos may incidentally contain personal data about others (e.g. a shop employee’s name). | Contract (art. 6(1)(b)) |
| Optional profile and address details you choose to add | Phone number, address, postcode, city | Contract / consent, depending on the feature |
| Payments and subscriptions | Subscription plan, status, transaction IDs and dates, currency, amount; billing name and address for web purchases. Card details are handled by Apple, Google or Stripe and never stored by us. | Contract (art. 6(1)(b)); legal obligation for accounting records (art. 6(1)(c)) |
| Sending service messages – renewal reminders, price changes, changes to terms, security notices | Email address | Contract / legal obligation |
| Marketing emails and newsletters | Email address, name, subscription status, language, engagement (opens/clicks) | Consent (art. 6(1)(a)), or legitimate interest (art. 6(1)(f)) for existing customers regarding similar services, in line with the Marketing Control Act. You can opt out at any time. |
| Keeping the Service secure and working – error logging, abuse prevention | IP address, device type and identifiers, operating system, app version, crash logs, timestamps of requests | Legitimate interest (art. 6(1)(f)) in a secure and functioning service |
| Understanding how the Service is used – aggregated analytics | Pseudonymised usage events (screens viewed, features used), device and app version [via Firebase Analytics / other] | Consent for non-essential analytics (see section 8); legitimate interest for strictly necessary, aggregated statistics |
| Customer support | Your messages to us and the data needed to answer them | Contract / legitimate interest |
| Complying with the law – accounting, tax, responding to lawful requests | Transaction and invoice data, correspondence | Legal obligation (art. 6(1)(c)) |
| Establishing or defending legal claims | Relevant account and correspondence data | Legitimate interest (art. 6(1)(f)) |
We do not process special categories of personal data (such as health data) intentionally. Please avoid uploading such information.
We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you.
4. Where the data comes from
Almost all data comes directly from you. We also receive purchase and subscription status from Apple and Google when you subscribe through their stores, and payment confirmations from Stripe for web purchases. Usage and diagnostic data is generated automatically when you use the Service.
5. Who we share data with
We share personal data only with providers that help us run the Service, and only to the extent necessary. Our providers process data on our behalf under data processing agreements (GDPR art. 28), except where marked as independent controllers.
| Provider | Purpose | Location |
| [Cloud hosting provider, e.g. Google Cloud / AWS / Azure] | Hosting, database and file storage, backups | [EEA region] |
| Apple Inc. / Google LLC (app stores) | Distribution, in-app purchases and subscription billing (independent controllers for the purchase) | USA (see section 6) |
| Stripe Payments Europe Ltd. | Payment processing for web purchases (independent controller for payment data) | Ireland / USA |
| Brevo (Sendinblue SAS) | Sending email newsletters and service emails | France (EEA) |
| [Firebase / Google Analytics for Firebase] | App analytics and crash reporting | USA (see section 6) |
| [Support tool, if any] | Customer support | [ ] |
We may also disclose data where required by law or a valid request from a public authority, to protect our rights or the safety of users, or to a successor if the business is sold or merged (we will inform you before your data becomes subject to a different privacy policy).
We do not sell personal data, and we do not share personal data with third parties for their own advertising. [Remove the following sentence if not applicable:] We no longer use Google Ads or Facebook/Meta remarketing.
6. Transfers outside the EEA
Some providers listed above are located in, or may access data from, countries outside the EEA, primarily the USA. Where this happens we rely on: – the European Commission’s adequacy decision for the EU–US Data Privacy Framework, for providers certified under it; and/or – the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional safeguards.
You can request a copy of the relevant safeguards by contacting us.
7. How long we keep your data
| Data | Retention |
| Account data and your items/receipts | For as long as your account exists. Deleted within [30] days after you delete your account; backup copies are overwritten within a further [90] days. |
| Inactive accounts | If you have not logged in for [24 months], we will email you before deleting the account. [Confirm your chosen policy for the existing user base.] |
| Purchase, invoice and accounting data | 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act (bokføringsloven). |
| Marketing consent and opt-out records | For as long as you are subscribed, plus a record of your opt-out so that we respect it. |
| Security and server logs | [90 days], longer only if needed to investigate an incident. |
| Analytics data | [Aggregated / pseudonymised; raw events deleted after 14 months.] |
| Support correspondence | [2 years] after the case is closed. |
8. Cookies, SDKs and similar technologies
Website. myitems.com and the web client use strictly necessary cookies (session, login, security, language preference) without consent. We use analytics or marketing cookies only if you consent through the cookie banner, in line with the Norwegian Electronic Communications Act (ekomloven). You can change or withdraw your choice at any time via cookie settings. Details of each cookie are listed in our Cookie Policy.
Mobile app. The app contains third-party software components (SDKs) for crash reporting and analytics [Firebase]. Non-essential analytics is only enabled if you accept it [in the app’s privacy settings / at first launch], and you can turn it off in Settings at any time. We do not use advertising SDKs.
Do Not Track. We honour your cookie and in-app choices; we do not separately respond to browser “Do Not Track” signals.
9. Security
We protect your data using measures appropriate to the risk, including encryption in transit (TLS) and at rest, hashed passwords, access controls, logging, backups and vetting of our providers. No system is completely secure; if a personal data breach occurs that is likely to result in a high risk to you, we will inform you and the Norwegian Data Protection Authority as required by the GDPR.
10. Your rights
You have the right to: – access the personal data we hold about you; – rectify inaccurate or incomplete data; – erase your data (“right to be forgotten”), subject to legal retention obligations; – restrict processing in certain circumstances; – data portability – receive the data you provided in a structured, commonly used, machine-readable format; – object to processing based on legitimate interest, and to direct marketing at any time; – withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal.
You can view, edit, export and delete most of your data yourself under [Settings] in the app or web client. For anything else, email hello@myitems.com. We will respond within one month (extendable by two months for complex requests, in which case we will tell you). We may ask you to verify your identity first.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with a supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no. If you live in another EEA country, you may complain to your local authority.
11. Users outside the EEA
United Kingdom. If you are in the UK, the UK GDPR applies. Your rights are as described above; complaints may be lodged with the Information Commissioner’s Office (ico.org.uk).
United States. If you are a California resident, you may have rights under the CCPA/CPRA, including the right to know, delete and correct personal information and to opt out of “sale” or “sharing”. We do not sell or share personal information as defined in the CCPA. You can exercise your rights by emailing hello@myitems.com. We do not discriminate against users who exercise their rights.
Other countries. We apply the standards in this policy to all users. Local law may give you additional rights; contact us and we will help.
12. Children
The Service is not directed at children under 18 [or: 13 in Norway / 16 in other EEA countries – align with Terms section 3] and we do not knowingly collect personal data from them. If you believe a child has created an account or provided us with personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy. For material changes we will notify you by email or in the app before they take effect and update the effective date above. Previous versions are available on request.
14. Contact
Assetment Software AS, Ellingstranda 24, 1642 Saltnes, Norway,
Email: hello@myitems.com