Account information. When an administrator creates your account we store your name, email address and role, and a securely hashed password.

Content you submit. When you submit a product, we collect the product name you enter, the barcode you scanned and the photo you capture.

Scan & catalogue activity. Barcodes you look up and product records you create or edit, to provide and maintain the catalogue.

Technical data. Standard request information (such as IP address and timestamps) needed to operate and secure the Service.

The app requests camera access for two purposes: to scan product barcodes, and to let you take a photo of a product when submitting it for review. Photos you capture are uploaded to our servers and attached to the submission so an administrator can verify the product. The app does not access your microphone, location or photo library beyond the image you choose to capture.

We use the information above to:

• authenticate you and keep the Service secure;
• look up products and maintain the product catalogue;
• process and review product submissions; and
• operate, troubleshoot and improve the Service.

We do not use your information for advertising.

We do not sell your personal information. We share it only with service providers that host and operate the Service on our behalf (for example, our database and file storage), and only as needed to run the Service. We may disclose information if required by law or to protect the rights and safety of users and the Service.

We retain account and catalogue data for as long as your account is active or as needed to provide the Service. Submission photos are kept with their submission record. We remove or anonymise data when it is no longer required, subject to any legal obligations.

Passwords are stored hashed, sessions use signed tokens, and access to administrative functions is role-restricted. While no method of transmission or storage is completely secure, we take reasonable measures to protect your information.

You may request access to, correction of, or deletion of your personal information, subject to applicable law. Because accounts are managed by an administrator, please contact your administrator or us at the address below to exercise these rights.

The Service is intended for use by authorised staff and is not directed to children under 13, and we do not knowingly collect their information.

We may update this policy from time to time. We will revise the “Last updated” date above and, where appropriate, provide additional notice.

If you have questions about this Privacy Policy or your data, contact us at [email protected].