1. Scope and feature availability
This notice covers itemaro.com, the privacy website itemaro.de, the Itemaro web administration and API, and the new native iOS and Android apps. Free supports local use, Pro supports stocktaking, and Premium supports warehouse management with optional team and business integrations. Choosing a paid plan does not release warehouse data for advertising.
The new apps and individual features are being introduced in stages. An optional feature described here processes data only when it is available and used or expressly enabled. This notice does not mean that every feature has already been released. Existing local data from the previous Flutter app is not automatically uploaded because you visit the website or because this notice changes.
2. Controller and privacy contact
The controller for our own processing described below is BSM-Onlinehandel UG (haftungsbeschränkt), Marie-Curie-Str. 2, 40789 Monheim am Rhein, Germany. For privacy requests, access and erasure, contact anfrage@bsm-onlinehandel.com. This is the operator’s privacy contact.
Where a business uses Itemaro to process employee and warehouse data on its behalf, that business normally determines the purposes, permitted content, access and retention. BSM acts as a processor on documented instructions under the data processing agreement (German). BSM is a controller for its own account administration, service security, contract management and website purposes. Employees should also contact their employer or commissioning business about business-controlled data; we assist that business with rights requests.
3. Local app use and device permissions
Local projects, items, counts and any photos initially remain on your device. Free can be used without an Itemaro employee account. Exports, file backups and device transfers you initiate are stored at the destination you choose; protecting and deleting these copies is also your responsibility. Your operating system or device cloud backup may contain data, depending on your settings and that provider’s privacy information.
The camera is used for scans or photos you initiate, including barcodes and invitations. Pick by Voice uses a suitable on-device speech model where available, otherwise an English on-device model, and otherwise text input. It does not automatically switch to cloud speech recognition. Audio recordings are not sent to Itemaro’s warehouse server; only confirmed structured entries or stock operations are transmitted. Local speech output depends on installed device voices. You can disable microphone and camera access in system settings; the relevant feature will then be unavailable.
Itemaro does not process raw biometric data for sign-in. Stored credentials are protected by the iOS Keychain or encryption using Android Keystore. Keychain entries can survive reinstallation; signing out removes the stored team credential. A device permission is not blanket consent to additional uses of data.
4. Accounts, employees and separate warehouses
An owner account processes an email address, display name, password hash, internal identifier, plan entitlements and acceptance of the processing agreement. Employee access uses a display name or business alias, internal identifiers, device name, warehouse membership, role and any time or location restrictions. Invitation and session credentials are stored as hashes on the server.
Shared data is processed centrally only when you deliberately create or connect to a warehouse. Access is checked for the specific warehouse and permission; signing in does not grant access to other businesses. Training warehouses use separate sample data. The inviting business is the source of assigned roles and can revoke access. Required contact details and authentication information are necessary for the relevant online access; it cannot be provided without them. Local use can remain separate.
5. Stocktaking, warehouse and business data
Depending on the feature used, Itemaro processes item records, identifiers, barcodes, storage locations, quantities, blocked and reserved stock, units, prices, batches, orders, receipts, issues and transfers. Stocktaking projects may contain a customer/business name, site, department, job reference, counting areas, staff assignments, initial counts, recounts and import/export templates. Timestamps, the acting display name, references and reasons support an understandable business record, not automated employee performance scoring.
Optional work instructions, quality and return records may include a supplier, document, batch, defect reason, confirmations and decisions. Supported uploaded images are checked, resized and re-encoded without EXIF/GPS metadata; this does not remove people or text visible in the image. Do not enter unnecessary personal, health or other particularly sensitive data. Previews and stock suggestions do not automatically assign blame or make legally significant decisions about employees.
The authorized business manages released reports, customer links and downloaded offline packages. Customer links are confidential, revocable access with limited permissions and a maximum validity of seven days. Where available, explicitly downloaded counting packages may reserve up to 500 positions for no more than 72 hours and never beyond the project permission. Apps encrypt them for the device; browser packages use a chosen offline password. Expiry or revocation prevents automatic submission but does not delete external copies you created.
6. Business sign-in and external integrations
Only explicitly configured integrations exchange approved item, order, quantity and stock data with an ERP or other business system. Depending on setup, this may use SAP/OData, Business Central or JSON interfaces and signed events. The business determines recipients, data scope, field mappings and the legal arrangements needed for transfers. Test responses are used for the requested comparison; saved profiles contain mappings rather than complete sample responses.
With OpenID Connect, Itemaro receives the provider identifier, stable business identity, username/display name and access status from the selected identity provider. SCIM may provision or disable access. Itemaro does not receive business sign-in passwords; matching email addresses alone do not grant warehouse access. Integration secrets are encrypted and excluded from ordinary customer exports. The connected business or identity provider’s notice also applies to processing on its side.
7. Subscriptions, purchases and revenue reports
Pro and Premium subscriptions are purchased only inside the apps through Apple App Store or Google Play. The relevant store independently controls its processing of store accounts, orders, payments, refunds and cancellation. Itemaro receives the product, transaction, validity and status information needed to check or restore access. New account-bound purchase verification is prepared for introduction with the corresponding app/server release; it involves an internal account association and protected purchase evidence. Itemaro does not receive payment card numbers or store passwords.
Only Itemaro revenue reports are imported manually into the protected administration area. Google Play import is currently configured; Apple financial import is not yet enabled. Raw files are processed in memory for validation. Retained statistics contain monthly product, currency and amount summaries, not individual customer, address or order profiles. These aggregated monthly figures remain for business accounting comparisons until replaced or removed; no automatic deletion period is currently configured for them. Any legally required personal accounting records are handled separately under the applicable retention obligations.
Deleting an Itemaro account does not automatically cancel a store subscription. Cancel it separately through the relevant store. Apple App Store & Privacy · Google Privacy Policy.
8. Website, first-party ads and daily totals
The public website may display labelled first-party text and image ads, for example for GastroTalent24. Ad images are served by Itemaro’s infrastructure and re-encoded without image metadata when stored. No external ad networks, tracking pixels or Google Analytics are used for these ads. Clicking an external ad or store link takes you to the selected provider, whose own privacy notice then applies.
Our statistics count the day, a predefined event type, campaign identifier or store destination, and total count. They do not store IP addresses, browser identifiers, referrers, URL parameters, visitor identifiers, device profiles or warehouse content. They are not linked to warehouse or employee accounts. Repeated requests and bots may be included; the figures are not unique visitors. Daily totals are removed after 90 days at the next cleanup. Do Not Track and Global Privacy Control are respected; you can also opt out of page-load counting on the homepage. The saved opt-out is a local functional preference.
The public counter uses available aggregated official store installation reports and identifies the source and reporting date. Installations are not represented as unique people worldwide; missing figures are not estimated. Technical IP/connection data needed by the hosting service for delivery and security is separate from these statistics.
9. Cookies and local functional storage
The website locally stores your selected language and, where applicable, your counting opt-out. Viewing a selected privacy language requires no cookie: the choice is in the link. The web warehouse portal keeps its API credential in memory. Optional business web sign-in uses a protected session cookie for no more than eight hours. Separate website administration uses an HttpOnly/SameSite session cookie restricted to the administration area for no more than 30 minutes and an authenticator as a second factor.
Storage strictly necessary for a function you explicitly request is based on section 25(2)(2) of the German TDDDG; additional storage or access requiring consent is based on section 25(1). Where personal data is involved, the GDPR legal bases below also apply. You can clear local settings in your browser; this removes preferences and may require signing in again.
10. Planned AdMob advertising in Free
The new native apps are prepared for Google AdMob banners only in the free local Free area. Production ads are not enabled at the current release stage. Pro, Premium and connected team warehouses are intended to have no ad banners. Warehouse content, items, prices, voice commands and employee details are not passed to Google as advertising parameters.
When enabled, Google User Messaging Platform checks the required privacy choices before ad requests. Required consent is based on GDPR Article 6(1)(a) and section 25(1) TDDDG and can be withdrawn in ad settings. Local use remains possible without consent, internet access or an available ad. The code requests non-personalized ads, disables publisher first-party IDs, removes Android advertising-ID permission and does not request iOS tracking permission.
Non-personalized ads do not automatically mean no personal data: Google may process IP address, approximate region, device/app information, interactions and diagnostics for delivery and fraud prevention. Precise location permission is not requested for advertising. The provider for EEA users is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by Google companies in other countries, including the US, is possible. See Google’s partner-services information and the applicable consent notice. This notice and store privacy disclosures will be aligned with actual ad operations before activation.
11. Optional app statistics and store reports
The new apps include optional usage statistics that are off by default. Only after activation are daily sessions, plan (Free, Pro or Premium), app version, platform and configured device region transmitted. Region is a device setting, not proof of location. Names, account identifiers, warehouse content, advertising identifiers and precise locations are not transmitted for this purpose. A daily rotating pseudonymous identifier is derived from a random value stored only locally.
Processing is based on consent; the app can be used without these statistics. Withdrawal in settings stops new transmissions. At the next successful connection, the app requests deletion of its retained daily reports and keeps only the necessary deletion proofs until then. Daily reports are cleaned up within 30 days; deletion proofs not linked to accounts remain for up to 30 days to prevent delayed resubmission. Results concern participating installations, not all people or verified subscribers; no persistent device profile is created to determine monthly unique users.
The administration also processes aggregated official Itemaro store reports by day, country or version for up to 400 days. These follow each store’s definitions and reporting delays. Country and version breakdowns are not added as separate groups of people. Personal order reports are not imported for these usage statistics.
12. Support and prepared account email delivery
When you contact us, we process the sender address, message content, any relevant account reference and correspondence needed to handle the request. Do not send passwords, invitation secrets or unnecessary warehouse/employee data. We handle messages to answer requests, support contracts or meet privacy obligations and remove them when their purpose and any applicable legal requirements no longer require retention.
Separate Resend delivery is prepared for email verification and password resets but remains disabled. No account emails are currently sent through this integration. Once enabled, only the recipient address, transactional message, necessary personal action link and delivery information will be provided to the delivery service, not warehouse stock or marketing lists. Open and click tracking are disabled; the sending domain requires TLS. Personal links must not be shared.
The configured Ireland sending region determines routing, not exclusive EU storage. Resend (Plus Five Five, Inc., US) states that message content and delivery logs are stored in the US, generally for 30 days on the selected plan, with backups lasting an additional seven days. Future delivery is subject to the Resend data processing addendum, including standard contractual clauses, and its subprocessor list. Activation requires implementation of account flows and assessment of the transfer arrangements.
13. Security and administration
Hosting and API services process necessary technical connection/request data, including IP addresses during transport, sign-in limits and error diagnostics, to deliver the service and prevent misuse. Our own website statistics do not store these connection details. Passwords, audio recordings and complete warehouse content are not intended for application logs.
Website administration requires separate authorization, a password and an authenticator. Authenticator secrets are encrypted; session credentials are hashed. Administration logs contain administrator ID, action, target and timestamp for up to 180 days. Business warehouse journals and access logs are separate. Technical operational samples without employee performance data are cleaned up after 30 days.
PrismaTech Shield is prepared as an additional security integration but is not enabled in the currently published Itemaro service. No Itemaro events are currently transmitted to Shield through it. Before activation involving additional processing, recipients, data scope and retention will be added to this notice. Technical safeguards do not replace the business’s responsibility to assign permissions securely.
14. Purposes and legal bases
Our own account, contract, purchase-entitlement and requested support services are based on GDPR Article 6(1)(b), or, for a business’s contact persons where applicable, Article 6(1)(f) for managing that business relationship. Necessary security, misuse prevention and data-minimizing evaluation of our own website/product offerings rely on Article 6(1)(f); our interests are reliable operation, protecting access and stock, and improving the service. Optional app statistics and advertising processing requiring consent rely on Article 6(1)(a). Legal obligations, including handling data subject rights, rely on Article 6(1)(c).
The business controlling warehouse/employee data determines its applicable legal basis, including any contract or employment-law requirements. An employee’s approval is not blanket consent on behalf of their employer. Optional information is not required for the basic service; necessary information is identified in the relevant flow or is apparent from its function.
15. Providers, recipients and international transfers
Vercel provides website/API hosting and private backup storage; Neon provides the central PostgreSQL database. The application region, warehouse database and private backup storage are configured for Frankfurt. This does not exclude worldwide processing of administration, support, security or subprocessor data. Domain registration and DNS are provided through United Domains; connecting to a domain/DNS service may produce technical data at that service.
Other recipients, according to the feature actually used, include authorized warehouse members, expressly approved customers or business integrations, and Apple/Google for store purchases. Resend is added only when the described email delivery is enabled. Data is not sold; warehouse/employee data is not used for advertising profiles or to train an Itemaro AI model. Authorities or legal advisers receive data only where required or necessary for legal claims.
Required transfers outside the EU/EEA must meet GDPR Articles 44 onwards, notably an applicable adequacy decision or suitable safeguards such as EU standard contractual clauses with any necessary supplementary measures. You can request information or a copy of relevant safeguards from our privacy contact. Provider documents: Vercel DPA, Neon DPA, Resend DPA. Selecting an EU region alone is not a promise of exclusively EU processing.
16. Retention, backups and deletion
Local data remains on your device or at the selected export destination until deleted. An encrypted offline read-only team snapshot is limited to up to 100 items and 20 movements and is no longer displayed after at most 24 hours or earlier access expiry. Pending operations remain on the device until submitted or deliberately removed. Explicitly downloaded counting packages have the separate limits described above.
Accounts and shared business data are retained to provide the contract until deleted or unless required retention obligations apply. Businesses must export their own records in time and determine their statutory periods. Confirmed account deletion removes personal account fields, ends sessions and deletes the account’s own shared warehouses. Other businesses’ stock remains; the departing user’s posting names are removed there. Pseudonymous journal references may remain to preserve business-record integrity. Personal information in free text and external copies may require separate review.
Invitations are valid for 15 minutes and cleaned up in maintenance after 24 hours past expiry. Sessions last at most 30 days; technical remnants are cleaned up 30 days after expiry. Deletion confirmations last five minutes. Sign-in limits are cleaned up after 24 hours. Unassigned employee accounts are cleaned up after session retention, generally by about 60 days after the last sign-in. Business sign-ins last eight hours, OIDC states ten minutes and app return codes two minutes; expired states are removed in maintenance.
Encrypted private backups are scheduled daily with 30-day retention followed by maintenance cleanup. Separate minimal erasure instructions without names or email addresses prevent deleted accounts from being reintroduced during restoration and remain up to seven days beyond backup retention. Backups are for recovery, not routine analysis. Website, app and store statistics and email delivery have their own periods above. Hosting providers may have additional technical retention periods; requests and legal evidence are retained for the duration required for their purpose.
17. Your rights and how to contact us
Subject to the legal conditions, you have rights of access, rectification, erasure, restriction and portability. You can withdraw consent at any time for the future; this does not affect processing that was lawful before withdrawal. For processing based on legitimate interests, you may object under GDPR Article 21 on grounds relating to your particular situation. You are not subject to a solely automated decision producing legal or similarly significant effects.
Use available “Privacy and account” functions for export, name correction, session management and confirmed deletion, or email anfrage@bsm-onlinehandel.com. Rights requests are normally handled within one month; any legally permitted extension will be explained. Appropriate identity verification may be needed to protect your data, without collecting unnecessary information. For business-controlled employee data, also send the request to that business; we assist on instructions. Legal exceptions and other people’s rights are taken into account.
You can complain to a competent supervisory authority, particularly where you live or work or where an alleged infringement occurred. The operator’s supervisory authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia. Further steps: account deletion instructions (German). The English and German versions describe the same processing; you can contact us in either language about anything unclear.