About this policy
This policy describes how the Exos Inventory mobile app for iOS and Android (“the app”) handles personal data. The app is made by ExOS Labs ehf., Skeiðarvogi 21, 104 Reykjavík, Iceland (“ExOS Labs”, “we”, “us”).
Exos Inventory is a business tool for the staff of companies that use it to look up, count and move stock. It is not intended for the general public or for children. There is no public sign-up: accounts are created by the employer’s administrator.
Who is responsible for your data
Each company that uses Exos Inventory (“the customer”, usually your employer) has its own server, for example lookup-orninn.exos.is. The customer decides what data is collected about its staff and is the data controller. ExOS Labs runs the service on the customer’s behalf as a data processor.
If you have a question or request about your data, please contact your employer first. You can also contact ExOS Labs directly using the details at the end of this policy.
Data the app collects
- Account data: your username, display name and role (counter, manager or admin), and your password and/or PIN. Passwords and PINs are stored on the server only as a one-way hash (argon2), never in readable form. Your sign-in session token is kept in the phone’s secure storage (iOS Keychain or Android Keystore).
- Work records: the stock counts and stock moves you make, with who made them and when.
- Usage log: each item or shelf-label lookup records your user, the time, the code you scanned or typed, what it matched, which screen you used (Look up, Count or Move), and how the code was entered (camera, typing or hardware scanner, or tapping a search result). The customer’s administrators can see this in a usage report.
The usage log is held briefly on the phone and then sent to the customer’s server. The phone keeps at most 5,000 unsent events and deletes any that are older than 30 days.
How the data is used and shared
The data is used only to run the service for the customer: to sign you in, to record stock work, and to give the customer’s administrators an overview of how the app is used.
Stock corrections are sent to the customer’s own business systems, such as its ERP system (for example Microsoft Business Central) and its web shop, as the customer has set up. Product photos shown in the app are loaded from the customer’s own web shop.
ExOS Labs does not use the data for any other purpose, and does not sell it or share it with third parties for marketing.
What the app does not do
- Camera: the camera is used only to read barcodes, shelf labels and QR login cards, and this happens on the phone itself. No photos or video are saved or uploaded.
- The app does not access your microphone, location, contacts or photo library.
- The app contains no advertising and uses no advertising or tracking identifiers.
- The app contains no third-party analytics or crash-reporting tools.
- The app does not track you across other companies’ apps or websites.
- Your data is not sold or shared with third parties for advertising or marketing.
Security
All communication between the app and the server uses encrypted HTTPS connections. Passwords and PINs are stored only as hashes, and the sign-in token is kept in the phone’s secure storage.
Data retention
Account data, work records and usage logs are kept on the customer’s server for as long as the customer keeps your account, or until the customer deletes them. Unsent usage events on the phone are deleted after 30 days at the latest.
Your rights
Processing is governed by the EU General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act no. 90/2018. You have the right to access the personal data held about you and to have it corrected or deleted. You can also object to processing or ask for it to be restricted.
To use these rights, contact your employer or ExOS Labs. You also have the right to lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is), or with the supervisory authority in your own country.
Changes to this policy
We may update this policy when the app changes. The date at the top shows when it was last revised, and changes will be published on this page.
Contact
ExOS Labs ehf., Skeiðarvogi 21, 104 Reykjavík, Iceland.
Questions about this policy or your personal data can be sent to [email protected].