Privacy policy
1. Who we are
Propiler is provided by Arctiv AB (org. no. 559279-9703), Grönborgsgatan 2, 852 33 Sundsvall, Sweden. For questions about your personal data, or to use your rights, email support@crdbag.com.
This policy covers the web app (my.propiler.app), the admin console, the documentation site and the Propiler iOS app.
2. Our two roles
When we act for a customer. Equipment, packlists, activity, photos, the people in a customer’s workspace or organization, and school students are the customer’s data. The customer (a company, or a school’s organiser) is the controller and decides why and how that data is used; Arctiv AB is the processor and follows the customer’s instructions under a data processing agreement. If you use Propiler through your employer or school, ask them first — we will help them answer you.
When we decide ourselves. For your user account, billing and support, and for running and securing the service, Arctiv AB is the controller.
3. The personal data we process
- Account: name, email address, profile photo, a user id, your sign-in settings. Your password is held by our sign-in provider (Amazon Cognito) as a one-way hash; we never see it.
- Workspaces and organizations: memberships, roles, groups, invitations (email address), company details such as company name and VAT number.
- Activity: who packed, unpacked, checked out or checked in an item, and when; the place; and, if allowed, the device’s location (GPS) at that moment.
- Photos: equipment photos (which can show people), cut-outs and photos of laid-out gear.
- School: students’ names, class, login codes, loans, and guardian-consent status. A student’s email address is stored only with a guardian’s consent.
- Tags and devices: tag ids and identifiers of readers, printers and displays.
- Technical: IP addresses in server logs, push-notification tokens, API keys and AI assistant (MCP) connections you create.
We do not use analytics or tracking tools, and we show no advertising.
4. Why we use it, and our legal basis
- To provide Propiler — your account, sign-in, workspaces, sharing, notifications you turn on: performance of our contract with you or your organization (GDPR art. 6(1)(b)).
- Security and operations — logs, abuse protection, backups, fixing faults: our legitimate interest in a safe, working service (art. 6(1)(f)).
- Support — answering you when you contact us: legitimate interest (art. 6(1)(f)).
- Billing and accounting — invoices and accounting records: legal obligation under Swedish accounting law (art. 6(1)(c)).
- Things you switch on — push notifications, location on the device: your choice in the device or browser, which you can withdraw at any time.
For customer data we process on a customer’s behalf, the customer decides the legal basis.
5. Location
When you pack, check out or check in an item, the app can record where it happened. This only happens when your device allows location for Propiler, and an organization can switch location capture off for all its members. Location (GPS) on activity is removed after 90 days.
6. AI photo analysis
If you ask Propiler to suggest details from a photo, the photo is sent to our AI provider for analysis. The result is only a suggestion: nothing is saved until you accept it. An organization can switch AI photo analysis, and access for AI assistants and the API, off for its members.
7. Who receives data
We use a small number of subprocessors to run Propiler — hosting, email, push notifications, maps and AI. They are listed, with where they are and why, on the subprocessor page. We do not sell personal data.
If you choose to sign in with Google, Google receives the sign-in under its own terms. If you turn on browser notifications, your browser’s push service delivers them; the message content is encrypted.
8. Transfers outside the EU/EEA
Our main data stays in Stockholm, Sweden. Some subprocessors are in the USA or the United Kingdom. For those we rely on the EU–US Data Privacy Framework, the EU’s Standard Contractual Clauses or an EU adequacy decision, as shown on the subprocessor page.
9. How long we keep data
- Location (GPS) on activity: 90 days.
- Activity without location: as long as the item or packlist exists.
- Audit events: 24 months, then made anonymous.
- Rate-limit and anti-abuse records: 24 hours.
- Deleted items: 30 days in “Recently deleted”, then removed.
- Students removed by their school: erased; their history is kept without their name.
- Deleted accounts: removed within 30 days. Backups roll off after 35 days.
- Server logs: 90 days.
- Accounting records: as long as Swedish accounting law requires.
10. Your rights
You have the right to access your data, have it corrected, have it erased, restrict or object to our use of it, and receive it in a portable format. Where you gave consent, you can withdraw it.
- Download your data: on the Account page, choose “Download my data”.
- Delete your account: on the Account page, choose “Delete my account”. Your name is removed from shared history, which stays as “Deleted user”.
- Anything else, or if a button is not available to you: email support@crdbag.com. We answer within one month.
You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY).
11. Children and students
Propiler is a tool for businesses and schools and is not directed to children. Users must be at least 16, except pupils whom their school adds. Pupils — including children under 13 — are in Propiler only because their school put them there, and they get a login only from their school. If we learn that a child under 13 has created an account in any other way, we delete it.
Every pupil, in every country. The school is in charge of its pupils’ data; we process it only for the school. Propiler keeps as little as needed — a name, a class, the pupil’s loans and, if the school gives one, a login code — and stores a pupil’s email address only with a guardian’s approval. A signed-in pupil sees only their own loans and which equipment is free. School organizations start with AI photo analysis, AI assistant/API access and location capture switched off. We never use pupils’ data for advertising, profiling or training AI, and we never sell it. A school can erase a pupil; the loan history then stays without the name. Pupils and parents use their rights through the school; if you contact us, we pass the request to the school and help it answer. A plain-language notice for pupils: student privacy.
United States — COPPA. For pupils under 13 we rely on the school’s authorization instead of asking each parent, as the Federal Trade Commission’s guidance under the Children’s Online Privacy Protection Act allows when information is collected only for the use and benefit of the school and for no other commercial purpose. The school gives it by signing our US Student Data Privacy Addendum. Parents can ask to review their child’s information, have it deleted and refuse its further collection — through the school, which can do this in Propiler, or by emailing support@crdbag.com; we confirm the request with the school and then act on it. We keep a child’s information only until the school erases the pupil or its agreement with us ends. The operator is Arctiv AB, Grönborgsgatan 2, 852 33 Sundsvall, Sweden; email support@crdbag.com, telephone +46 70 371 36 56.
United States — FERPA. For a US school, Arctiv AB acts as a “school official” under the school’s direct control: we use pupil records only to provide Propiler to the school, we do not re-disclose them except to our subprocessors, as the school directs or as the law requires, and we delete them when the agreement ends. Parents and eligible students exercise their FERPA rights through the school. We also follow state student-privacy laws such as California’s SOPIPA, New York Education Law §2-d and Illinois’ SOPPA.
EU/EEA. The school’s organiser is the controller and we are its processor under our data processing agreement. The school decides the legal basis — for a municipal school in Sweden normally its task in the public interest — so the GDPR’s rule on a child’s own consent (art. 8) does not apply.
12. Cookies and storage
Propiler uses only the storage it needs to work — no tracking cookies. See cookies and storage.
13. Security
How we protect data, and how to report a vulnerability, is described on the security page.
14. United States
If you live in the United States, this section adds to the rest of the policy and takes precedence where they differ. It covers the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and the comprehensive privacy laws of other states. Some of these laws apply only to larger companies; we give the rights below to every US resident anyway.
Our role. For your account, billing, support and security we are a “business” or “controller”. For data a customer puts into Propiler we are its “service provider” or “processor”, and we pass your request about that data to the customer.
Notice at collection. In the past 12 months we have collected these categories of personal information:
- Identifiers — name, email address, user id, IP address, push token; from you, the person who invited you and your device. Kept while your account exists and deleted within 30 days after; IP addresses in logs 90 days.
- Customer records and commercial information — billing name, address and email, company name, VAT number, plan, seats and invoices; for invoicing. Billing records 7 years (Swedish accounting law).
- Internet or network activity — server logs, sign-in protection, audit events and your activity in the service; to provide and secure the service. Logs 90 days, sign-in protection 24 hours, audit events 24 months then anonymized, activity as long as the item or packlist exists.
- Precise geolocation (sensitive) — one position when you pack or check equipment in or out, only if your organization allows it and you allow it on your device. Kept 90 days.
- Photos — profile and equipment photos. Kept as long as your account or the item exists; deleted items 30 days.
- Professional information — your organizations, roles, groups and permissions. Kept as long as the membership exists.
- Non-public education information — pupils’ names, classes, loans and login codes, for schools only. Kept until the school erases the pupil or its agreement ends.
- Account log-in (sensitive) — your email address with your password (held only as a verifier by Amazon Cognito), or a pupil’s class code with student code. Kept as long as the account exists.
We use personal information only to provide, support and secure Propiler, to invoice and to meet legal obligations — never for advertising or marketing, and we do not train AI on it. We disclose it only to our subprocessors, to the people and tools you or your organization choose, to Google if you sign in with Google, and to authorities where the law requires it.
No sale, no sharing, no targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We show no ads and do no profiling with legal or similarly significant effects — and none of this for anyone under 18. We use sensitive personal information only to sign you in and protect your account, and location only to show your team where equipment was handled. We treat a Global Privacy Control signal as a request to opt out of sale, sharing and targeted advertising; as we do none of these, it changes nothing for you.
Your rights. Depending on your state, you can ask to know and access, delete, correct and get a portable copy of your personal information, and to opt out of sale, sharing, targeted advertising and profiling (we do none of them). You will not be discriminated against for using your rights. Use “Download my data” and “Delete my account” on the Account page, or email support@crdbag.com with “US privacy request” and your state in the subject. We confirm within 10 business days and answer within 45 days (at most 45 more, with a reason). We verify you through your sign-in or by asking you to confirm from your account’s email address. An authorized agent needs your signed permission or a power of attorney. If we say no, you can appeal by replying, or by emailing us with “Appeal” in the subject; we decide within 45 days and, if we deny the appeal, tell you how to contact your state’s attorney general.
Where data is stored. In the EU (Stockholm, Sweden); we do not offer storage in the United States today. Some subprocessors process data in the United States.
15. Changes
We update this policy when the service or the law changes. The date at the top shows the latest version. Important changes are announced in the app or by email.