DataItemize Privacy Policy
Version: 2026-10-09 · Effective: 2026-10-09
This policy explains how Data Doodles Tech Pvt. Ltd., trading as Data Doodles Tech, of Baluwatar-03, Kathmandu, Nepal ("we", "us", "our") handles personal information in connection with DataItemize, our online inventory and business management service (the "Service").
1. Summary
- We collect what we need to run your account: your name, email, password (stored only as a secure hash), your role in your company, and security records such as sign-in sessions with IP address and browser details.
- We do not use cookies, analytics, advertising trackers or session-recording tools, and we do not sell personal information.
- The records your business keeps in DataItemize — including details of your customers, suppliers and employees — belong to your business. We process them only on your business's instructions (see section 2).
- Our database and application servers are in Singapore. Our hosting provider is a US company.
- Some records (the stock ledger and the audit log) are designed so they cannot be changed or deleted inside the Service. Permanent deletion is done by us on request.
2. Two roles: when this policy applies
Where we decide how information is used (we are the "controller"). This policy covers personal information about:
- people who sign up for or are invited to DataItemize ("users");
- people who contact us for sales or support; and
- people who visit our website or sign-in pages.
Where your business decides (we are a "processor"). When a business uses DataItemize, it may record information about its own customers, suppliers, employees and other contacts — for example names, phone numbers, email addresses, addresses and tax registration numbers on customer and supplier records, or names and job titles on employee records. That business decides what to record and why; we process it only to provide the Service, under our Data Processing Addendum. If your information is held in a DataItemize account by a business you deal with, please contact that business about it. If you contact us instead, we will pass your request to them where we can identify them.
3. Information we collect
Information you give us
- Account details: full name, email address, password, and optionally a phone number and company name. We store your password only as an argon2id hash; we never store it in readable form.
- Membership and role details: which company and businesses you belong to, your role and permissions, any warehouse restrictions, who invited you, and invitation records (invitee email address, role, expiry).
- Preferences: notification preferences, saved table views and dashboard layout.
- Acceptance records: which version of these legal documents you accepted, and when.
- Communications: messages you send us by email or otherwise for support or sales.
- AI assistant questions (only if enabled): if the optional AI copilot is enabled and you use it, the question you type. The copilot is not currently enabled.
Information collected automatically
- Sign-in sessions: for each sign-in, the IP address, browser user-agent string, time of sign-in and expiry, and whether the session has been revoked. You can see and revoke your own sessions in your account settings.
- Audit log: when you create, change, approve, archive or delete something, the Service records who did it (your user ID and email), what changed (before and after values), any reason given, the time, your IP address and your browser user-agent string. Questions asked of the AI copilot are also recorded here (first 200 characters, tools used and model).
- Security counters: failed sign-in attempts are counted per account and per IP address to lock out password-guessing. These counters are short-lived.
- Service logs: our servers log each request's method, path, response status, duration, a request ID, and your user ID and business ID. Our hosting provider may also keep its own request logs, including IP addresses, under its own retention settings.
What we do not collect
- We do not set cookies and do not use analytics, advertising, social-media or session-replay tools. Details are in the Cookies and Local Storage Notice.
- We do not process payment card or bank details. There is currently no online payment in the Service.
- We do not collect your location. If you use barcode scanning, the camera image is processed inside your browser to read the code; camera images are not sent to us.
4. How we use personal information
| Purpose | Information used |
|---|---|
| Create and run your account, sign you in, and show you the businesses and features your role allows | Account, membership, preferences, sessions |
| Keep the Service secure: detect and block password guessing, let you review and revoke sessions, investigate incidents, enforce tenant isolation | Sessions, audit log, security counters, service logs |
| Keep a trustworthy audit trail for your company | Audit log |
| Send service messages: email verification, password resets, invitations and notifications you choose to receive by email (see section 5 about email delivery) | Account details, notification preferences |
| Show in-app notifications (for example low-stock alerts) | Membership, preferences |
| Apply your plan's limits and features | Membership, company plan |
| Provide support you ask for | Any of the above, as needed |
| Answer AI copilot questions, if enabled | Your question and the read-only business results it looks up |
| Comply with law and enforce our Terms | Any of the above, as needed |
We do not use personal information for advertising, we do not build marketing profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not use your information or your business's data to train AI models, and if the AI copilot is enabled we will use it only under provider terms that do not allow the provider to train on it.
If we want to send product news or marketing emails, we will do so only as the law allows and will give you a way to opt out in every message.
5. Who we share it with
Infrastructure providers (subprocessors). These providers process data for us to run the Service:
| Provider | What it does for us | Where data is processed | Status |
|---|---|---|---|
| Vercel Inc. (USA) | Hosts the web app and the API; delivers pages through its global network; runs scheduled background jobs; keeps request logs | API and background jobs run in Singapore (sin1); web pages are served from Vercel's global edge network; logs per Vercel's settings | Active |
| Neon (database service) | Hosts the PostgreSQL database that stores all account and business data | AWS Asia Pacific (Singapore), ap-southeast-1 | Active |
| Vercel Blob (Vercel Inc.) | Stores uploaded files (product photos, attachments, import files) in a private store | Singapore (sin1) | Active |
| Resend (USA) | Delivers service emails (verification, password reset, invitations, notifications) | United States | Active |
| GitHub (source code hosting) | Stores our source code | — | Active, but no customer or user data |
The following are planned and not in use today. We will update this policy and give notice before any of them starts processing personal information:
| Provider | Planned purpose |
|---|---|
| Anthropic | Generating answers for the optional AI copilot |
Emails we send contain your email address and the message itself, which Resend processes in order to deliver it.
Others in your company. Account owners and administrators of your company can see your name, email, role and activity. People with permission to view the audit log can see audit entries, including the IP address and browser details recorded with each action.
Our platform administrators. A small number of our staff have platform-administrator access. They can see user accounts and sign-in history (including IP addresses and browser details) and can access any company's data. We use this access only to provide support, operate and secure the Service, and comply with law. Changes they make inside a company are recorded in that company's audit log.
Integrations your business sets up. If your business configures webhooks or API keys, data is sent to the destinations it chooses.
Legal and safety reasons. We may disclose information if required by law or a valid order of a competent authority, or where necessary to protect the rights, safety or property of our users, the public or us.
Professional advisers and business transfers. We may share information with our lawyers, auditors and accountants under confidentiality, and with a buyer or successor if our business is sold or reorganised, who must continue to protect it as described here.
We do not sell personal information.
6. Where your information is stored
We are based in Nepal. Our database (Neon), our file storage (Vercel Blob) and our API servers (Vercel) are located in Singapore, so personal information is transferred from Nepal and other countries to Singapore. Service emails are delivered through Resend in the United States. Vercel is a US company and serves web pages through a global network, so request information such as IP addresses may also be processed in other countries, including the United States.
7. How long we keep it
| Information | How long |
|---|---|
| Account details and memberships | While your user account exists. When removed from a company, your membership is deleted but your user account remains until you ask us to delete it. |
| Sign-in session records (IP, user-agent) | Kept while your user account exists. We do not currently delete them automatically. |
| Audit log entries | Kept for as long as the company's data is kept. They cannot be edited or deleted inside the Service. |
| Archived or "deleted" items, contacts and businesses | Hidden in the app but kept in the database (see section 8). |
| Service logs at our hosting provider | According to the provider's log retention for our plan. |
| Database backups | Our database provider keeps point-in-time history for up to 7 days. |
| Short-lived security counters | Minutes to hours; they expire automatically. |
| Support emails | For as long as needed to resolve the request, and up to 2 years afterwards. |
When a subscription or trial ends, the account becomes read-only; we do not automatically delete data. We may keep information for longer where the law requires it or to establish or defend legal claims.
8. Deletion
- Archiving is not deletion. Archiving a business or deleting a record in the app hides it but keeps it, so documents, the stock ledger and the audit log remain complete.
- Ledger and audit records cannot be changed inside the Service. They are protected by the database itself. Only we can remove them, as part of a permanent deletion request.
- Permanent deletion is on request. Email support@datadoodlestech.com. For a whole company account, the request must come from the account owner. We will complete permanent deletion within 30 days, except where we must keep information by law.
- Backups age out. Deleted information can remain in the database provider's backup history until it ages out, up to 7 days.
9. How we protect it
- All traffic between your browser and the Service is encrypted with HTTPS.
- Passwords are hashed with argon2id. Refresh tokens, password-reset links, email-verification links, invitations and API keys are stored only as hashes.
- Access tokens last 15 minutes and are tied to a sign-in session; refresh tokens rotate on every use, and reusing an old one revokes the session. Changing your password signs out your other sessions; resetting it signs out all of them. Ten failed sign-ins lock the account for 15 minutes.
- Every request is checked on the server against your company membership, role, and business and warehouse scope, and an application-level guard stops a request from loading another company's records.
- Stock ledger and audit log entries are append-only.
- Our database provider, Neon, encrypts stored data at rest as part of its service. We do not add our own encryption layer on top.
- Secrets are kept in our hosting provider's environment settings and are not written to logs.
Some limits you should know about: the Service does not yet offer multi-factor authentication; the web app keeps your session tokens in your browser's local storage, so sign out on shared devices; and the Service has not yet had an independent penetration test. No system is perfectly secure.
10. Your choices and rights
- See and update your details. You can update your name and phone number in your account settings. To change your email address, contact us.
- Review sessions. You can see where you are signed in and sign out other sessions.
- Notifications. You can choose which notifications you receive and how.
- Export. Users with the right permissions can export the item catalogue and most reports as CSV or XLSX.
- Requests. You can ask us for a copy of your personal information, to correct it, to delete it, or to stop using it for a particular purpose, and you can complain to us about how we handle it. Email support@datadoodlestech.com. We may need to confirm your identity. We will respond within 30 days.
Depending on where you live, the law (for example, Nepal's Individual Privacy Act, 2075) may give you specific rights over your personal information. We will respond to requests in line with the law that applies.
If your information is held in a DataItemize account by a business you deal with, that business handles your request (see section 2).
11. Children
DataItemize is a business tool. It is not intended for anyone under 18, and we do not knowingly collect personal information from them. If you believe we have, contact us and we will delete it.
13. Changes to this policy
We will update this policy when our practices change — for example before any planned provider in section 5 starts processing personal information. For material changes we will notify account owners by email or in the app before the change takes effect. The version date at the top shows the current version.
14. Contact us
Data Doodles Tech Pvt. Ltd. (Data Doodles Tech) Baluwatar-03, Kathmandu, Nepal Privacy requests: support@datadoodlestech.com General support: support@datadoodlestech.com
This policy is adapted from the Privacy Policy (GDPR Enhanced) template published by General Legal under CC0 1.0. Credit as requested by General Legal:
This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.