Privacy & Cookies

LAST UPDATED: 5 JULY 2026 · APPLIES TO DRAPANO.COM AND THE DRAPANO APP

Drapano tracks tools, not people. This page explains what data the service handles, why, and what your rights are. It is written to be read, not to be scrolled past.

Who is responsible

The data controller is [YOUR COMPANY NAME LTD], [registered address], Cyprus (“Drapano”, “we”). For anything privacy-related, write to privacy@drapano.com.

What we collect, and why

• Account data — your name, email address and a hashed password. Needed to create and secure your account (legal basis: performance of a contract, GDPR Art. 6(1)(b)).
• Inventory data — the tools, specs, purchase details, service records, custody history and notes your company enters. This is your operational data; we store and display it for you (Art. 6(1)(b)). Custody records name which team member holds a tool — that is the product working as intended, visible only inside your own company account.
• Photos — tool labels, tool photos, receipts and damage photos you upload. Stored per company, never public, delivered only to signed-in members of your company (Art. 6(1)(b)).
• Technical logs — standard web server logs (IP address, timestamp, request) kept for security and troubleshooting (legitimate interest, Art. 6(1)(f)), rotated automatically.

We do not collect analytics profiles, advertising identifiers, location trails, or anything about your browsing elsewhere. There are no trackers on this site.

Label & accessory scanning

When you use the scan feature, the photo you take is sent to Anthropic PBC (USA), whose Claude API reads the label and returns the extracted text. This happens only when you tap scan, only with that photo, and only to produce the result you asked for.

• Anthropic processes API data under a Data Processing Agreement and does not use API inputs to train its models by default.
• Transfers to the USA are safeguarded by the mechanisms in that DPA (including EU Standard Contractual Clauses, as applicable).
• If you'd rather not use it, don't tap scan — every field can be typed by hand and the product works fully without it.

Who else touches the data

Our sub-processors are limited to: [HOSTING PROVIDER, country] (servers on which the service runs) and Anthropic PBC (scan feature only, as above). We do not sell, rent, or share your data with anyone else. If a lawful authority compels disclosure, we comply only to the extent legally required.

How long we keep it

• Account and inventory data: for as long as your company account exists.
• If you delete a tool or photo, it is removed from the live system immediately and from backups as they rotate (within [30] days).
• If you close your account, all company data is deleted within [30] days, except records we must keep for legal or accounting reasons.
• Server logs: [14] days.

Your rights

Under the GDPR you can ask us, at any time, to:

• Access the personal data we hold about you, and receive a copy (portability);
• Correct anything inaccurate;
• Delete your data (“right to be forgotten”);
• Restrict or object to processing based on legitimate interest.

Write to privacy@drapano.com — we answer within 30 days. If you believe we've handled your data unlawfully, you can complain to the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy) or your local supervisory authority.

Cookies

Security

All traffic is encrypted with TLS. Passwords are stored only as salted hashes. Each company's data and photos are isolated from every other company's at the application level. Access to production systems is restricted and logged.

Children

Drapano is a work tool for businesses and tradespeople and is not directed at children under 16.

Changes

If this policy changes in a way that matters, we'll note it here with a new date and, for significant changes, tell you in the app.