Privacy & Cookies
LAST UPDATED: 5 JULY 2026 · APPLIES TO DRAPANO.COM AND THE DRAPANO APP
Drapano tracks tools, not people. This page explains what data the service handles, why, and what your rights are. It is written to be read, not to be scrolled past.
Who is responsible
The data controller is Pilot Fish Limited, Makedonias 5, Sunrise Complex, Block 6 Apt 304, Pyla 7080, Cyprus (Reg. HE 448236 · VAT CY60018908C) (“Drapano”, “we”). For anything privacy-related, write to privacy@drapano.com.
What we collect, and why
- Account data — your name, email address and a hashed password. Needed to create and secure your account (legal basis: performance of a contract, GDPR Art. 6(1)(b)).
- Inventory data — the tools, specs, purchase details, service records, custody history and notes your company enters. This is your operational data; we store and display it for you (Art. 6(1)(b)). Custody records name which team member holds a tool — that is the product working as intended, visible only inside your own company account.
- Photos — tool labels, tool photos, receipts and damage photos you upload. Stored per company, never public, delivered only to signed-in members of your company (Art. 6(1)(b)).
- Technical logs — standard web server logs (IP address, timestamp, request) kept for security and troubleshooting (legitimate interest, Art. 6(1)(f)), rotated automatically.
We do not collect advertising identifiers, cross-site profiles, or anything about your browsing elsewhere. Our analytics are cookieless and self-hosted on our own EU servers — they count page views and basic interactions without cookies, without storing anything on your device, and without tracking you across sites.
Label & accessory scanning
When you use the scan feature, the photo you take is sent to Anthropic PBC (USA), whose Claude API reads the label and returns the extracted text. This happens only when you tap scan, only with that photo, and only to produce the result you asked for.
- Anthropic processes API data under a Data Processing Agreement and does not use API inputs to train its models by default.
- Transfers to the USA are safeguarded by the mechanisms in that DPA (including EU Standard Contractual Clauses, as applicable).
- If you'd rather not use it, don't tap scan — every field can be typed by hand and the product works fully without it.
Who else touches the data
Our sub-processors are limited to: ENAHOST s.r.o. (Slovakia), operating its own servers physically located in Cyprus (EU) — the infrastructure the service runs on and Anthropic PBC (scan feature only, as above). We do not sell, rent, or share your data with anyone else. If a lawful authority compels disclosure, we comply only to the extent legally required.
The shared tool catalog
To make label recognition and fit-matching more accurate, we maintain an aggregated catalog of tool-model facts: brand, model, category, voltage, battery platform and technical specs. When any account saves a tool, those model facts (and only those) may be added to the catalog. It never contains serial numbers, photos, prices, locations, people, or anything identifying you or your company — it is knowledge about products, not about customers.
How long we keep it
- Account and inventory data: for as long as your company account exists.
- If you delete a tool or photo, it is removed from the live system immediately and from backups as they rotate (within 30 days).
- If you close your account, all company data is deleted within 30 days, except records we must keep for legal or accounting reasons.
- Server logs: 14 days.
Your rights
Under the GDPR you can ask us, at any time, to:
- Access the personal data we hold about you, and receive a copy (portability);
- Correct anything inaccurate;
- Delete your data (“right to be forgotten”);
- Restrict or object to processing based on legitimate interest.
To delete your account and everything in it, see how to delete your account — you can start the request from inside the app or by email.
For anything else, write to privacy@drapano.com — we answer within 30 days. If you believe we've handled your data unlawfully, you can complain to the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy) or your local supervisory authority.
Cookies
Count of cookies on Drapano: one. It's the session cookie
(tvsid) that keeps you signed in. It is strictly necessary for the service to function,
which is why EU law requires no consent banner for it — and why you won't find one here.
No analytics cookies, no advertising cookies, no third-party cookies. That's the whole cookie policy.
Security
All traffic is encrypted with TLS. Passwords are stored only as salted hashes. Each company's data and photos are isolated from every other company's at the application level. Access to production systems is restricted and logged.
Children
Drapano is a work tool for businesses and tradespeople and is not directed at children under 16.
Changes
If this policy changes in a way that matters, we'll note it here with a new date and, for significant changes, tell you in the app.