Privacy policy

Who we are

Reuno is run by Arthur Both, trading as Reuno, 36 Lancaster Mews, London, W2 3QF, United Kingdom (“Reuno”, “we”, “us”). We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything about your data, email hello@reuno.co.

The short version

• A tag carries only a random code. Your name, phone number, email and address are never printed on it.
• Finders message you through our relay. They never see your email or phone number, and you never see theirs.
• We never sell personal data. We run no advertising or analytics trackers.
• You can download your data or delete your account at any time from your dashboard.

What we collect from tag owners

• Your account. Your email address, so we can sign you in with a one-time code or link. Your first name if you add it, and your alert settings.
• Your tags. Each tag’s code, item name, colour, your note to finders, any reward or drop-off details, whether lost mode is on, and whether finders see your first name.
• Messages. What you and finders write to each other, and any location a finder chooses to share.
• Scans. When a tag was scanned, whether by QR code or NFC, and the approximate town or city and country. This comes from the finder’s internet connection, not their GPS. Scans you make while signed in to your own account are not counted.
• Orders. Your name, email, delivery address, what you bought and what you paid. Card payments are handled by Stripe. We never see or store your full card number.
• Support. Anything you send us by email.

What we collect from finders

You do not need an account to use a finder page, and you do not have to give us any contact details.

• Your message and, if you add them, your first name and where you found the item.
• Your email address, only if you give it, so we can tell you when the owner replies. The owner never sees it.
• Your location, only if you tap to share it. It is shown to the owner in your conversation.
• The language your browser uses, so the page and our emails can match it.
• The approximate town or city and country of the scan, as described above.
• A cookie that keeps your conversation open on your device (see Cookies).
• A scrambled, one-way version (a hash) of your IP address. We use it only to limit spam and abuse, and we cannot turn it back into your IP address.

Business quote requests

If you ask for a business quote we collect your name, company, work email, the quantity and colour you want and what the tags are for. We use this to reply, prepare a quote and send a digital proof.

Businesses we contact about Reuno

We email a small number of UK businesses, such as letting agents, hotels, gyms and merchandise companies, to offer them Reuno’s branded key tags. This section explains what we hold about a business we contact and why.

• Where we found you. On your business’s own website, or in a public business listing (OpenStreetMap). Each email says which. Our system finds businesses in OpenStreetMap and reads a few public pages of their own websites (as “ReunoBot”, following the site’s robots.txt), and may check the public Companies House register.
• What we hold. The business name, the work email address we wrote to and, where they were published with it, the business’s phone number, website, town and postcode. We also keep our notes on the type of organisation and the public words that show it (for example a company number on your website, with the page and the date we saw it), why Reuno might suit it, the emails we sent and any replies.
• Why. To tell businesses about a product that may be useful to them. Our lawful basis is legitimate interests. We only write to organisations that show they are a company, a charity or a public body, never to sole traders or partnerships without their consent. We send one follow-up at most, and only if you have not replied.
• Who handles it. Our emails to businesses are sent and received through Google (Gmail). The details are stored in our database (see “Who we share it with”).
• How long. If you do not reply, we delete your details 12 months after our last email. If you reply, we delete them 24 months after the last message. If you ask us to stop, say no or ask us to delete your details, or we take you off our list sooner, we keep only your email address on a do-not-contact list, so that we never email you again. If you asked us to stop or said no, that list also holds your business’s web domain. When we delete the details of a business we emailed, we keep only its web domain and a scrambled (hashed) form of the email address, so that we never write to it a second time.
• Your choices. You can object at any time and we will stop. Use the unsubscribe link in any of our emails, reply “stop”, or email hello@reuno.co. You also have the rights listed under “Your rights”, including complaining to the ICO.

How the relay keeps both sides private

When a finder writes to a tag, the message comes to us and we pass it to the owner’s dashboard, with an email alert if the owner has alerts on. The owner replies from their dashboard and we pass the reply back to the finder’s page, and by email if the finder gave one. Neither side sees the other’s email address or phone number unless they choose to share it in a message.

Why we use your data

UK GDPR says we need a lawful basis for each use. These are ours:

Who we share it with

We use a small number of service providers. They process data only on our instructions and under contract.

• Supabase stores our database, item photos and sign-in. Our project is hosted in Frankfurt, Germany (EU).
• Vercel hosts the website and runs our servers in Frankfurt, Germany (EU). Its global network may deliver the site’s pages and images from a location near you.
• Resend sends our emails: sign-in codes, alerts and order emails.
• Google (Gmail) sends and receives our emails to businesses we contact about Reuno.
• Stripe takes card payments. Stripe is also a separate controller for data it needs to prevent fraud and meet its own legal duties. See Stripe’s privacy policy.
• Delivery companies (Royal Mail, or a courier for larger orders) receive your name and address to deliver your order.

We may also share data when the law requires it, for example in reply to a valid request from the police. We never sell personal data and never share it for advertising.

Some of these providers are based in the United States or use sub-processors there. When data leaves the UK we rely on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, where the provider is certified) or on the ICO’s International Data Transfer Agreement or Addendum.

Cookies

We only use cookies that the site needs to work, so we do not ask for consent to them. We use no analytics or advertising cookies.

Stripe sets its own cookies on its checkout pages.

How long we keep it

• Account, tags and messages: while your account is open. When you delete your account we delete your profile and messages and remove your details from your tags, and the data leaves our providers’ backups within 30 days.
• A tag’s messages: if you remove a tag from your account, your past conversations about it stay in your inbox (the tag’s next owner cannot see them) until you delete your account.
• A finder’s email: deleted with the conversation it belongs to.
• Scan records: 12 months, then deleted automatically.
• Hashed IP addresses: 2 days for rate limits. On reports, enquiries and support messages, 30 days. Then deleted automatically.
• Orders: 6 years, to meet UK tax rules.
• Business enquiries, quote requests, support messages and reports about a tag: 2 years after the last message, then deleted automatically. Emails in our inbox are kept for the same time.
• Businesses we contact: 12 months after our last email if there is no reply, or 24 months after the last reply, then deleted automatically, keeping only the business’s web domain and a scrambled (hashed) form of the address so that we never write to it twice. An email address that asked us to stop, said no, bounced, asked to be deleted or was taken off our list sooner stays on our do-not-contact list, so that we never email it again.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of your data (you can also download it from your dashboard)
• correct data that is wrong
• delete your data
• limit how we use it, or object to how we use it
• move your data to another service
• stop using data we hold with your consent, at any time

Email hello@reuno.co. We reply within one month and it is usually free. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.

Keeping it safe

• Every page and email link uses HTTPS.
• Database rules mean owners can only ever read their own tags and messages.
• Finder conversation keys and IP addresses are stored only as one-way hashes.
• Only the people who run Reuno can reach the admin tools, and only when they need to.

Children

Reuno is for adults to buy and manage. Tags are often put on children’s things, and the finder page shows no name unless the owner adds one. We do not knowingly collect data from children under 13. A parent or guardian should set up the tag.

Changes and contact

If we change this policy we will update the date at the top. For important changes we will also email account holders. Questions or requests: hello@reuno.co, or write to Arthur Both, trading as Reuno, 36 Lancaster Mews, London, W2 3QF, United Kingdom. See also our terms and refunds and delivery pages.