Privacy policy

Who we are

This policy comes from Reuno (“Reuno”, “we”, “us”). We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything about your data, email hello@reuno.co.

The short version

• A tag carries a random code and, if a business gave it to you, that business’s name. Your name, phone number, email and address are never printed on it.
• Finders message you through our relay. They never see your email or phone number, and you never see theirs.
• We never sell personal data. We run no advertising or analytics trackers.
• You can download your data or delete your account at any time from your dashboard.

What we collect from tag owners

• Your account. Your email address, so we can sign you in with a one-time code or link. Your first name if you add it, your alert settings, and the language you use the site in, so our emails to you can be in it.
• Your tags. Each tag’s code, item name, colour, your note to finders, any reward or drop-off details, whether lost mode is on, and whether finders see your first name.
• Messages. What you and finders write to each other, and any location a finder chooses to share.
• Scans. When a tag was scanned, whether by QR code or NFC, and the approximate town or city and country. This comes from the finder’s internet connection, not their GPS. Scans you make while signed in to your own account are not counted.
• Tags from a business. If a business gave you your tag, it never gets your messages or your contact details. Like anyone who scans your tag, it sees only what you choose to show finders, such as your first name. We may tell it totals across its tags, such as how many have been claimed or scanned, never who, and only once enough are claimed that no one can be picked out.
• Orders. Your name, email, delivery address, what you bought, what you paid and the language you ordered in, so the emails about your order can be in it. Card payments are handled by Stripe. We never see or store your full card number. We also use your email to find your past Reuno orders, at Stripe and in our own records, so first-order codes work only once per person (see “Emails to customers” below).
• Support. Anything you send us by email.

Emails to customers

• Order emails. Your order confirmation, delivery email and replies to your questions. We need to send these to fulfil your order, so you cannot opt out of them.
• Your past orders. When you start a checkout, we use your email to find your past Reuno orders, at Stripe and in our own records, so first-order codes work only once per person. For this we make a customer record at Stripe with your email, even if you do not finish your order. If you do not, we delete it within 7 days.
• One code to share. After each order we send you one email with a 10% discount code (FRIEND10) to pass on to a friend. We tell you about it under the email box in our shop, and in your order confirmation.
• Why we can send it. You gave us your email when you bought from us, the email is about our own tags, and you can say no: in the shop when you give us your email, and at any time after. This is the “soft opt-in” in the Privacy and Electronic Communications Regulations (PECR). Under UK GDPR our lawful basis is legitimate interests: telling customers about a simple way to share Reuno.
• How to say no. Tick “Don’t send me the code to share” in the shop. Or use the opt-out link in your order confirmation or in that email, reply “stop”, or email hello@reuno.co. Your order emails still come as usual.
• The opt-out list. If you say no, we keep your email address, when you opted out and how, and nothing else, so that we never send you another offer email.

What we collect from finders

You do not need an account to use a finder page, and you do not have to give us any contact details.

• Your message and, if you add them, your first name and where you found the item.
• Your email address, only if you give it, so we can tell you when the owner replies. The owner never sees it.
• Your location, only if you tap to share it. It is shown to the owner in your conversation.
• The language your browser uses, so the page and our emails can match it.
• The approximate town or city and country of the scan, as described above.
• A cookie that keeps your conversation open on your device (see Cookies).
• A scrambled, one-way version (a hash) of your IP address. We use it only to limit spam and abuse, and we cannot turn it back into your IP address.

Business quote requests

If you ask for a business quote we collect your name, company, work email, the quantity and colour you want, what the tags are for and the language you used the site in. We use this to reply in that language, prepare a quote and send a digital proof.

Businesses we contact about Reuno

We email a small number of UK businesses, such as letting agents, hotels, gyms and merchandise companies, to offer them Reuno’s branded key tags. This section explains what we hold about a business we contact and why.

• Where we found you. On your business’s own website, or in a public business listing (OpenStreetMap). Each email says which. Our system finds businesses in OpenStreetMap and reads a few public pages of their own websites (as “ReunoBot”, following the site’s robots.txt), and may check the public Companies House register.
• What we hold. The business name, the work email address we wrote to and, where they were published with it, the business’s phone number, website, town and postcode. We also keep our notes on the type of organisation and the public words that show it (for example a company number on your website, with the page and the date we saw it), why Reuno might suit it, the emails we sent and any replies.
• Why. To tell businesses about a product that may be useful to them. Our lawful basis is legitimate interests. We only write to organisations that show they are a company, a charity or a public body, never to sole traders or partnerships without their consent. We send one follow-up at most, and only if you have not replied.
• Who handles it. Our emails to businesses are sent and received through Google (Gmail). The details are stored in our database (see “Who we share it with”).
• How long. If you do not reply, we delete your details 12 months after our last email. If you reply, we delete them 24 months after the last message. If you ask us to stop, say no or ask us to delete your details, or we take you off our list sooner, we keep only your email address on a do-not-contact list, so that we never email you again. If you asked us to stop or said no, that list also holds your business’s web domain. When we delete the details of a business we emailed, we keep only its web domain and a scrambled (hashed) form of the email address, so that we never write to it a second time.
• Your choices. You can object at any time and we will stop. Use the unsubscribe link in any of our emails, reply “stop”, or email hello@reuno.co. You also have the rights listed under “Your rights”, including complaining to the ICO.

How the relay keeps both sides private

When a finder writes to a tag, the message comes to us and we pass it to the owner’s dashboard, with an email alert if the owner has alerts on. The owner replies from their dashboard and we pass the reply back to the finder’s page, and by email if the finder gave one. Neither side sees the other’s email address or phone number unless they choose to share it in a message.

Why we use your data

UK GDPR says we need a lawful basis for each use. These are ours:

Who we share it with

We use a small number of service providers. They process data only on our instructions and under contract.

• Supabase stores our database, item photos and sign-in. Our project is hosted in Frankfurt, Germany (EU).
• Vercel hosts the website and runs our servers in Frankfurt, Germany (EU). Its global network may deliver the site’s pages and images from a location near you.
• Resend sends our emails: sign-in codes, alerts, order emails and the code to share.
• Google (Gmail) sends and receives our emails to businesses we contact about Reuno.
• Stripe takes card payments. When you start a checkout, Stripe keeps a customer record with your email for us, so it can tell a first order from a repeat one. Stripe is also a separate controller for data it needs to prevent fraud and meet its own legal duties. See Stripe’s privacy policy.
• Delivery companies (Royal Mail, or a courier for larger orders) receive your name and address to deliver your order.
• The company that gave you a tag, only if you tick “Yes, [company] may email me” when you set the tag up. We pass on your email address, the date and the words you agreed to, nothing else (never your items, messages or location). The company then uses it under its own privacy policy, as a separate controller. You can withdraw on your tag’s page or by emailing hello@reuno.co: we stop passing it on and ask the company to stop emailing you.

We may also share data when the law requires it, for example in reply to a valid request from the police. We never sell personal data and never share it for advertising, except your email address with a company whose box you tick (above).

Some of these providers are based in the United States or use sub-processors there. When data leaves the UK we rely on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, where the provider is certified) or on the ICO’s International Data Transfer Agreement or Addendum.

Cookies

We only use cookies that the site needs to work, so we do not ask for consent to them. We use no analytics or advertising cookies.

The shop also keeps the email address you type, and whether you ticked the box about the code to share, in your browser for that tab only, so they are still there if you come back from the payment page. They go when you close the tab. The language you choose is also kept in your browser’s storage, so the finder page can use it too. Stripe sets its own cookies on its checkout pages.

How long we keep it

• Account, tags and messages: while your account is open. When you delete your account we delete your profile and messages and remove your details from your tags, and the data leaves our providers’ backups within 30 days.
• A tag’s messages: if you remove a tag from your account, your past conversations about it stay in your inbox (the tag’s next owner cannot see them) until you delete your account.
• A finder’s email: deleted with the conversation it belongs to.
• Scan records: 12 months, then deleted automatically.
• Hashed IP addresses: 2 days for rate limits. On reports, enquiries and support messages, 30 days. Then deleted automatically.
• Orders: 6 years, to meet UK tax rules.
• Your customer record at Stripe: if you start a checkout but do not finish your order, we delete it within 7 days. If you order, we keep it with your order records.
• Offer email opt-outs: your email address, when you opted out and how, for as long as we send offer emails, so that we never send you another.
• Business enquiries, quote requests, support messages and reports about a tag: 2 years after the last message, then deleted automatically. Emails in our inbox are kept for the same time.
• Businesses we contact: 12 months after our last email if there is no reply, or 24 months after the last reply, then deleted automatically, keeping only the business’s web domain and a scrambled (hashed) form of the address so that we never write to it twice. An email address that asked us to stop, said no, bounced, asked to be deleted or was taken off our list sooner stays on our do-not-contact list, so that we never email it again.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of your data (you can also download it from your dashboard)
• correct data that is wrong
• delete your data
• limit how we use it, or object to how we use it
• move your data to another service
• stop using data we hold with your consent, at any time

Email hello@reuno.co. We reply within one month and it is usually free. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.

Keeping it safe

• Every page and email link uses HTTPS.
• Database rules mean owners can only ever read their own tags and messages.
• Finder conversation keys and IP addresses are stored only as one-way hashes.
• Only the people who run Reuno can reach the admin tools, and only when they need to.

Children

Reuno is for adults to buy and manage. Tags are often put on children’s things, and the finder page shows no name unless the owner adds one. We do not knowingly collect data from children under 13. A parent or guardian should set up the tag.

Changes and contact

If we change this policy we will update the date at the top. For important changes we will also email account holders. Questions or requests: hello@reuno.co. See also our terms and refunds and delivery pages.