Version: 1.0 | Last Updated: 13 October 2026 | Status: Draft — Pending Legal Review
Privacy Policy
Draft for legal review. Planned effective date: 10 November 2026.
In short
- Tech by Build runs Polarpass and is responsible for the personal data we use for accounts, billing, support, security and passport statistics.
- When a business puts personal data into its product passports, that business is responsible for it. We handle it on the business's behalf under the data processing agreement in our Terms.
- We do not sell personal data, show advertising or use customer content to train AI models.
- Passport statistics count views and scans without cookies, IP addresses or visitor identifiers.
- Questions and requests: privacy@techbybuild.com.
1. Who we are
Polarpass is operated by Tech by Build, the trade name of Menno de Vries, a sole proprietorship (eenmanszaak) established in the Netherlands. A sole proprietorship is not a separate legal entity, so 'we' in this policy means Menno de Vries, trading as Tech by Build. Chamber of Commerce (KVK) number 96687762. VAT number NL005225215B96.
Postal address, registered with the KVK as our correspondence address: Hallenweg 16, 5683 CT Best, the Netherlands. We do not receive visitors at this address. Our business address is a private home address and is shielded in the Dutch Business Register.
This policy covers the Polarpass website at https://polarpass.eu, the Polarpass app, and passport pages we host, including on customer domains.
Privacy questions and requests: privacy@techbybuild.com. Support and security reports: support@techbybuild.com or the contact form at https://polarpass.eu/contact. You can also call +31 6 21195761 or write to the address above, marked 'Privacy'.
We have not appointed a data protection officer, because the GDPR does not require one for our activities. The privacy address reaches the person responsible for data protection at Tech by Build.
2. Who is responsible for your data
For account administration, billing, support, security, running the service and passport statistics, Tech by Build decides how and why personal data is used. For that data we are the 'controller' under the GDPR, and this policy explains how we handle it. Customers cannot change how passport statistics are recorded, which is why we are the controller for them.
A business using Polarpass decides what goes into its passports and what it publishes. If it includes personal data, such as a supplier contact's name, that business is the controller and must have a lawful reason to use and publish it and must inform the people concerned in its own privacy notice. We store and display that data on its instructions as its 'processor', under the data processing agreement (verwerkersovereenkomst) attached to our Terms. Product facts that do not relate to an identifiable person are not personal data.
Questions about personal data in a passport are best sent to the business that published it, using the contact details on the passport. You can also contact us and we will help identify that business and help it respond.
3. Personal data we collect
We need an email address to create an account, and billing details to sell a paid plan. Without them we cannot provide those services. Everything else is optional. You never need an account or to give us any data to read a public passport.
The app asks for device permissions only when you use a feature that needs them: the camera to scan QR codes or take product photos, your photo library to choose images, and notifications for push messages. We never access your contacts or precise location.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and team | Name, email, username, user ID, workspace or brand name, business website, country, company-size range, chosen product categories, role, invitations, account dates. | You, or the workspace administrator who invites you. |
| Workspace activity | Which member created, edited, imported, duplicated, archived, restored, published or unpublished which passport, or uploaded or changed which image or document, and when. Members who can open a passport can see its history. | Your use of the workspace. |
| Sign-in | Email verification records, session records and their expiry or revocation. With Apple or Google sign-in: the provider's account ID, verified email (Apple may give a relay address) and any name it shares. If password sign-in is enabled, a password hash, never the password. | You and your sign-in provider. |
| Contract records | Customer legal name, the accepting person, the exact Terms and DPA text, version, content hash, acceptance statement, channel and time. | You, when you accept the Terms. |
| Passport content | Product descriptions, materials, origin and supplier details, responsible-operator contacts, photos, certificates, declarations, repair information, documents, translations, published versions and identifiers. Image credits are published with the image and can contain a photographer's name. These can include personal data about you or others. Do not upload health data, identity documents or other sensitive data. | You and your workspace. |
| File-rights confirmations | Who confirmed, which file (reference and checksum), the exact statement and version, the time, for images where the image comes from (for example your own photograph or a supplier), and any source or licence reference you add. | You, when you upload or publish a file. |
| Billing | Plan, billing provider and customer or subscription IDs, transaction or purchase IDs, status, renewal dates, chargeable usage, and the business name, billing address and VAT number that Stripe Checkout asks for. Card details are entered with the payment provider; we never receive full card numbers. | You, Stripe, Apple or Google. |
| Support and notifications | Messages and attachments you send us by email or the contact form, in-app notifications, notification settings, push device ID, platform, push token and delivery status. | You and your device, when you enable push. |
| Technical data | IP address and browser or device information that every web request carries, used to deliver pages and protect the service. Security logs are kept separately from passport statistics. | Your browser or app. |
| Passport statistics | See section 5. | Our server, when a passport is opened or scanned. |
4. Why we use it and our legal grounds
Accepting our Terms is not consent from people named in a passport. A business that includes their personal data must rely on its own legal ground. We do not send newsletters or marketing; if we ever do, we will ask for consent where required, and you can always object.
| Purpose | Legal ground (GDPR) |
|---|---|
| Providing your account, workspace, tools, exports and plan | Contract (Art. 6(1)(b)) when you are our customer. For employees and team members of a business customer: legitimate interest in providing the customer's service and managing authorised access (Art. 6(1)(f)). |
| Hosting and publishing passport content | We act as processor on the customer's instructions under the DPA. |
| Recording contract acceptance and file-rights confirmations | Contract (Art. 6(1)(b)), and legitimate interest in documenting agreements, authority and permissions and handling claims (Art. 6(1)(f)). After an account is deleted: legitimate interest (Art. 6(1)(f)) only. |
| Taking payment, calculating VAT and managing allowances | Contract (Art. 6(1)(b)), or legitimate interest for business contacts (Art. 6(1)(f)). |
| Keeping invoices and accounting records | Legal obligation (Art. 6(1)(c)) under Article 52 of the Dutch General Tax Act (AWR) and VAT rules. This does not justify keeping other account or passport data for that period. |
| Security, abuse prevention and keeping the service running | Legitimate interest in protecting users, data and the service (Art. 6(1)(f)). |
| Answering questions, complaints and requests | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) for rights requests and legally required disclosures. |
| Operational emails and in-app alerts | Contract (Art. 6(1)(b)), or legitimate interest for business contacts (Art. 6(1)(f)). |
| Push notifications on your phone | Consent (Art. 6(1)(a)). You can turn push off at any time in the app or your device settings. |
| Passport statistics (section 5) | Legitimate interest in giving customers basic information about how often their passports are used, with the least data needed (Art. 6(1)(f)). |
| Defending legal claims | Legitimate interest (Art. 6(1)(f)), only for as long as the claim requires. |
5. Passport statistics
When a public passport is opened or its QR code is scanned, our server records one entry with the passport, whether it was a view or a scan, the time, the country our network provider derives from the request, a broad device type (mobile, tablet or desktop) and whether the request looks automated.
We do not store the IP address, the browser's user-agent text, the referring page or any visitor or browser identifier with these entries, and we do not count unique or returning visitors. Views are counted on our server when the page is delivered; no script in your browser sends a separate signal, and no cookies or device storage are used. Browsers that send a Do Not Track or Global Privacy Control signal are not counted.
Workspace owners and administrators see totals per day, country and device type. Entries are deleted after 395 days, about 13 months. Older entries that contained more detail are reduced to these fields when this version takes effect.
6. Public passports, previews and version history
Publishing makes the selected fields, images and documents available to anyone with the link or QR code, including on customer domains. Others can view, copy, download or index public content. Fields and files marked internal or hidden are never included in public pages, but authorised workspace members can see them.
Each publication keeps a public version. Changing a draft or making a file private does not change versions that were already published. Archiving a product, cancelling a plan, or marking a product discontinued or recalled does not remove its public page. Unpublishing removes public access to the passport and its versions. To have personal data removed from published history, contact the publishing business or us. We cannot recall copies others have already made.
Preview links expire after ten minutes. Anyone with a valid preview link can open it, so share it only with the intended reviewers. Avoid publishing supplier contacts, photos of people or other personal data unless there is a lawful reason and the people concerned have been informed.
7. Who receives data
We do not sell personal data. Only the providers below receive it, each limited to what its task needs. Providers that act on our behalf are bound by data processing terms with confidentiality and security obligations. Apple, Google and Stripe also use some data for their own purposes as independent controllers, as their privacy policies explain.
We run passport statistics ourselves; no outside analytics service receives passport visits. We do not use advertising, marketing-automation, AI or customer-support platforms. We will update this list before adding a provider.
Workspace members see data according to their role. Professional advisers may receive necessary information under confidentiality. We disclose data to authorities only when the law requires it. If the business is reorganised or sold, the records needed to continue the service may be transferred with appropriate safeguards and notice to you.
| Provider | What it does for us | Data | Location and transfer safeguard |
|---|---|---|---|
| Hostinger International Ltd, Cyprus | Server hosting for the app, database, file storage and backups; incoming email for our addresses. | All data held in the service; emails you send us. | Server in Frankfurt, Germany. Our daily backups are kept on the same server; Hostinger's weekly backups are stored separately from it in the same or a nearby Hostinger data centre region. Hostinger DPA with Standard Contractual Clauses for any transfer outside the EEA. |
| Cloudflare, Inc., United States | Network protection and delivery for the website and API. | IP address, request details and content passing through. | Global network, including outside the EEA. We use Cloudflare's standard proxy and security settings and do not receive or store its request logs. Cloudflare DPA with Standard Contractual Clauses and the EU-US Data Privacy Framework. |
| Resend (Plus Five Five, Inc.), United States | Sending sign-in codes, invitations and account emails, and delivering messages and reports of illegal content from our contact form to our support inbox. | Names, email addresses, message content and delivery data. Resend may sample emails for abuse prevention, as its security page explains. | United States. Resend keeps email data for 30 days. Open and click tracking are off. Resend DPA with Standard Contractual Clauses. |
| Expo (650 Industries, Inc.), United States, with Apple Push Notification service and Google Firebase Cloud Messaging | Delivering push notifications you have enabled. | Push token, notification text and the product or screen it links to. | United States and global infrastructure. Expo's terms include Standard Contractual Clauses; Apple and Google apply their developer and Firebase terms. |
| Stripe Payments Europe Ltd and Stripe Technology Europe Ltd, Ireland | Web subscription payments, VAT calculation and invoices. | Email, business name, billing address, VAT number, payment details you enter with Stripe, and subscription data. | EU, with transfers to the United States under Stripe's DPA and data transfer addendum. |
| Apple Distribution International Ltd and Google Ireland Ltd / Google Commerce Ltd, Ireland | Sign in with Apple or Google; App Store and Google Play purchases where offered. | Sign-in identifiers, the email and name you choose to share, purchase status. | Independent controllers under their own privacy policies; their affiliates may process data in the United States. |
8. Transfers outside the EEA
Some providers in section 7 process data in the United States or can access it from there, even though our server is in Germany. Each such transfer relies on an EU adequacy decision (the EU-US Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses. Ask privacy@techbybuild.com for a copy of the relevant safeguards; we may remove commercially confidential details.
9. How long we keep data
A cleanup job runs every hour and deletes data when the periods below end. Deleted data can remain in backups until those backups expire; if we ever restore a backup, we repeat the deletions first.
Providers keep their own copies for their own periods. For example, Resend keeps email logs for 30 days and Google may keep Firebase installation IDs for up to 180 days after deletion is requested.
| Data | How long |
|---|---|
| Account and workspace | While your account exists. Deleting a workspace owner's account deletes the workspace, its public passports and team access. Deleting a member's account leaves the workspace in place. |
| Inactive free workspaces | If an unpaid workspace with no published passports has had no sign-in or activity for 24 months, we may delete it after 30 days' notice by email. |
| Passport content and public versions | Until you delete or unpublish it, or the workspace is deleted. Cancelling a plan does not delete it. |
| Workspace activity | While the passport it concerns and the workspace exist. If a member deletes their account, their entries remain without the link to that account. |
| Contract acceptance records | While the account exists, then 5 years without the link to the account, to document the agreement and handle legal claims. |
| File-rights confirmations and content-restriction records | While the product or workspace they belong to exists, including while a published version still contains the file. |
| Invoices and accounting records | 7 years under Dutch tax law, counted from when the record is no longer needed for the ongoing administration; 10 years for transactions under the EU VAT One Stop Shop scheme if we use it. |
| Passport statistics | 395 days. |
| Web sign-in session | Up to 30 days, or until you sign out. Revoked sessions are removed 7 days later. |
| Email verification codes | Removed 7 days after they expire or are used. |
| Team invitations | Removed 30 days after they expire, are accepted or are revoked. |
| Push registrations | Removed 30 days after you disable push, or after 180 days without use. |
| In-app notifications | 395 days. |
| Google Play purchase records awaiting confirmation | 30 days after they expire. |
| Uploaded files no longer used anywhere | 1 day. |
| Support messages | 12 months after the question or complaint is closed. |
| Reports of illegal content and our decisions | 3 years after the case is closed, or longer while a legal claim about it is ongoing. |
| Security logs | At most 90 days, unless needed to investigate a specific incident. |
| Rate-limit counters (can include an IP address) | At most 24 hours. |
| Records of privacy requests | 3 years after the request is closed. |
| Backups | We copy the database and uploaded files daily and keep each copy on the server for 7 days. Hostinger also makes a weekly backup of the whole server and keeps the two most recent, so deleted data can remain in a backup for up to about two weeks. |
10. Your rights
You can ask us for access to your personal data, correction, deletion, restriction, a copy in a machine-readable format (portability), or to stop processing based on legitimate interests (objection). Where we rely on consent, you can withdraw it at any time, as easily as you gave it; this does not affect earlier processing. Deletion is not absolute: we may keep records the law requires or that we need for a legal claim, and we tell you if that applies.
Right to object. Where we rely on legitimate interests (see section 4), you can object at any time on grounds relating to your situation, by emailing privacy@techbybuild.com. We then stop, unless we have compelling legitimate grounds that override your interests or need the data for a legal claim.
In the app you can download your data (Settings → Account → Download my data) and delete your account. Without signing in, you can request deletion at https://polarpass.eu/account-deletion. For anything else, email privacy@techbybuild.com. You do not need an account to ask about data in a public passport. We only ask for what we need to confirm your identity.
We respond within one month. For complex or multiple requests we can extend this by up to two months and will tell you why within the first month. Requests are free unless they are manifestly unfounded or excessive. Where we act as processor for a business, we pass your request to that business and help it respond.
11. Complaints
You can complain to a data protection authority, in particular in the EU country where you live, work or where the issue occurred. You do not have to contact us first. Our lead authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can also go to court.
Submit a complaint to the Dutch Data Protection Authority12. Cookies and device storage
We use no analytics, advertising or tracking cookies, so we do not show a cookie banner. If we ever add something that needs consent, we will ask first and make refusing as easy as accepting.
If Cloudflare shows a security check to a browser, it may set a strictly necessary cookie (cf_clearance) to remember that the check was passed. It is used only for security.
| Name or storage | Purpose | Duration |
|---|---|---|
| __Host-edpp_web_session (website cookie) | Keeps you signed in on the website. HttpOnly, SameSite=Lax, Secure. | Up to 30 days, or until you sign out. Without it you can still read public passports. |
| App device storage | Profile, onboarding choices and draft settings. | Until you sign out or remove the app. |
| App secure storage | Session token and push device ID. | Until you sign out or remove the app. |
13. Security
We protect data with random session tokens stored only as hashes, session expiry and revocation, role-based workspace access, server-side removal of internal and hidden content from public pages, rate limits, short-lived previews, upload type, size and signature checks, secure token storage in the app, web security headers and HTTPS on all public addresses. Administrative accounts are protected with two-step login.
No service can guarantee complete security. Report a suspected problem to support@techbybuild.com, without sending sign-in codes or session tokens. If a personal data breach occurs, we notify the authority and affected people when the GDPR requires it.
14. Children and automated decisions
Accounts are for adults using Polarpass for business. Anyone, including consumers, can read public passports without an account. If you believe a child has given us personal data, contact us and we will deal with it.
We make no decisions with legal or similarly significant effects based solely on automated processing. Automated checks such as rate limits, sign-in verification, bot detection and plan allowances only protect and operate the service. Readiness scores assess product information, not people.
15. Changes to this policy
We update this policy when our processing changes. We announce material changes by email to account holders and in the service before they take effect, and the date at the top shows the latest change. Where a change needs consent, we ask for it. Previous versions are available on request from privacy@techbybuild.com.