Privacy Policy

This is version 3 of this policy. We number versions instead of dating them. It was written ahead of RAQIOM’s registration in Israel and describes what GearLogs does today. It explains what data GearLogs handles, why, where it lives, and your rights — covering both account data we collect from you and operational data your organization enters into the Service.

1. What We Collect

Two categories. Account & authentication data — e-mail, name, organization, and login and security metadata. Operational data your organization enters — equipment records, and personnel names, roles, and custody assignments. Personnel data is entered by the customer organization, not collected by us directly from those individuals. Each time you sign in to your GearLogs account afresh (not when an existing session is restored), we record the time of the sign-in, the kind of device as a short label (browser and operating system, for example “Chrome · Windows”) and the IP address, and show them to you as a notice in your own notifications — and by e-mail, if you switched that on — so that a sign-in you did not make is easy to spot. The notice is deleted after 12 months. This applies to members’ accounts only; for people on a personnel list who sign in to My Gear, no IP address and no device identifier is kept, as described below. When a person on a customer’s personnel list signs in to My Gear, we keep a one-way fingerprint of the e-mail on their record, when the session was created and last used, and when it expires — never the e-mail itself, no IP address and no device identifier — so that the session can be proved and ended; the record is deleted thirty days after the session ends. When that person disputes a hand-over receipt, the words they write are stored with the receipt and are readable, on the customer’s Approvals screen, by the customer’s administrators and by the members it has given the right to confirm a hand-over on behalf — and by GearLogs support only while the customer has opened a support view of their workspace — never by other personnel, and never sent by e-mail. A person on a customer’s personnel list may receive at most one daily summary e-mail from each workspace whose personnel list they are on, at the address on their record, listing what is new on their My Gear page in the page’s own words; the customer can switch it off for its whole workspace, and every such e-mail carries a standard unsubscribe header.

2. Why We Process It & Legal Basis

We process account data to operate and secure your access, and operational data to provide the accountability and inventory service you use. For users in the EU, our legal bases are performance of a contract (Art. 6(1)(b)) and our legitimate interest in securing and improving the Service (Art. 6(1)(f)).

3. Sub-Processors

We use a small, named set of providers:

• Supabase — database and authentication. Primary data hosting in the EU (Frankfurt).
• Cloudflare — hosting, content delivery, and human-verification (bot protection) at sign-in and on the website’s contact form, over a global edge network. Human verification uses Cloudflare Turnstile; Cloudflare’s handling of that data is described in its Turnstile Privacy Addendum. When you send the contact form, only the domain of the e-mail address you give (never the whole address) is looked up through Cloudflare’s public DNS resolver, to check that it receives mail.
• Paddle — billing and payment processing (Merchant of Record); processes payment and limited billing-contact data.
• Resend (EU — Ireland) — delivery of the e-mails GearLogs sends (notifications, support replies, billing and security messages); processes recipient addresses and message content.
• Microsoft 365 — our mailboxes, where messages you send to us by e-mail (including website enquiries) are received and answered.

We maintain this as a living, named list and will notify material changes. We do not sell your data or share it for advertising.

4. Where Data Lives & International Transfer

Your primary database is hosted in the EU (Frankfurt), and the e-mails GearLogs sends are delivered through Resend in the EU (Ireland). Other providers operate across regions: Cloudflare delivers content and bot protection over a global network, Paddle handles payments as merchant of record under its own buyer terms, and our mailboxes are hosted by Microsoft 365. Where one of these providers processes personal data outside the EU, it does so under that provider’s own data-protection terms; write to [email protected] if you need the details for a specific provider. Israel holds EU adequacy status, which supports transfers between Israel and the EU.

5. Retention

We retain Customer Data for as long as your organization’s access is active, and for a limited window after termination (to allow export) — after which it is deleted or anonymized, except where law requires retention. We do not keep operational data indefinitely.

Support conversations inside GearLogs, and enquiries sent through the website form, are deleted from our database 12 months after the last activity in them. Two exceptions: a conversation our support team has marked to keep, and a feature request that is still on our roadmap (it is kept until it is shipped or dropped). Notifications, and the records of the e-mails GearLogs sends, are deleted 12 months after they were created. E-mails you send us directly, and the copy of a website enquiry that reaches our mailbox, stay in the mailbox; today we do not delete them automatically. You can ask us at [email protected] to delete your messages at any time, and we will do so unless the law requires us to keep them.

6. Security

We apply appropriate technical and organizational measures: encryption in transit and at rest, tenant isolation so one organization’s data is not accessible to another, optional two-factor authentication, and role-based access controls. No system is perfectly secure, and this description of our measures does not diminish our underlying duty to protect data.

If you believe you have found a security vulnerability, report it to [email protected] or via the contact named in /.well-known/security.txt; a person reads and responds to every report. We do not pursue legal action against good-faith security research conducted under this policy.

7. Your Rights

Subject to applicable law, you may request access to, correction of, deletion of, or a portable export of your personal data, and (for EU users) may object to or ask us to restrict certain processing. To exercise these, contact [email protected]; we aim to respond within 30 days. Where your organization is the controller of personnel data, some requests may be directed to it.

8. Cookies & Analytics

We use only essential cookies needed for authentication and security (for example, session cookies and Cloudflare’s bot-protection). We do not use advertising or cross-site tracking cookies.

We also use Cloudflare Web Analytics on gearlogs.com and in the app. It counts page views without cookies and without any identifier: Cloudflare receives the page address, the referring page, the browser type and the country of the request, and shows us those as totals. It never reads what you type or store in GearLogs, and we cannot see any individual visitor in it.

9. Children

GearLogs is intended for organizational and professional use and is not directed to individuals under 18. Responsibility for lawful entry of any personnel data, including any minor’s, rests with the customer organization (see Terms clause 4).

10. Breach Notification

If a data breach affects your data, we will notify you without undue delay and, where required, notify the Israeli Privacy Protection Authority or the relevant EU supervisory authority.

11. Changes to This Policy

We may update this policy. Each update carries a new version number, and members are asked to agree to it inside GearLogs. Continued use after a new version is published constitutes acknowledgment.

12. Controller Identity & Contact

The controller is RAQIOM. Its registration as a business in Israel is not yet complete; the registered details and address will be published here once it is. Privacy questions: [email protected]. Where your organization determines how personnel data it enters is used, it is the controller and GearLogs is the processor; a Data Processing Addendum governs that relationship and can be provided on request.