Your data, plainly explained.

1. Who is responsible

Grido AB (org. no. 559480-1945), c/- Dockplatsen 16, 211 19 Malmö, Sweden. Email: [email protected].

For this website and for the accounts of businesses and schools using Checklisted, we are the controller.

For the checklists themselves, the organisation that runs them (usually your employer) is the controller of the data of the staff who tick them. We process that data on its behalf (Art. 28 GDPR). If you tick checklists at work, please contact that organisation about your data; we will help it answer. Organisations using Checklisted find our data processing agreement at checklisted.me/dpa.

2. Visiting this website

When you open a page, your browser sends technical data (IP address, time, page, browser) to our hosting provider, Vercel Inc. This is needed to deliver the page and keep it secure (Art. 6(1)(f) GDPR). Logs are kept briefly and then deleted.

Fonts are served from our own server. Your browser does not connect to Google for them.

3. Accounts for businesses and schools

To sign up you give your email address and the name of your business or school; we also store your time zone, taken from your browser, so checklists start fresh at the right time. We use this data to run your account, send sign-in links and codes, and contact you about the service (Art. 6(1)(b) GDPR). If you choose to sign in with Google or Apple, they send us your email address and name (Apple may send a private relay address instead); we use them the same way. The data is stored with Supabase Inc. in the EU (Ireland).

Payments for the plan are handled by Stripe Payments Europe Ltd. (Ireland). When you subscribe, Stripe receives your email address, organisation name and the billing details you enter there (card, billing address, VAT number) to take payments and issue invoices (Art. 6(1)(b) GDPR). We never see your full card details; we store only your Stripe customer number and the state of your plan. Stripe may transfer data to Stripe, Inc. (USA), covered by the EU-US Data Privacy Framework and standard contractual clauses.

4. Ticking a checklist

Staff open a checklist through a link or a QR code; they don’t need an account. The first time, they type a name (a first name is enough). The name is kept on that phone, in the browser’s local storage, so it doesn’t have to be typed again; it can be changed with “not you?” or removed by clearing the browser’s site data.

Each tick and untick is stored with that name, the time, and, when the checklist was opened through a place’s QR code, the place’s name (for example “Kitchen”). The organisation sees this in its dashboard as a log of who did what, when and where. The data is stored with Supabase in the EU (Ireland) until the organisation deletes the checklist or its account.

We don’t ask staff for an email address, don’t email them, and don’t use their phone’s location: “where” is only the place whose QR code was scanned.

5. No analytics

Checklisted uses no analytics or tracking tools, on any page.

6. Cookies and local storage

We only store what the service needs (Art. 5(3) ePrivacy Directive; in Germany § 25(2) TDDDG): a sign-in cookie for businesses using the dashboard; during sign-in with Google, a cookie for up to 10 minutes that protects the sign-in; during sign-up with Google or Apple, a cookie for up to 15 minutes that carries the business name and time zone typed on the sign-up page; and, on staff phones, the name typed to tick (local storage, see section 4). We don’t use advertising or tracking cookies.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Art. 15–21 GDPR). Write to us at [email protected]. You may also complain to a data protection supervisory authority: our lead authority is the Swedish Authority for Privacy Protection (IMY, imy.se), or the authority where you live.