Last updated: 15 September 2026
This policy explains what personal information Inventyl collects, why, and what choices you have. Inventyl is provided by Crossthread, a sole proprietorship ("we", "us"). For privacy questions, contact support@inventyl.com.
What we collect
- Account information — your name and email address, and the authentication records needed to sign you in.
- Organization and inventory data — the items, quantities, locations, suppliers, labels, reports, photos and other content you and your team add. This is your business data; we process it to run the Service for you.
- Team information — email addresses of people you invite, and their roles.
- Technical and security data — IP address, browser and device information, request logs and records of suspicious or abusive traffic, used to keep the Service secure and working.
- Billing information — if you subscribe, our reseller Paddle.com collects your payment details, billing address and tax information. We receive your customer and subscription status (for example, plan, renewal date and cancellation), not your full card number.
- Support messages — anything you send to our support email.
If you use Inventyl without signing up, your data stays on your device (in your browser's storage) and is not sent to us.
How we use it
We use personal information to provide and secure the Service, sync your data across devices and team members, send account and service emails (such as invitations, password resets and scheduled reports you set up), process subscriptions, respond to support requests, and comply with legal obligations.
Where the EU/UK GDPR applies, our legal bases are: performing our contract with you; our legitimate interests in securing, maintaining and improving the Service; and compliance with legal obligations (for example, tax and accounting records).
We don't sell personal information, and we don't use advertising or third-party analytics trackers.
Invoice and document scanning
Text recognition for scanned invoices and documents runs in your browser. Images are not uploaded to us or to a third party for recognition. The fallback recognition engine downloads its program files and language data from a public content delivery network (jsDelivr), which will see your IP address when that happens. Photos you choose to attach to items or records are stored with your organization's data.
Barcode scanning
When you are signed in, the app reports how barcode scanning performed on your device: which decoder ran (your browser's built-in one, or our bundled fallback), how long a decode took, whether it succeeded, and coarse device information such as "iOS/Safari". This is our own measurement, sent to our own API — not a third-party analytics service — and we use it to find out why scanning is slow or unreliable for some devices.
Barcode values are not included, with one exception: when the scanner reads the same label twice and gets two different answers, both values are sent, because the difference between them is the only way to diagnose a misread. A barcode value identifies a product, not a person. Those values are erased after 30 days, and the scanning measurements themselves are deleted after 90 days.
If you use Inventyl without signing up, none of this is sent — as with the rest of your data, it stays on your device.
Where the app gets in your way
When you are signed in, the app also reports moments where something went wrong for you: an error we showed you, a save or sync that failed, a search that found nothing, a step you started and left, a retry, or a camera that wouldn't open. Each report says what kind of problem it was, which screen it happened on, and when — for example "a search found nothing, on the items screen".
What you type is never included. We do not send your search terms, item names, customer names, or anything else you entered. For a search that found nothing we record only that it happened and roughly how long the query was, which is enough to tell a typo from a gap in your catalogue without us seeing the words. Our database will not accept these reports unless they are short, plain labels, so your content cannot end up in them by mistake.
We use this to find the parts of Inventyl that are failing people, rather than waiting for someone to write in about it. It goes to our own API, not to a third-party analytics service, and it is deleted after 90 days. If you use Inventyl without signing up, none of it is sent.
Service providers
We use these providers to run Inventyl. They process data on our behalf, under contracts that restrict their use of it:
- Amazon Web Services (United States) — hosting, database, authentication (Amazon Cognito) and email delivery (Amazon SES).
- Cloudflare — network security, DNS and content delivery.
- Google Workspace — our support email.
- Paddle.com — our reseller and Merchant of Record, which handles checkout, payments, invoicing and sales tax. Paddle acts as an independent controller for the payment information it collects; see Paddle's privacy notice.
International transfers
Our main hosting is in the United States. Where we transfer personal information from the EU/EEA or UK, we rely on appropriate safeguards such as the EU–US Data Privacy Framework (where the provider is certified) or the European Commission's Standard Contractual Clauses.
Storage in your browser
Inventyl stores data in your browser so it can work offline and keep you signed in: a sign-in session cookie for api.inventyl.com, local storage and IndexedDB for your settings and offline copy of your data, and a service worker cache for the app itself. These are necessary for the Service to work. We don't use advertising or analytics cookies.
How long we keep it
Scanning measurements are deleted after 90 days, and the barcode values described above after 30. We keep account and organization data while your account is active. If you delete your organization or account, we delete the associated data from our active systems within 30 days; copies in backups are removed as those backups expire. Security logs are kept for a limited period. We keep billing and tax records for as long as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can export your inventory data from the app at any time. To exercise any right, email support@inventyl.com. We'll respond within one month.
If you're in the EU/EEA, you can complain to your local data protection authority — in Denmark, Datatilsynet. If you're in Canada, you can contact the Office of the Privacy Commissioner of Canada.
Security
We use encryption in transit (HTTPS), access controls, signed session cookies, database backups and monitoring for abusive traffic. No system is perfectly secure; if a breach affects your personal information, we'll notify you and the relevant authorities as required by law.
Children
Inventyl is a business tool and isn't directed at children under 16.
Changes
We'll post updates to this policy on this page and change the date above. For material changes, we'll notify account owners by email or in the app.
Contact
Crossthread
support@inventyl.com