Last updated: 3 August 2026
This describes what Floor Lookup stores, why, and who else can see it. It is written to match what the software actually does — if you find a difference between this page and the product, the page is the bug and we want to hear about it.
Floor Lookup has two audiences and they are treated differently.
Retailers — the businesses who sign up, connect a catalog and put the app on their shop floor. You are our customer. The product data you connect is yours.
Associates — the staff who use the handset. They never create an account with us; a manager provisions them in the dashboard, and they sign in with a staff code and a PIN they choose themselves.
| Account | Company name, admin email addresses, a password hash (Argon2id — never the password), and an authenticator secret if two-factor is switched on |
| Billing | Whether you are trialing or subscribed, and identifiers issued by Stripe. We never see or store card details — those go to Stripe directly |
| Configuration | Your sites, your staff list, the handsets enrolled, and the connector settings that tell us how to read your catalog |
| Audit | A log of who changed what in the dashboard: the action, the target, the time |
Whatever your connector sends us: SKUs, names, categories, prices, barcodes, image URLs, and stock counts per site. This is your business data. We use it for one thing — showing it back to your associates on the handset — and we do not sell it, share it, or use it to train anything.
If your catalog contains anything you would not want on a phone, do not map it. The mapping is yours to write, and a field you do not map is a field we never receive.
A staff code, a display name, a home site, a hash of their PIN, and their sessions. An admin cannot see or set an associate's PIN — the setup code flow exists so that only the associate ever knows it.
Basket handoffs record the items an associate put in a basket, so the till can pick it up. They are business records, not personal ones, but they do name the associate who built them.
The catalog and stock counts are cached on the device, so the app works when the shop's WiFi does not. Also on the device: the enrolment credential (in the platform keychain), the signed-in session, and the current basket. Signing out clears the session and basket; revoking the handset from the dashboard erases the credential.
The app requests camera access for barcode scanning, and nothing else. No location, no contacts, no advertising identifier. There is no tracking and there are no third-party analytics in the app.
The dashboard sets one cookie: your session. It is HttpOnly, SameSite=Lax, and Secure in production. There are no analytics or advertising cookies, so there is no consent banner to click — we do not set anything that would need one.
| Processor | What they handle | Where |
|---|---|---|
| DigitalOcean | Hosting and the managed database | Amsterdam (EU) |
| Stripe | Payments. Card details go to them, never to us | EU/US |
| Migadu | Outbound email (password resets, notifications) | EU |
| Sentry | Crash diagnostics from the mobile app | EU/US |
| Expo (EAS) | Building and distributing the mobile app | US |
| Apple, Google | App distribution to handsets | Global |
Your data lives for as long as your account does. Delete your account and the tenant is removed, taking its catalog, stock, staff and devices with it. Backups roll off within 30 days. Audit logs are kept for the life of the account, because their purpose is answering "who changed this, and when".
If you are in the UK or EU, you have the right to access, correct, export or delete your data. For your own account, write to us and we will do it. For an associate's data, you are the controller and we are the processor — you can do most of it yourself in the dashboard, and we will help with the rest.
Passwords are hashed with Argon2id. Every tenant's data is isolated at the database level by row-level security, not by application code remembering to filter — a query that forgets the tenant returns nothing rather than everything. Traffic is HTTPS only. Two-factor authentication is available on dashboard accounts and we recommend it.
We are a small team and we do not claim a certification we have not been through. What we can tell you is what the software does, which is what this page is for.
achabanenko@gmail.com — privacy questions, data requests, or a correction to this page.
This page describes our practices in plain terms. It has not been reviewed by a lawyer; if you need a Data Processing Agreement or contractual privacy language for procurement, write to us and we will sort one out.