Privacy Policy

This policy explains how Ecoflink AS(“Ecoflink”, “we”) handles personal data when you use the Ecoflink mobile app, claim a bag return on the Ecoflink web app, or visit ecoflink.no. We collect as little as we can and never sell your data.

Who is responsible

Ecoflink AS (org.nr 937043996), Karles vei 28B, 8403 Sortland, Norway, is the data controller. Questions or requests: mail@ecoflink.no.

The Ecoflink app

Ecoflink lets stores reward you for reusing shopping bags. You get one Ecoflink account that works with every participating store.

What we collect

• Account: your email address (used to log in with a one-time code), and the first and last name you choose to add.
• Reuse activity: which participating stores you have joined, your reuse progress and lifetime reuses with each store, bags linked to you, and when and at which store a bag was scanned, returned or claimed.
• Rewards: coupons you redeem, the voucher code, the store and the time.
• Sign-in security: one-time login codes and session tokens, stored only in hashed form.

The app uses your camera only to scan return QR codes. Images are processed on your device and never stored or uploaded. The app has no ads, no third-party analytics or tracking, and does not use your location.

Why we use it

• To provide your account, track your reuses and let you redeem rewards. This is necessary to provide the service you signed up for (GDPR art. 6(1)(b)).
• To keep the service secure and to produce statistics for participating stores, such as how many bags were reused. This is our legitimate interest (art. 6(1)(f)).

Who can see it

• Participating stores see the members of their own program: your name, email, reuse progress and redemptions with them, so their staff can honor your rewards. A store never sees your activity at other stores.
• Service providers who process data on our behalf: our server hosting, and Resend (Resend Inc., USA), which delivers login code emails. Transfers to the USA are protected by the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

How long we keep it

Login codes expire after 5 minutes and sessions after 90 days. Everything else is kept for as long as you have an account.

Deleting your account

Delete your account any time in the app under Profile → Delete account, or see how to delete your account. This permanently deletes your profile, store memberships, progress and sessions. Scan and redemption history that stores need for their records is kept without any link to you.

The website

• Contact and registration forms collect what you type in (such as name, email, phone, address). The forms are delivered to us by Formspree. We use the information only to answer you or follow up on your registration, and delete it when it is no longer needed.
• Statistics: we use Vercel Web Analytics, which counts page visits without cookies and without identifying you.

Your rights

You can ask for access to, correction of or deletion of your personal data, ask us to restrict or stop processing it, and ask for a copy in a portable format. Email mail@ecoflink.no from the address on your account and we will answer within 30 days. If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Children

The Ecoflink app is not intended for children under 13.

Changes

If we change this policy we will update the date above, and tell you in the app if the change matters to you.