Privacy Policy

Effective Date: 2026-11-04

1. Introduction

This Service is operated by:

Bizarre Grzegorz Osak
Grabowiec 22A, 21-302
Lubelskie, Poland
NIP: 5381864992
REGON: 522616642
Email: support@thingidentity.com

Our Privacy Policy (“Privacy”, “Privacy Policy”) governs your visit to thingidentity.com and your use of the Thing Identity app for iOS, including its App Clip (together, “Service”), and explains how we collect, safeguard and disclose information that results from your use of our Service.

We use your data to provide and improve Service. The purposes, legal bases and retention periods of the processing are described further in this Privacy Policy. Unless otherwise defined in this Privacy Policy, the terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.

Our Terms and Conditions (“Terms”) govern all use of our Service and together with the Privacy Policy constitutes your agreement with us (“agreement”).

2. Definitions

SERVICE means the thingidentity.com website and the Thing Identity app for iOS, including its App Clip (“App”), operated by Bizarre Grzegorz Osak (“Bizarre”).

PERSONAL DATA means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).

USAGE DATA is data collected automatically either generated by the use of Service or from Service infrastructure itself (for example, the duration of a page visit).

COOKIES are small files stored on your device (computer or mobile device).

DATA CONTROLLER means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your data.

DATA PROCESSORS (OR SERVICE PROVIDERS) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively.

DATA SUBJECT is any living individual who is the subject of Personal Data.

HE USER is the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data.

3. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

4. Types of Data Collected

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). Personally identifiable information may include, but is not limited to:

0.1. Email address

0.2. First name and last name

0.3. Phone number

0.4. Address, Country, State, Province, ZIP/Postal code, City

0.5. Cookies and Usage Data

We use your email address for messages about your account and the Service, for example address verification, password resets, organization invitations and content moderation notices. We send the newsletter with news about the Service only if you consent to it, by ticking the box when signing up or in the notification settings (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). You can withdraw your consent at any time in the notification settings or with the link in any newsletter email; withdrawal does not affect the lawfulness of sending before it.

Usage DataWe may also collect information that your browser sends whenever you visit our Service or when you access Service by or through any device (“Usage Data”).

This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you access Service with a device, this Usage Data may include information such as the type of device you use, your device unique ID, the IP address of your device, your device operating system, the type of Internet browser you use, unique device identifiers and other diagnostic data.

Tracking Cookies Data

We use cookies and similar tracking technologies to track the activity on our Service and we hold certain information.

Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies are also used such as beacons, tags and scripts to collect and track information and to improve and analyze our Service.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

5. Use of Data

Bizarre uses the collected data for the following purposes and on the following legal bases:

0.1. to provide and maintain the Service, including your account and the interactive features of the Service: performance of a contract (Art. 6(1)(b) GDPR);

0.2. to provide customer support and answer messages: performance of a contract (Art. 6(1)(b) GDPR) and, for people without an account, our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR);

0.3. to send notices about your account and subscription, including expiration and renewal notices, and about changes to the Service: performance of a contract (Art. 6(1)(b) GDPR);

0.4. for billing, invoicing and collection: performance of a contract (Art. 6(1)(b) GDPR) and obligations under tax and accounting law (Art. 6(1)(c) GDPR);

0.5. to keep the Service secure and to detect, prevent and address technical issues: our legitimate interest (Art. 6(1)(f) GDPR);

0.6. to analyse the use of the Service and improve it: your consent to statistics cookies (Art. 6(1)(a) GDPR, section 12) and, for error reports and performance data, our legitimate interest (Art. 6(1)(f) GDPR);

0.7. to establish, exercise and defend legal claims and enforce our rights: our legitimate interest (Art. 6(1)(f) GDPR);

0.8. the newsletter: your consent (Art. 6(1)(a) GDPR, section 4);

0.9. other purposes: only with your consent, which we will ask for separately (Art. 6(1)(a) GDPR).

The processing of data of people visiting product pages is described in section 13a. Where we rely on our legitimate interest, you may object to the processing (section 10).

6. Retention of Data

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

7. Transfer of Data

We store and process data mainly in the European Economic Area (EEA): the Service's servers run on Amazon Web Services in Frankfurt, the database on MongoDB Atlas in the European Union, and error reports in Sentry in the European Union.

Some of our providers, in particular Google (Google Analytics), Microsoft (Microsoft Clarity) and Cloudflare (Turnstile), as well as the Amazon Web Services CloudFront network, may process data outside the EEA, including in the United States. We transfer data outside the EEA only with the safeguards required by Chapter V GDPR:

0.1. to the United States, on the basis of the European Commission's adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework (Art. 45 GDPR); all our U.S. providers (Amazon.com, Inc., Google LLC, Microsoft Corporation, MongoDB, Inc., Sentry and Cloudflare, Inc.) are active participants in that program;

0.2. additionally, and to other countries without an adequacy decision, on the basis of standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

You can obtain a copy of these safeguards by writing to support@thingidentity.com.

8. Disclosure of Data

We may disclose personal information that we collect, or you provide:

0.1. Disclosure for Law Enforcement.

Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities.

0.2. Business Transaction.

If we or our subsidiaries are involved in a merger, acquisition or asset sale, your Personal Data may be transferred.

0.3. Other cases. We may disclose your information also:

0.3.1. to our subsidiaries and affiliates;

0.3.2. to contractors, service providers, and other third parties we use to support our business;

0.3.3. to fulfill the purpose for which you provide it;

0.3.4. for the purpose of including your company’s logo on our website;

0.3.5. for any other purpose disclosed by us when you provide the information;

0.3.6. with your consent in any other cases;

0.3.7. if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others.

9. Security of Data

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

If you are a resident of the European Union (EU) and European Economic Area (EEA), you have certain data protection rights, covered by GDPR.

We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please email us at support@thingidentity.com.

In certain circumstances, you have the following data protection rights:

0.1. the right to access, update or to delete the information we have on you;

0.2. the right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete;

0.3. the right to object. You have the right to object to our processing of your Personal Data;

0.4. the right of restriction. You have the right to request that we restrict the processing of your personal information;

0.5. the right to data portability. You have the right to be provided with a copy of your Personal Data in a structured, machine-readable and commonly used format;

0.6. the right to withdraw consent. You also have the right to withdraw your consent at any time where we rely on your consent to process your personal information;

Please note that we may ask you to verify your identity before responding to such requests. Please note, we may not able to provide Service without some necessary data.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA).

11. Service Providers

We may employ third party companies and individuals to facilitate our Service (“Service Providers”), provide Service on our behalf, perform Service-related services or assist us in analysing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

12. Analytics

We may use third-party Service Providers to monitor and analyze the use of our Service.

On the website these are Google Analytics 4 and Microsoft Clarity, which run only after you accept statistics cookies in the cookie banner, and Sentry, which receives reports of errors in the website's code (the error, the page address and the browser and operating system versions, without your IP address) and, from about 10% of visits, data on the page's performance (load times and request addresses). Sentry keeps this data in the European Union for 30 days. Which of these run in the App is described in section 13.

13. Thing Identity App for iOS and App Clip

The Thing Identity app for iOS and its App Clip have their own App Privacy Policy. Pages served by our platform and shown inside the App are covered by this Privacy Policy as described there; their content is published by the brands that own the products.

13a. Visitors of Product Pages

This section is for people who visit product pages that brands publish on our Service, for example after scanning a code on a package, including when a product page links to this Privacy Policy instead of the brand's own. The controller of the data described below is Bizarre Grzegorz Osak. A brand that adds its own tools or forms to its page shows its own privacy policy.

What we process, why, on what basis and for how long

0.1. Showing the page and keeping the Service secure: IP address, browser and operating system type and version, page address (including the product's GTIN and scan parameters). Basis: our legitimate interest in serving the page and protecting the Service from abuse (Art. 6(1)(f) GDPR). Application logs are kept for 14 days.

0.2. Record of your choice in the cookie banner: consent ID, IP address, browser, page address and the categories you chose. Basis: the obligation to demonstrate consent (Art. 6(1)(c) in connection with Art. 7(1) GDPR). Kept for 4 years from when you gave it.

0.3. Statistics: Google Analytics 4 and Microsoft Clarity cookies, the product page view (GTIN, language, brand), device type, operating system, browser and approximate location (country, region, city). Basis: your consent to statistics cookies (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). Google Analytics keeps event data for 2 months and data tied to a user identifier for 14 months from the last visit; Microsoft Clarity keeps recordings for 30 days and heatmaps and click data for 13 months. Aggregated statistics, which do not tell who you are, are kept without a time limit.

0.4. Google signals and Google Ads campaign measurement: described in section 14; only with your consent to statistics and marketing cookies.

0.5. Product reviews: rating, text, your name if you give it, an anonymous browser key (the ti_review_viewer cookie), your votes on reviews and your reports of reviews. Basis: our legitimate interest in publishing and moderating opinions about products (Art. 6(1)(f) GDPR). Kept until the review or the product page is deleted.

0.6. Protecting forms from bots: when you send a review, a vote or answers to a survey, Cloudflare Turnstile checks your IP address and browser data. Basis: our legitimate interest in preventing spam (Art. 6(1)(f) GDPR). Cloudflare processes the data it uses to improve bot detection as a separate controller, under the Turnstile Privacy Addendum.

0.7. Reports of illegal content: name, email address and the content of the report (section 26 of the Terms). Basis: obligations under the Digital Services Act (Art. 6(1)(c) GDPR in connection with Art. 16 and 17 DSA). Kept for 12 months from the decision on the report.

0.8. Errors and performance: described in section 12; Sentry keeps the data for 30 days.

0.9. Campaigns of brands: a brand may show a survey, a picture or a message on its product page. Your browser keeps, in its local storage under ti-campaigns-closed, which campaigns you closed or answered, so they are not shown again; it holds no identifier, lasts at most 180 days, and is strictly necessary for the "do not show again" you ask for. How often a campaign was shown to you is kept under ti-campaigns-delivery only if you allowed marketing cookies; otherwise only until you reload the page. With the same consent your browser also keeps, under ti-campaigns-visits, when you first and last opened each product page (by its barcode), for 13 months from your last visit, so that a campaign a brand meant for a first visit is shown only then, and under ti-campaigns-seed one random value that decides whether you belong to the share of visitors a brand meant a campaign for; without that consent such campaigns are not shown to you at all. With the same consent your browser also keeps, under ti-campaigns-session, when your current visit to the brand's pages began and when you last opened one, so that a campaign closed "until the next visit" or shown once per visit keeps to it for the whole visit; without that consent we take a visit to be the last half hour. To choose which campaign to show, each time you open a product page your browser sends us what it remembers of campaigns (when you saw, closed or answered them, whether this is your first visit to the product, when your current visit began, and that random value), the batch or serial number of the scanned code if the page was opened with one, and the type of your device; we use it for that choice only and store none of it. A survey's discount code is given to you only after you send your answers. Showings, clicks and closings are counted only if you allowed statistics cookies, as numbers that do not tell who you are. Answers to a survey are kept anonymously: with the product, the language, the type of device and the day, but without your IP address, your browser or any identifier; the survey asks no open questions. Sending the answers is protected as in item 0.6. Basis for counting: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law); for the storage of what you closed or answered: the exception of Art. 399 of that law for storage strictly necessary for a service you asked for.

What the brand receives

The brand that published a product page sees the statistics of its pages in the Thing Identity dashboard only in aggregated form: numbers of views, countries, regions and cities, devices, operating systems, browsers and hours of visits, and, if you allowed marketing cookies, aggregated age, gender and interests from Google signals. The brand does not receive your IP address or cookie identifiers. Reviews are public; the brand sees them as any visitor does, and may reply to them and hide them under the Terms. The brand sees its campaigns' counts and the anonymous answers to its surveys.

Recipients and transfers outside the EEA

The data is processed on our behalf by Amazon Web Services (hosting in Frankfurt and the CloudFront network), MongoDB (database in the European Union), Sentry (Functional Software, Inc., data in the European Union), Google (Google Analytics), Microsoft (Microsoft Clarity) and Cloudflare (Turnstile). Google, Microsoft and Cloudflare may transfer data to the United States. The transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, in which these providers participate, and additionally on standard contractual clauses.

The App

In the Thing Identity App and its App Clip we do not run Microsoft Clarity or Google signals, whatever you choose in the cookie banner.

Your rights are described in section 10. Whichever brand's product page brought you to us, send requests about this data to us at support@thingidentity.com.

14. Google Signals and Google Advertising

We do not show ads on the website. If you accept statistics and marketing cookies in the cookie banner, Google Analytics 4 turns on Google signals: Google may tie your visit to your Google account if you are signed in and have ad personalization turned on. This lets Google give us aggregated data on visitors' age, gender and interests. We see it, as brands do in the statistics of their product pages, only in aggregated reports that do not tell who you are.

If you come to us from a Google Ads ad, with the same consent we keep the ad click ID (_gcl_aw and _gcl_ls, 90 days) to measure how our Google Ads campaigns perform. We do not use data from the Service to target ads at you (section 15).

Google also uses this data for its own advertising purposes, including personalizing ads on other websites and services. For that, Google is a separate controller and processes the data under the Google Privacy Policy. The data may be transferred to the United States; Google LLC participates in the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). You can withdraw it at any time in the cookie settings; withdrawing does not affect the lawfulness of processing before it. You manage ad personalization on your Google account in My Ad Center. Google signals never runs in the App (section 13).

15. Remarketing

We do not use remarketing: we do not target ads at you on other websites based on your visits to our Service.

16. Payments

We may provide paid products and/or services within Service. In that case, we use third-party services for payment processing (e.g. payment processors).

We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

17. Links to Other Sites

Our Service may contain links to or redirect to other sites that are not operated by us. If you click a third party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

18. Children’s Privacy

Only people aged 18 or over may create an account on the Service (section 12 of the Terms). We do not knowingly collect personal data of minors in connection with accounts.

Anyone may visit product pages, including a child under 16 (“Child”). A Child may consent to statistics and marketing cookies and publish product reviews only with the consent of a parent or guardian (Art. 8 GDPR).

If you become aware that a Child has given us personal data without such consent, write to us at support@thingidentity.com. We will delete that data.

19. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update “effective date” at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

20. Contact Us

If you have any questions about this Privacy Policy, please contact us: