Your brand and product data
You are the controller. Itemoo processes it on your behalf under a data processing agreement — you can read it before buying.
Security centre
Security, GDPR and availability — no marketing
Straight answers: who is responsible for which data, what keeps working when something fails, and what we don’t do. If your quality or IT team needs more, we will fill in your security questionnaire.
Who is responsible for which data
People who scan a code
We collect no personal data on a scan. Analytics are aggregated: country and time of the scan. Analytics cookies only with consent.
Visitors to this website
Demo and contact forms: the controller is InPayer sp. z o.o. We use the data only to reply and delete it after 12 months.
Technical basics
- Encrypted connections (TLS) on product pages, in the panel and in the API.
- Servers and files in the European Union (OVH, Warsaw) — every subprocessor’s location is in the subprocessor list.
- The Itemoo team accesses brand data only as far as support requires, with an event log.
- We report a personal data breach to you without undue delay, no later than 24 hours after detecting it (data processing agreement).
Documents you can read
Proof, not claims
Numbers you can verify during the demo
Page load times are design targets from the system's non-functional requirements — not an averaged marketing statistic. Languages and the code standard you can check yourself on the demo page.
- <300 ms
- Median product page render after a scan. p95 under 1.5 s.
- <100 ms
- Offline page open after the first visit — served from the device.
- 11
- Product page interface languages — labels follow the customer's phone, content follows the versions you add.
- GS1
- Codes follow the GS1 Digital Link standard — from product through batch to a single unit.
| Failure | Still works |
|---|---|
| AI model provider | Product page, recalls, documents, shop. The question form still accepts the question and forwards it to you. |
| Payment gateway | Product page, documents, cart preserved for the return trip |
| Mail server | Everything except email; the content goes to the log |
| Push notifications | Email as the fallback channel plus the scan banner |
| File storage | Product page with its full text content |
| Customer has no connection | The page from device cache after the first visit |
| AI quota exhausted | Recalls, product page and documents — always |
Regulatory alignment
GPSR: you enter responsible-entity data once and it appears with every product, and missing data blocks the first publication. DPP: the passport section covers materials, origin, carbon footprint and recycling — batteries from February 2027. UDI: GTIN per variant, because medical devices need a separate identifier for each SKU. Non-EU products: the passport and EU responsible-entity details ready before the goods enter the market.
Data protection
A scan records the country, not a precise location, and is never tied to a person. A shipping address typed before purchase stays on the customer's device. Customer accounts are passwordless — sign-in by emailed code, so there are no passwords to leak. Contact data lives in a separate table so it can be permanently erased.
Deployment safety
Startup halts on unsafe configuration rather than quietly shipping a hole. Files are validated by content, not by extension. The language model has no tools and no write access — everything it reads is data to it, never an instruction.
What sets us apart
Five rules we do not bend for convenience
These are not slide-deck slogans. Each one is enforced by the data contract or the architecture, so it cannot be waived when a deadline gets tight.
01 No cited source, no content
Every model-written statement must cite a source document and a quotation. The schema demands it (evidence: min(1)) — not a line in a prompt. A fragment without a cited source is dropped at validation, before it reaches you for approval.
02 A printed code must never lead nowhere
This single rule shapes the rest of the system: archiving instead of deletion, document versioning instead of file replacement, and no brand identifier change without a redirect. A label outlives a commercial decision.
03 Compliance is quoted, never generated
Safety data sheets, product passports and legal documents run in cite-only mode. The model does not paraphrase them, does not translate them and does not invent file addresses. The forbidden-field list is hard and covered by tests.
04 A quota never disables a safety feature
When the AI pool runs out, import and the assistant pause until the next month or until you raise the limit. You can let them continue at a charge, but only up to a spending cap you set yourself in the panel. Neither a used-up pool nor a plan limit ever blocks recalls, the product page or documents — user safety is not a line item in a pricing table.
05 The system reports a signal, not a verdict
With counterfeit signals we show the data alongside the legitimate explanation that could account for it. Whether it is a clone or a wholesaler with three warehouses is decided by the person who knows the distribution channel.
What we don't do
So that nothing is left unsaid when you buy:
- We don't register passports in the EU DPP registry — we give you the data as JSON-LD (schema.org), a GS1 linkset and through the /v1 API (from the Pro plan); filing it is the manufacturer's step.
- We don't certify products and we are not a notified body or legal adviser.
- The manufacturer is responsible for the content of safety data sheets, instructions and passport data — AI proposes, a person approves.
- We don't machine-translate files — safety data sheets, instructions, certificates; you upload language versions from your own supplier. Descriptions on the page, including the passport, are translated by AI as a draft marked “machine translation” that you publish after review. Passport content can have versions in all 24 official EU languages, and the page interface is in 11 languages.
Availability
Availability
Availability of the product page, the recall banner and the API is measured by an independent monitor running outside our infrastructure.
See service status →Report a vulnerability
Found a vulnerability? Write to us via the form with the subject “Bug or vulnerability report” — we reply within one working day.
Report a vulnerability →Company details
InPayer sp. z o.o.
ul. Złota 2 lok. 19, 15-016 Białystok, Poland
KRS 0001188374 · NIP 9662210066 · REGON 542449855
Bring one product. Leave with a working code.
For the demo we take your product’s documents, import them live, and show you the finished product page together with a code you can scan immediately. Thirty minutes, no slide deck.
No card, no commitment, no fifteen-email sales funnel.