Privacy policy.

1. The short version

• Buyers are never identified. Bippa records what was bought and what it cost, never who took it.
• There is no analytics, no advertising and no third-party tracking on this site. One cookie exists, and it is the one that keeps you logged in.
• Card details never reach us. MobilePay handles the payment, Stripe handles the club's subscription.
• Everything runs on servers in the European Union.

The rest of this page is the detail behind those four lines.

2. Who is responsible

This service is operated by Bippa, Kochsgade 31D, 5000 Odense C, Denmark. For anything in this policy, write to hello@bippa.dk.

Two different relationships run through the same product, and separating them answers the question of who to ask:

Your account, as a person

When you create an account, accept an invitation or log in, we decide what is stored and why. We are the data controller, and the rights in section 11 are exercised against us.

Your club's records

Products, prices, stock movements and sales belong to the club. The club decides what goes in and who may see it; we store and process it on the club's instructions. There the club is the controller and we are its processor.

3. What we collect about you

Only what the product needs to work. There is no profiling, no enrichment from other sources, and nothing is bought in.

Account

Your name and email address, and the times the account was created, last changed and, if it comes to it, deleted.

Logging in

Bippa has no passwords. We store the single-use login link we emailed you, when it expires and when it was used, plus your session tokens, when they were last rotated and when they expire.

Club membership

Which clubs you belong to and your role in each. An invitation holds the email address it was sent to, the token in the link, when it expires and when it was accepted.

Profile picture

If you upload one: the image, its filename, size and dimensions. Images sit in a private bucket and are served through short-lived signed links, never a public url.

Server logs

Our servers record requests to diagnose faults and abuse. These logs can contain an IP address and are kept briefly.

4. What your club records through Bippa

This is the club's operating data. Little of it is personal, but two parts touch a person, so they are listed here rather than buried:

Products and stock

Names, prices, cost prices, barcodes and stock counts. Every movement is a ledger line: what changed, by how much, what the count was afterwards, any note, and which volunteer recorded it. That last part is about a person, and it is deliberate - the point of a ledger is that a count can be traced back to whoever made it.

Points of sale

The name and description of each place the club sells from, and the token in its QR code.

Sales

Time, total, currency, status, the payment reference from MobilePay, the merchant number it was paid to, and the line items with their quantities and prices. No buyer.

MobilePay credentials

The club's merchant serial number and the API credentials it issues to Bippa. The secrets are encrypted before they are written to the database.

Subscription

For a club on a paid plan, the Stripe customer, subscription and price identifiers, the status, when the period ends and whether it is set to cancel. No card number, expiry or security code ever reaches us.

5. Buyers

Scanning the QR code at a point of sale creates no account and asks for no name, email or phone number. You scan what you are taking and you pay.

What Bippa keeps afterwards is a sale: the time, the items, the amount and a payment reference. Nothing in it points at a person. Two members buying the same cola a minute apart leave two records that cannot be told apart, and neither the club nor we can work out who either one was.

The payment itself is between you, MobilePay and the club. MobilePay sees the payer because it has to move the money, and it handles that under its own privacy policy, not this one. What comes back to us is whether the payment succeeded and a reference to it.

6. Cookies

Bippa sets one cookie, named session. It is set when you log in, it holds your signed session, and it is what stops the app asking who you are on every page. It is httpOnly, so no script can read it, and in production it is sent over https only.

There is nothing else. No analytics, no advertising pixels, no embedded trackers, no fingerprinting. That is why the site has no cookie banner: a strictly necessary cookie does not need consent, and we set no other kind. Logging out deletes it.

7. Why we are allowed to process it

To provide the service, GDPR article 6(1)(b)

Your account, logging in, club membership, and running the club's points of sale. Without this data there is no product.

Our legitimate interests, article 6(1)(f)

Keeping the service secure, diagnosing faults, preventing abuse, and recording which volunteer made a stock change so the club's ledger means something. We have weighed these against your interests and kept the data minimal.

A legal obligation, article 6(1)(c)

Records we or your club are required to keep, chiefly accounting records of payments.

8. How long it is kept

Your account

Until you or your club delete it. A deleted account is marked deleted at once and removed from our systems afterwards.

Login links and sessions

Login links expire within minutes of being sent and are void once used. Sessions expire on their own and are removed when you log out.

Invitations

Until accepted or expired.

Sales and stock records

For as long as the club keeps its books. A Danish club is generally required to retain accounting records for five years from the end of the financial year, and deleting a sale would leave a hole in the club's accounts, so these outlive the account of whoever recorded them.

Server logs

A short rolling window, then they are gone.

9. Who else processes it

We use a small number of providers to run the service: cloud hosting and database, payment processing, subscription billing, file storage and email delivery. Each is bound by a data processing agreement and may only act on our instructions.

A current list of the providers we use, by name, is available on request from hello@bippa.dk. We keep it there rather than on this page so that it is accurate on the day you ask.

Beyond these, we hand your data to nobody. We do not sell it, we do not share it for advertising, and a club cannot see anything about you beyond your name, your email and what you did in that club.

One outbound call is worth naming because it looks like sharing and is not: when a volunteer scans an unknown barcode, we look the product up in a public product database. The barcode goes out. Nothing about the person or the club does.

10. Where it is processed

The service runs on infrastructure located in the European Union. Some of our providers are headquartered outside the EU and may support their service from elsewhere; where that happens, the transfer rests on the European Commission's standard contractual clauses.

11. Your rights

Under the GDPR you may:

• Ask for a copy of what we hold about you
• Have anything inaccurate corrected
• Have your data erased, within the limits in section 8
• Ask us to restrict how we process it
• Receive it in a portable, machine-readable form
• Object to processing we base on our legitimate interests

Write to hello@bippa.dk and we will answer within a month. Where the data belongs to your club's records rather than your account, we will pass the request to the club, because the decision is theirs to make.

If you think we have got this wrong, you can complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk. We would rather you told us first.

12. Keeping it safe

Traffic runs over https. Session cookies are signed and unreadable to scripts, and sessions rotate as they are used. Your club's MobilePay secrets are encrypted before they are stored, so reading the database is not enough to spend the club's money. Access to production is limited to the people who need it.

No system is perfect. If a breach ever puts your rights at risk, we will tell Datatilsynet within 72 hours and tell you without undue delay.

13. Children

Bippa accounts are for the adults who run a club, and we do not knowingly create one for a child under 13. A child can of course buy a soda from a club, and nothing about that purchase identifies them.

14. Changes

When this policy changes, the date at the top changes with it. If a change materially affects you, we will email the address on your account rather than hope you check.