Passport StudiosPrivacy policy
Passport Studios is a web service that helps fashion brands collect product data from their suppliers and publish Digital Product Passports. This policy explains what personal data we handle, why, and what rights you have.
Who we are
Passport Studios is run by Eiður Unnarsson, Iceland. Contact: eidur@passportstudios.is. When this policy says "we", it means Passport Studios.
Our role
- For brand accounts (the people who sign up and use the dashboard) we are the controller of your account data.
- For data brands put into the service, including supplier contact details and supplier answers, the brand is the controller and we process the data on its behalf. If you're a supplier and have a question about your data, you can contact the brand that sent you the form, or us.
- Published passports are public pages. Brands decide what goes on them, and suppliers can mark answers as not for public display.
What we collect
| Who | Data | Why |
|---|---|---|
| Brand users | Email address, password (stored hashed by our authentication provider), brand membership and role, sign-in times | To give you access to your brand's workspace and keep it secure |
| Brand details | Company name, legal name, address, website, contact email | Shown on passports as the responsible company, and used as the reply-to address on supplier emails |
| Suppliers | Company name, country, contact name and email, answers to the form, uploaded documents, name of the person who signed off | To send the request, remind about it, and give the brand the answers |
| Invited teammates | Email address and role | To send the invitation and grant access |
| Everyone | Technical logs kept by our hosting providers (such as IP address, browser and time of request) | To run the service securely and fix errors |
We don't collect payment card details. If paid plans are introduced, payments will be handled by a payment provider and this policy will be updated.
Legal basis
- Performing our agreement with you when you use the service (GDPR Art. 6(1)(b)).
- Our legitimate interest in running, securing and improving the service, and the brand's legitimate interest in collecting product data that EU law requires (Art. 6(1)(f)).
- Legal obligations, for example bookkeeping, where they apply (Art. 6(1)(c)).
Emails
We send emails that are part of the service: supplier requests and reminders, notices to brands when a supplier answers or a request is overdue, and team invitations. Suppliers get at most three automatic reminders per request. We don't send marketing emails without asking first.
Cookies and local storage
We don't use advertising or analytics cookies. Your browser stores a sign-in session for the dashboard, drafts of supplier forms so work isn't lost, and small interface preferences. You can clear these in your browser at any time.
Service providers
| Provider | Used for | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | Data hosted in the EU (Ireland) |
| Netlify | Hosting the website | United States, with a global network |
| Resend | Sending emails | United States |
Where data is transferred outside the EEA, it happens under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep data
- Account and brand data: while the account is active. When a brand closes its account, we delete its data within 30 days, except published passport data the brand asks us to keep online and records we must keep by law.
- Supplier requests and answers: for as long as the brand keeps them in its workspace.
- Hosting logs: according to each provider's retention, typically a few weeks.
Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, or object to processing. Email eidur@passportstudios.is and we'll reply within one month. If the request concerns data a brand controls, we'll pass it on to that brand and help them answer.
You can also complain to the Icelandic Data Protection Authority, Persónuvernd, or the authority in your own country.
Security
Data is encrypted in transit. Each brand's data is separated by access rules in the database, so users only see brands they belong to. Supplier forms are reached through private links that only work for that one request.
Changes
If we change this policy in a way that matters, we'll tell account holders by email before the change takes effect.