Privacy notice

Last updated 2026-11-14

Who we are

AED Keeper is operated by Ihab Tag, trading as Qamarita Lab (“we”), based in Egypt. We are the data controller for your account, billing and the website. For the records an organization keeps in AED Keeper, including the names of its members and of the people who check its equipment, the organization decides what goes in and we process them on its behalf. Contact: .

What we collect, and why

  • Your account: your email address, the name you give us, the organizations you belong to and your role in each. Each time you sign in we keep a session with your IP address and browser type, which ends within 30 days. Lawful basis: performing our agreement with you, and our legitimate interest in keeping accounts secure.
  • Your organization’s records: its sites, AEDs and first-aid kits, their expiry dates, every check, problem and date change, notes, and the people invited to it (names, emails, roles). We keep a log of who did what (for example who changed a date or downloaded a report), which owners and admins can see. Lawful basis: performing our agreement with the organization.
  • People who check: anyone who scans a label enters their name, and can add a photo of the equipment. With each check we store the time and a one-way code made from the network address and browser, so owners can tell when many checks come from one source; we can’t turn it back into the address. Please don’t photograph people. Lawful basis: the organization’s legitimate interest in keeping a record of its checks.
  • Billing: your plan, the price, the renewal terms you agreed to (the exact wording and when), and the subscription’s status and dates. Paddle, our merchant of record, takes the payment and tells us its status; we never see your card details. Lawful basis: performing our agreement, and the law (tax records).
  • Email: sign-in links, invitations, reminders and daily summaries, problem alerts, export links, and subscription emails go through our email provider. We record whether each email was sent, but not its contents; we don’t track opens or clicks. You can turn the daily summary off in the app. Lawful basis: performing our agreement.
  • Anonymous usage statistics: our analytics provider (hosted in the EU) counts visits, in a cookieless mode, so we can see which pages help. It combines your IP address and browser type with a value that changes daily into a one-way code, and deletes that value each day, so visits can’t be linked to you over time. We don’t send your email or name to it. Lawful basis: our legitimate interest in understanding how the site is used.
  • Error reports: our error-monitoring provider (EU) receives technical error reports without your personal details. Lawful basis: legitimate interest in keeping the site working.
  • Security: apart from sign-in sessions and the check code above, your IP address is used briefly in memory to limit spam and abuse, and we keep no request logs. Our network and security provider processes IP addresses transiently to deliver and protect the site. Lawful basis: legitimate interest in keeping the site secure.

Cookies

Visitors to the public pages get no cookies and nothing in browser storage, so there is no cookie banner. When you sign in, we set the essential cookies that keep you signed in. When an owner opens checkout, the page loads Paddle’s secure checkout, which may use the cookies it needs to take the payment safely; see Paddle’s privacy notice at paddle.com/legal/privacy.

Where your data is kept, and transfers

On a server in the EU, and with these processors: our analytics provider (usage statistics, EU), our error-monitoring provider (error reports, EU), our email provider (US) and our network and security provider (US). Paddle, the seller of our subscriptions, handles payments under its own privacy notice. We don’t sell or share your data with anyone else. The full list of our providers is at /subprocessors.

We are based in Egypt, outside the UK and the EU, and access the data from there. Our processors outside the UK and EU (our email provider, our network and security provider, and the US companies behind our analytics and error-monitoring providers) are bound by data processing agreements that use the EU Standard Contractual Clauses and the UK addendum, or the EU–US Data Privacy Framework.

How long we keep it

  • Your account and your organization’s records (sites, devices, checks, photos and reminders) are kept for as long as the account or organization exists. The log of who did what is kept for 2 years.
  • When you delete your account or your organization, we delete that data at once, and our backups of it are gone within 30 days. Export files are deleted after 24 hours.
  • Payment records are kept as long as the law requires.

Your rights

You can ask us to:

  • see the data we hold about you, and get a copy in a common format (portability);
  • correct it, or delete it;
  • restrict how we use it while a question about it is settled;
  • stop using it where we rely on our legitimate interest (usage statistics, error reports, security): you can object at any time;
  • stop emailing you, or withdraw your consent, at any time.

In the app, you can change your name and delete your account, and owners and admins can export everything their organization holds. If you checked equipment for an organization and want your name corrected or removed, ask the organization or write to us. Write to . We act within 30 days. If you’re in the UK, you can also complain to the Information Commissioner’s Office (ico.org.uk); in the EU, to your local data protection authority.

Changes

We’ll post any change to this notice here, with a new date, and email account owners about material changes.