Last updated: 7 September 2026
This Privacy Policy explains how Scandinavia Tech L.L.C
(“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use the
NovaTagg mobile application for Android and iOS (package name
com.scandinaviatech.novatagg) and the related services at
novatagg.com (together, the “Service”).
If you do not agree with this policy, please do not use the NovaTagg app.
1. Who we are
Data controller: Scandinavia Tech L.L.C
Registered address: The Metropolis Tower – Office 1814 – Business Bay – Dubai – United Arab Emirates
Contact e-mail for privacy matters:
privacy@novatagg.com
2. Data we collect
2.1 Information you give us when you create an account
- Name
- E-mail address
- Password (transmitted over an encrypted connection and stored only in hashed form)
- Phone number
- Postal address
- Profile picture / avatar, if you choose to upload one
2.2 Information from third-party sign-in
If you choose to register or sign in using Google Sign-In or Sign in with Apple, we receive from that provider your name, e-mail address and a unique account identifier, which we use to create and authenticate your NovaTagg account. We do not receive your password from these providers. If you use Apple’s “Hide My Email” feature, we receive only the relay address Apple generates.
2.3 Camera and photos
- Profile picture: if you upload an avatar, the image you select is sent to our servers and stored with your account.
- QR code scanning: the app uses your device camera to scan QR codes. The camera feed is processed on your device only. We do not record, transmit or store video or images from the QR scanner.
Camera and photo library access is requested only at the point you use these features, and you can decline or revoke it in your device settings.
2.4 NFC tag data
NovaTagg reads from and writes to NFC tags you physically present to your device. This includes the identifier and content of the tag. NFC interaction only occurs while you are actively using a read or write screen in the app.
2.5 Technical and log data
When the app communicates with our servers we automatically process your IP address, the date and time of the request, and basic device and app version information, in ordinary server logs. This is necessary to operate the Service securely and to detect abuse.
2.6 Data stored on your device
Authentication tokens are stored in your device’s encrypted secure storage (Android Keystore / iOS Keychain). App preferences, such as your chosen language, are stored locally. This data stays on your device and is removed when you log out or uninstall the app.
3. What we do not collect
To be explicit, the NovaTagg app does not:
- collect your location — the app requests no location permission;
- access your contacts, SMS, call logs, calendar, microphone or files;
- contain advertising, ad identifiers or advertising SDKs;
- contain third-party analytics, tracking or crash-reporting SDKs;
- collect health, biometric, financial or payment data;
- sell or rent your personal data to anyone, ever.
4. How we use your data
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your account | Name, e-mail, password, sign-in identifiers | Performance of a contract (Art. 6(1)(b)) |
| Authenticating you and keeping you signed in | E-mail, tokens | Performance of a contract (Art. 6(1)(b)) |
| Verifying your e-mail and enabling password reset | E-mail, phone number | Performance of a contract (Art. 6(1)(b)) |
| Showing and letting you edit your profile | Name, phone, address, avatar | Performance of a contract (Art. 6(1)(b)) |
| Providing NFC tag read/write features | NFC tag content | Performance of a contract (Art. 6(1)(b)) |
| Keeping the Service secure and preventing abuse | IP address, log data | Legitimate interests (Art. 6(1)(f)) |
| Meeting legal and accounting obligations | Account records | Legal obligation (Art. 6(1)(c)) |
5. Who we share your data with
We share personal data only with the following categories of recipient:
- Google LLC — if you use Google Sign-In, to authenticate you. See the Google Privacy Policy.
- Apple Inc. — if you use Sign in with Apple, to authenticate you. See the Apple Privacy Policy.
- Our hosting provider, AWS (Amazon Web Services), which stores the data on our behalf under a data processing agreement.
- Competent authorities, where we are legally required to disclose data.
We do not share your personal data with advertisers or data brokers.
6. International transfers
Your data is stored on servers located in United Arab Emirates / Middle East. Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision as the transfer safeguard.
7. How long we keep your data
- Account data is retained for as long as your account is active.
- After you request deletion, your account and associated personal data are permanently deleted within 30 days.
- Server logs are retained for 7 days and then deleted.
- Records we must keep for legal or accounting reasons are retained for the period required by law, and then deleted.
8. Deleting your account and your data
You can request deletion of your NovaTagg account and all personal data associated with it by sending a request from your registered e-mail address to privacy@novatagg.com with the subject “Account deletion request”, or by using the deletion request form at novatagg.com/delete-account.
We will confirm the request and complete the deletion within 30 days. Deletion removes your name, e-mail address, password, phone number, postal address and profile picture from our systems. Data we are legally obliged to retain is kept for the period required by law and is not used for any other purpose.
9. Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing of your data;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with your data protection supervisory authority.
To exercise any of these rights, contact privacy@novatagg.com. We respond within one month.
10. Security
All traffic between the app and our servers is encrypted using HTTPS/TLS. Passwords are stored only in hashed form. Authentication tokens are held in your device’s encrypted secure storage. Access to personal data within our organisation is limited to staff who need it to operate the Service.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, you directly.
11. Children
NovaTagg is not directed to children and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change, and material changes will be communicated in the app or by e-mail before they take effect.
13. Contact us
Scandinavia Tech L.L.C
The Metropolis Tower – Office 1814 – Business Bay – Dubai – United Arab Emirates
privacy@novatagg.com