Privacy notice

Who we are

Origo Tech AS is the controller for the account data of the people who use the portal, and the processor for the data customers enter in their passports.

Portal users

We store your email address, your name and the organisation you belong to in order to give you access. Sign-in is handled by Google Identity Platform. What you do in the portal is recorded in the organisation’s audit log, which the organisation itself owns.

Payment

Payments are processed by Stripe. Card details are entered with Stripe and never reach us; we receive confirmation that the payment has been made, together with the organisation’s name and billing address.

Consumers reading a passport

The consumer page sets no cookies. We count views per passport per day and per country, without IP addresses, without identifiers and without any timestamp more precise than the day.

The Origo app and App Clip

The app and the App Clip show product passports when you scan a QR code. They require no sign-in and do not ask for your name, email address or location. The camera is only used to read the QR code on the phone; the image is neither stored nor sent anywhere.

The passport is retrieved from Origo, in the same way as when it is opened in a browser. The pages the manufacturer has set up in the app are retrieved from Origo’s content service. It also receives anonymous events: which parts of the page are opened, and the number of stars if you give a rating. The events carry no identifier and are stored only as counts per manufacturer.

To reject fake requests, the app uses Apple’s App Attest through Firebase App Check from Google. This confirms that a request comes from a genuine Origo app, not who is using it. The app does not track you across other apps or websites.

Where the data is stored

In Google Cloud data centres in the EEA (Finland and the Netherlands). We do not ourselves transfer personal data outside the EEA.

AI clients

If your organisation connects an AI client (Claude, ChatGPT or similar) to the service, the data the client retrieves goes to the provider your organisation has chosen. That is your organisation’s choice and responsibility.

Your rights

You can request access, rectification and erasure by writing to post@origo-tech.no. Complaints can be lodged with Datatilsynet, the Norwegian Data Protection Authority.