1. Controller
ALTYPIST DOO Beograd
Milutina Milankovića 7 DJ, 11070 Belgrade, Republic of Serbia
Email: hello@myfirstaidkit.life
2. This website
myfirstaidkit.life is a static website. It sets no cookies, embeds no third-party content (no fonts, scripts or maps from other servers) and uses no analytics or advertising.
Server and logs. The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. To deliver pages the server necessarily processes your IP address. Access logs with requested addresses are not stored. Legal basis: Art. 6(1)(f) GDPR (secure, working operation). A data processing agreement under Art. 28 GDPR is in place with Hetzner.
Invitation links. An invitation link (myfirstaidkit.life/invite/…) opens a page that only explains how to join. The page runs no scripts, stores nothing and sends the link nowhere; requested addresses are not logged.
Email contact. If you write to us, we process your address and message to reply (Art. 6(1)(b) or (f) GDPR).
3. The My First Aid Kit app
My First Aid Kit is a private journal. You create an account and store your first aid kits, the medicines in them, packs with quantities, expiry and opening dates, the history of changes and the shopping list. This data is visible only to the members of your family you invite. Legal basis: Art. 6(1)(b) GDPR (contract). You decide what to enter; anything you enter about other people is your responsibility towards them.
4. Payments (Premium)
Premium is bought in the iPhone app through the App Store. Apple processes the payment as an independent controller under its own privacy policy; we receive only the subscription status, plan and renewal date — never your card details. Nothing is sold on myfirstaidkit.life. Legal basis: Art. 6(1)(b) GDPR.
Processors
Data processing agreements under Art. 28 GDPR are in place with all processors; for providers based in the USA, appropriate safeguards under Art. 46 GDPR (EU Standard Contractual Clauses) or the EU-U.S. Data Privacy Framework apply.
- Supabase, Inc. (USA) — database, sign-in, file storage; stored in the EU.
- Resend, Inc. (USA) — sending emails with confirmation and sign-in codes.
- Hetzner Online GmbH (Germany) — the server of this website.
We do not sell data and show no ads. The app includes no analytics or advertising SDKs.
Retention
Data is kept while your account exists. When you delete your account, your data is deleted unless the law requires us to keep it (for example, billing records).
5. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). You may also lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state where you live.