Privacy

Last updated 14 October 2026

Benchkit is run by Qloovi AS, Norway (the data controller). Contact: benchkit@qloovi.com.

The short version

Benchkit stores information about first-aid kits and items, not about people. We do not ask for names, email addresses or passwords, and we never store anything about injuries or anyone's health.

What we store

• Team: team name, sport, level, country and language, and a cryptographic hash of the private manage link.
• Kits: kit names, contents, quantities and expiry dates, plus emergency-card text you enter (venue address, nearest AED and emergency department, and "who to tell" as a role). Please don't enter personal names or phone numbers in these fields.
• Usage reports: which items were taken out of a kit, how many, and when, plus an optional short note about items. We do not record who reported, who was hurt, or why. Notes are blanked automatically after 90 days and usage history is deleted after about 13 months.
• Clubs: club name, which teams have joined, licence status and the payment reference from our payment provider.
• Notifications (optional): if a coach turns on notifications, the browser's push endpoint address, so we can send a "kit used" signal.
• Abuse protection: to rate-limit reports and sign-ups we keep a counter keyed by a salted one-way hash of the IP address (IPv6 shortened to the network prefix). The salt changes daily, so hashes can't be linked across days, and counters are deleted shortly after their one-hour window ends.

What stays on your device

Your manage link, language choice and checklist ticks are kept in your browser's local storage. The kit page keeps a copy of the kit so it works without signal.

Services we use

• Cloudflare (hosting and database, EU/US) as our processor.
• Stripe, through its Link service, sells the club licence as merchant of record (Stripe Managed Payments). Stripe handles the payment, VAT, receipts and cancellation, and collects billing details under its own privacy policy (stripe.com/privacy, link.com/privacy). We only receive the payment and subscription references and the licence status; we never see card details.
• OpenStreetMap (Nominatim and Overpass): only when a coach presses "Find AEDs nearby", their browser sends the venue address or location to these services to find nearby AEDs and emergency departments.

Legal basis and retention

We process the little data we have to provide the service you asked for (GDPR Art. 6(1)(b)) and to keep it secure (Art. 6(1)(f)). Data is kept until you delete the team (Settings → Delete team and all data), which removes it permanently. Teams that have not been used for 24 months may be deleted.

Your rights

You can see, change and delete all data yourself in the app. For anything else, email us. You can also complain to Datatilsynet (the Norwegian Data Protection Authority).