Lostly is operated by Nordic Business Advisory ApS (trading as Lostly), a company registered in Denmark. Contact: support@lostly.eu
As a service primarily used in the European Union, we comply with the General Data Protection Regulation (GDPR). The data controller is Nordic Business Advisory ApS.
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| Name (from Sign in with Apple) | Display your name in the app and personalise your profile | Contract |
| Location (where item was lost or found) | Match found items to nearby lost reports | Contract |
| Photos of found items | Automatically classify and describe found items using AI. Thumbnail stored for matching; full photo never leaves your device until a claim is approved. | Contract |
| Item descriptions (public and private) | Match lost and found reports. Private description is used only for ownership verification and is never shown to finders. | Contract |
| Chat messages | Enable anonymous coordination between owners and finders for item return | Contract |
| Shipping address | Generate a carrier shipping label for item return. Transmitted to the carrier at label creation, then immediately deleted from our systems. Not retained beyond that point. | Contract |
| Payment information | Process the shipping fee (59 DKK platform fee + carrier cost). Handled entirely by Stripe — we never see or store your card details. | Contract |
| Device token (APNs) | Send push notifications for matches, claim updates, and shipping events | Consent |
| Trust score | Display a trust indicator based on your successful returns | Legitimate interest |
In the app we do not collect advertising identifiers, browsing history, contacts, or any data unrelated to the lost-and-found service. Visits to this website are covered separately in section 3.
This section covers visits to lostly.eu only. It is separate from the app: nothing described here is linked to an app account, and you do not need one to read these pages.
Lostly is sold to businesses, so when someone visits this site we look up which organisation their internet connection belongs to. That tells us a hotel or a transport company has taken an interest; it does not tell us who the individual is, and we make no attempt to find out.
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| IP address | Looked up against ipinfo.io to resolve the organisation and approximate location behind the connection. Stored with the entry. | Legitimate interest |
| Organisation, city, region, country | Identify which businesses are interested in Lostly, and from which markets | Legitimate interest |
| Page visited, time spent on it, and the page you arrived from | Understand which pages answer a prospective customer's questions | Legitimate interest |
Campaign parameters in the link you followed (utm_source and similar) | Tell apart visits from an email we sent, a search, and a direct visit | Legitimate interest |
| Browser user agent and screen size | Check the site renders correctly on the devices people actually use | Legitimate interest |
Our legitimate interest is understanding which organisations are interested in a product we sell to organisations. We weigh that against your privacy by collecting nothing that identifies you personally, not building a profile of you, not tracking you across other websites, and not using this data for advertising or passing it to advertisers. Visits from private or internal network addresses are discarded without a lookup.
We keep these entries for up to 24 months, then delete them. The IP address is removed sooner — after 12 months: the organisation, city and country are what we actually use, and the IP is the only part that points at a particular connection, so it does not need to stay as long as the rest.
We use no advertising, profiling or analytics cookies, and this site stores nothing on your device for the purposes described above. The identifier that links a page view to the time spent on it exists only in your browser's memory while that page is open and is gone when you leave it.
One cookie is set, and only if you ask for it: clicking the language selector stores nf_lang so the site remembers whether you want English or Danish. It holds nothing but the language code, lasts a year, and you can delete it in your browser at any time. Because it does nothing except carry out a choice you made, it needs no consent — which is also why this site shows you no cookie banner.
The IP lookup is performed by ipinfo.io (United States) and the entries are stored in Google Sheets (Google Ireland Limited). Both are listed in section 6.
You can object to this processing at any time by writing to support@lostly.eu — tell us roughly when you visited and from which organisation, and we will delete the entries and exclude your network from future lookups. You have the same rights here as in section 7. Your browser's "Do Not Track" setting and any tracker-blocking extension will also stop the lookup from happening, and we do not work around either.
When submitting a found item, the photo is sent to Anthropic (United States) for AI-powered classification and description. The photo is processed to generate a category and a factual description of the item; it is not used to train Anthropic's models and is not retained by Anthropic beyond the request.
A privacy blur is applied on your device to any people visible in the photo, before the thumbnail is stored. If your device cannot complete that check, you are told before the photo is stored and can choose to take a new one. The full-resolution photo is never uploaded to our servers.
To find possible matches, the description of an item — the text, not the photo — is sent to OpenAI Ireland Limited, which converts it into a list of numbers that represents its meaning. We store only those numbers and compare them with the numbers for other items, which is how a lost report and a found report are brought together even when the two people describe the same object in different words.
What is sent is the item description alone. Your name, email address, phone number and postal address are never part of it, and neither is the photo. OpenAI processes the text only to produce those numbers and does not use it to train its models. A copy may be kept for up to 30 days so that misuse of the service can be detected, and is then deleted. Where the text is processed outside the EEA, that transfer is covered by the European Commission's Standard Contractual Clauses.
The description you write is the one thing in this service you choose the wording of, so it is worth being plain about what that means. Write what identifies the object. Leave out anything about yourself, your health or your circumstances that you would not want a third party to process — a description can carry more than it means to. If you would rather your description were not sent at all, report the item and then write to support@lostly.eu: we can remove the stored numbers, with the consequence that the item will not be found by its description and will rely on place and time alone.
| Service | Purpose | Privacy policy |
|---|---|---|
| Supabase | Database and file storage (hosted in EU — Stockholm, Sweden) | supabase.com/privacy |
| Anthropic | AI photo classification and item description | anthropic.com/privacy |
| OpenAI | Converts an item description into a numerical representation used to match lost and found reports (section 4). The text only, never the photo or your contact details. OpenAI Ireland Limited; processing may take place outside the EEA under Standard Contractual Clauses. | openai.com/policies/privacy-policy |
| Stripe | Payment processing | stripe.com/privacy |
| Shipmondo | Carrier shipping label generation | shipmondo.com/da/privatlivspolitik/ |
| Apple (Sign in with Apple + APNs) | Authentication and push notification delivery | apple.com/legal/privacy |
| Resend | Transactional email delivery (venue staff invites, auth emails) | resend.com/privacy |
| Geoapify | Address autocomplete and postcode lookup outside Denmark. The partial address you type, never your name or any item detail. | geoapify.com/privacy |
| Adressevælger (Dataforsyningen) | Address autocomplete and postcode lookup for Danish addresses, operated by the Danish Agency for Data Supply and Infrastructure. The partial address you type, never your name or any item detail. Denmark. | dataforsyningen.dk |
| ipinfo.io | Resolves a website visitor's IP address to an organisation and approximate location (section 3). United States. | ipinfo.io/privacy-policy |
| Google (Sheets) | Stores the website visit entries described in section 3. Google Ireland Limited. | policies.google.com/privacy |
You have the right to:
To exercise any right other than account deletion, contact support@lostly.eu. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Agency (datatilsynet.dk).
All data is transmitted over HTTPS. The database is hosted in the EU (Stockholm) with row-level security enabled — each user can only access their own data. Private item descriptions are never exposed to finders or other users.
Lostly is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data, please contact us and it will be deleted promptly.
We may update this policy as the service evolves. Material changes will be communicated via a push notification or in-app notice at least 14 days before they take effect. The effective date at the top reflects the most recent update.
Nordic Business Advisory ApS (trading as Lostly)
support@lostly.eu
lostly.eu