Privacy Policy

The controller of the personal data described below is the company that operates Valo Uno (see the details below). Questions about your personal data: contact support@valouno.com.

Account details: your name, email address and whether you signed up as a customer or a provider. Your password is handled by our authentication service and stored only in protected (hashed) form. We can never read it.

Signing in with Google or Apple: if you choose to sign in with Google or Apple, we receive basic account details from the provider (such as your name and email address, or Apple’s relay address if you hide your email) to create and link your account.

Address: customers save one address so we can find providers nearby. As you type your address, the address text is sent to Google’s Places service for address suggestions, and the address is converted to map coordinates. If Google is unavailable, OpenStreetMap’s Nominatim service is used instead. Only the address text itself is sent for this purpose.

Search area: when you choose where to search for services, the choice is stored locally on your device, not on our servers. Your saved account address is used to calculate distances to nearby providers.

Provider business details: business name, description, photo, services, prices and working hours. These are shown publicly in the app, which is their purpose. When applying, the provider also gives an organisation number and contact details for our review. For sole traders the organisation number can be the same as the personal identity number; it is then treated as personal data, used only for the review and never shown publicly.

Business profiles created by Valo: for local businesses that have not registered themselves, we may create a profile from public sources such as the business's website and public registers: business name, organisation number, address, services, website, public contact details and similar business facts, together with the source each fact came from. The profile is marked "Listad av Valo" (listed by Valo) and the prices are Valo's estimate. We also keep the business's contact details so that we can notify the business about the profile, contact it about customer requests and send a personal link for taking over. For a sole trader, the business name, address and organisation number can be personal data about the owner; the organisation number is stored protected and never shown, and the business is notified about the profile when it is published. If the business asks for the profile to be removed, we then keep only a one-way encrypted (hashed) organisation number so that no new profile is created for the business.

Photos: providers can upload a profile photo, photos of the business and portraits of team members; customers can upload a profile photo. Provider photos are shown publicly on the business page. That is their purpose. Whoever uploads photos of other people is responsible for having their approval.

Bookings: the service, time, price and a copy of your address at the time of booking, so the provider knows where the job is. You can add a location detail and a note to the provider (for example a door code, parking or whether there are pets). Booking history is kept as a record even after a booking is cancelled or declined.

Reviews: after a completed booking a customer can leave a rating and comment. Reviews are shown publicly with an abbreviated name (for example “Anna A.”).

Notifications: in-app notices about your own bookings and payments. We do not send advertising.

Emails: we send service emails about your account and bookings, for example booking confirmations, payment notices, important status changes and one reminder to leave a review after a completed job. They are sent through our email provider Postmark, which processes your email address and the email content on our behalf. Emails never contain your street address, and we use no open or click tracking. Addresses that bounce or mark our emails as spam are placed on a do-not-email list so we stop sending to them.

Messages: customers can send text messages to providers in the app, and providers can reply. Messages are stored to provide the feature and may be needed as records for support, complaints, disputes, fraud prevention, safety investigations and legal claims. Only text can be sent, no images or files. On a profile run by Valo, messages are answered by Valo's staff and shown as "Valo bokningsteam"; when the business takes over the profile it can read the conversation.

Payout account (providers): for payouts, Stripe creates a connected account for your business. We store the account id and payout status. The details you give directly to Stripe (for example identity and bank details for know-your-customer checks) are processed by Stripe under Stripe’s own terms.

Security logs: to protect the service against abuse we limit how often certain features can be used. In those checks your IP address and account id are handled only in one-way encrypted (hashed) form, and the logs never contain addresses, searches or email addresses.

Support and reports: matters you send us (questions, complaints, reports) are kept as records of the handling and are deleted at the latest 24 months after the matter is closed.

Card details are collected and stored by Stripe, our payment processor. Your full card number never reaches Valo Uno. We store only a payment reference and a card summary (card brand, last four digits and expiry month/year) so you can see which card will be charged, together with payment records (amounts, currency and status).

To provide the service and perform our agreement with you: matching you with nearby providers, handling bookings, taking payment when the provider accepts the booking, and showing reviews. We keep payment and accounting records to meet a legal obligation (including the Swedish Bookkeeping Act). We also process data on the basis of legitimate interest to prevent fraud, keep the service secure and handle legal claims. We do not sell your data and we do not use it for advertising.

The table shows the legal basis for each processing activity under Article 6 of the GDPR. Where the basis is legitimate interest we have weighed our interest against your privacy and concluded that the processing is necessary and expected; you can always object to such processing.

The provider you book sees your name and the job address. Other users see only what is public: provider business pages and reviews with abbreviated names. The following service providers process data on our behalf: Supabase (database, login and file hosting), Stripe (payments and payouts), Google (login and address suggestions), Apple (login), Postmark (email delivery), OpenStreetMap Nominatim (address-to-coordinates lookup), Expo (EAS Hosting) for web hosting, and Cloudflare (protection and caching of website traffic).

If you use messaging, your counterpart sees your name (for providers, the business name) and your messages. Valo Uno may access messages for support, complaints, disputes and suspected abuse. On a profile run by Valo, Valo's staff read and answer your messages and requests until the business has taken over; the business sees them only then.

Our databases and file storage with Supabase run within the EU (the Stockholm region). Some of our providers (such as Stripe, Google, Apple, Postmark, Expo and Cloudflare) may however process data in the United States or other countries outside the EU/EEA. Where this happens, appropriate safeguards under the GDPR are used, such as the EU Commission’s standard contractual clauses.

The web app stores your login session in your browser so you stay signed in. There are no advertising or analytics trackers, so no cookie banner is needed. Our payment processor Stripe sets necessary fraud-prevention cookies when the card form loads at booking. A complete list of everything stored is on the About cookies page.

We keep your data for as long as you have an account and as long as it is needed for the service. Payment and accounting records are kept for seven years under the Swedish Bookkeeping Act. Booking and review data may be kept for as long as needed to handle disputes and legal claims. When you ask to delete your account, we delete your profile, address, photos and saved card, and the link between you as a person and the remaining records is removed. Text you wrote yourself (for example in messages or reviews) may however remain in those records. Email addresses that previously bounced or were reported as spam are kept on a do-not-email list so we never contact them again. Deletion can be requested directly in the app (Profile → Legal and privacy → Delete account) or via support@valouno.com; the details are on the Delete account page.

Messages are kept for as long as the conversation is needed for the service and as records as described above. If an account is deleted, its identity is detached from the conversation; your counterpart sees “Deleted user”, but the message text may remain as a record. The retention periods are revisited at the legal review.

Business profiles created by Valo are kept for as long as the profile is shown or has booking history. If the business asks for removal, we remove the profile within seven days and then keep only a hashed organisation number. A personal takeover link is valid for 14 days; the record of who received it and when is purged after it has been used, revoked or has expired.

Under the GDPR you can ask for access to, correction or deletion of your personal data, restriction, objection, and a copy of your data. Contact support@valouno.com. Please mark the message “GDPR”. We respond without undue delay and within one month at the latest. You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY). The service is intended for people who are at least 18 years old.