1.Controller
The operator of POFFIX is the controller. Contact us through the contact form with the topic privacy until a dedicated address is published.
Decision required: Legal name, registration number and contact address of the controller, and whether a data protection officer is required.
2.Data we process
• Account: email, name, phone (optional) and sign-in details. If you sign in with Google we receive your name and email from Google.
• Tasks: category, description, answers, photos you upload, postcode, municipality, any address, preferred time, pricing details and contact details.
• Messages and price offers: the contents of private threads, offers, approvals and agreements with timestamps.
• Providers: expression of interest, categories, service area (municipality or optional map point and radius), experience, work photos, profile photo, account details and verification status.
• Payment: amounts, status and references from the payment provider. Card details are handled by Stripe and never reach POFFIX.
• Ratings and disputes: reviews, problem reports and decisions.
• Support: messages via the contact and report forms.
3.Purposes and legal basis
• Arranging and carrying out tasks, chat and agreements – contract (Art. 6(1)(b)).
• Reviewing tasks and providers, preventing misuse and protecting accounts – legitimate interest (Art. 6(1)(f)).
• Accounting and payment records – legal obligation (Art. 6(1)(c)) once payments are live.
• Answering questions and handling incidents – legitimate interest or contract.
• Task emails (confirmations, status changes) – contract. We send no marketing.
5.Processors
• Lovable Cloud – website hosting, database, sign-in, file storage and email sending.
• Stripe – card payments (test mode today).
• Google – sign-in if you choose it, and map display on the provider page.
Decision required: Data processing agreements, storage location and any third-country transfers for each provider must be confirmed.
6.Transfers outside the EU/EEA
Some providers may process data outside the EU/EEA. Any such transfer must rely on the European Commission's standard contractual clauses or another valid basis.
Decision required: Which providers transfer data and on what basis.
7.Retention
Data is kept as long as needed for the purpose. Accounting records are kept as long as the law requires. Agreements and status history are kept unchanged as evidence of what was agreed.
Decision required: Specific retention periods for accounts, tasks, messages, applications and photos.
8.Security
Data is protected by database access rules so each user reaches only their own data. Photos are stored privately and shown through time-limited links. Guest task and approval links are secret, time-limited and stored only as hashes.
9.Your rights
You have the right to access, rectify, erase and restrict processing of your data, to object to processing based on legitimate interest, and to receive data you provided (portability).
Contact us through the contact form. We may need to confirm your identity.
10.Complaints
You may complain to the Swedish Authority for Privacy Protection (IMY), imy.se.