Privacy Policy

This Privacy Policy explains how Svaggy collects, uses, and protects your personal data when you use our food and grocery delivery service. We are committed to processing your data lawfully and transparently in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection law.

1. Who is the data controller?

The data controller is the Svaggy entity operating in your country (details at svaggy.fi/legal). For Finland: Svaggy Finland Oy. You can contact our Data Protection Officer (DPO) at privacy@svaggy.fi.

2. What data we collect

When you use Svaggy, we collect:

• Account data: name, email address, phone number, preferred language.
• Order data: items ordered, Merchant details, delivery address, timestamps, order value.
• Payment data: last four digits of your card and payment method type (full card numbers are held only by Stripe).
• Location data: delivery address you enter; precise GPS location only when you grant permission in-app.
• Device and usage data: device type, OS version, IP address, in-app events and session data (via PostHog, EU-hosted).
• Communications: messages exchanged with support or couriers.

3. Why we process your data (legal basis)

| Purpose | Legal basis | |---|---| | Fulfilling your orders | Contract performance (Art. 6(1)(b) GDPR) | | Payment processing | Contract performance | | Sending order updates | Contract performance | | Fraud prevention and safety | Legitimate interests (Art. 6(1)(f)) | | Marketing emails (opt-in) | Consent (Art. 6(1)(a)) | | Legal compliance (tax, accounting) | Legal obligation (Art. 6(1)(c)) | | Analytics to improve the service | Legitimate interests |

4. Who we share your data with

We share your data only as necessary:

• Merchants: name, delivery address and order details to prepare and hand over your order.
• Couriers: name, delivery address, and contact number so they can deliver your order.
• Stripe: payment data for processing.
• Firebase FCM: device token for push notifications.
• Resend: email address for transactional emails.
• PostHog (EU-hosted): usage data for product analytics.
• Hostinger / Coolify (EU region): application infrastructure.

We do not sell your personal data.

5. International transfers

Where sub-processors operate outside the EEA (e.g. Stripe, Firebase), transfers are protected by Standard Contractual Clauses (SCCs) or adequacy decisions. A full list of sub-processors is available at svaggy.fi/legal/sub-processors.

6. How long we keep your data

• Account data: for the duration of your account, plus 3 years after deletion (for dispute resolution).
• Order data: 7 years (Finnish accounting law).
• Usage/analytics data: 26 months on PostHog.
• Marketing consent records: until you withdraw consent, plus 1 year.

7. Your rights under GDPR

You have the right to:

• Access a copy of your personal data.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten") — subject to legal retention obligations.
• Portability — receive your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent for marketing at any time.
• Lodge a complaint with your national supervisory authority (Finland: Tietosuojavaltuutettu; Czech Republic: Úřad pro ochranu osobních údajů).

To exercise your rights, go to Profile → Privacy & data in the app, or email privacy@svaggy.fi.

8. Cookies and analytics

The Svaggy mobile app uses PostHog (EU-hosted) for analytics. You can opt out of analytics at any time under Profile → Privacy settings. Our website uses essential cookies and, with your consent, analytics cookies — see our Cookie Policy at svaggy.fi/cookies.

9. Changes to this Policy

We will notify you via the app or email at least 30 days before any material change. The "last updated" date at the top of this page always reflects the current version.

10. Contact

Data Protection Officer: privacy@svaggy.fi Postal address: see svaggy.fi/legal.

[DRAFT-LEGAL-REVIEW] — pending legal counsel approval before Finland launch.