Privacy policy

1. Who is responsible

TipTap LTD is the data controller. Privacy contact: info@moppsy.se. Processing complies with the EU GDPR and applicable national law.

2. Categories of personal data

We may process, among other things:

• Account & contact: name, username, email, phone, profile photo, login identifiers; Swedish personal identity number / Personnummer is collected for RUT claims and held encrypted on Cloudflare R2 (not as plaintext on application servers after checkout).
• Bookings & RUT data: address, property designation / BRF details (encrypted on Cloudflare R2 with RUT claims), time slots, service type, price, messages, status, reviews, incident reports.
• Cleaner profile: hourly rate, city, equipment, services, languages, “Available now”, schedule, daily equipment check-in.
• Verification (KYC): identity document images (ID / passport / driving licence / selfie) on private Cloudflare R2, plus payout status via Stripe Connect.
• Location: approximate or precise position when cleaners enable availability or when you allow location in the app.
• Technical data: IP, device, logs, cookies.
• Payment metadata: transaction IDs and amounts via Stripe — we do not store full card numbers, expiry, or CVC on Moppsy servers.

3. Live map

Customers see cleaners on the live map. Available now means the cleaner has turned availability on, appears on the map, and has no job in progress right now. During an active job they may still appear on the map but are not shown as available for new bookings. Between 00:00 and 06:00 (market local time), cleaners are not shown on the public live map even if availability is on; live tracking for a confirmed booking is unaffected.

4. Profile photo on map pins

Map pins show the Moppsy logo by default. When a cleaner’s average rating is at least 4.5 and they have an uploaded or Google-linked profile photo, that photo is shown on the map pin instead of the logo.

5. Retention of location

We do not normally keep a full location history longer than needed for the service, security, disputes, or law.

6. Purposes and legal bases

• Provide the platform (contract — GDPR Art. 6(1)(b)).
• Payments and payouts (contract / legal obligation).
• Accounting and tax (legal obligation).
• Fraud prevention and security (legitimate interests).
• Consent where required, e.g. precise location or marketing cookies.

7. Processors

We use processors under data processing agreements, including:

• Stripe — payments, Connect, payouts, and off-session supplementary charges
• Cool Company Skandinavien AB — umbrella employment and payroll reporting for cleaners in Sweden
• Skatteverket — Swedish Tax Agency for RUT tax deduction claims
• Brevo — transactional email
• Cloudflare (incl. R2) — files, CDN, security
• Mapbox — maps and geocoding
• Google / Apple — optional sign-in
• KYC providers — identity checks where required

7b. Identity documents, RUT data & payment details

Identity documents: Images of national ID cards, passports, driving licences, and related selfies uploaded for cleaner verification are stored on a private Cloudflare R2 bucket (a third-party cloud storage service). They are not served via public URLs. Access is restricted to Moppsy administrators through authenticated admin tools for verification and fraud prevention.

RUT (Sweden): When you claim RUT-avdrag on moppsy.se, your personnummer, fastighetsbeteckning / BRF organisation number, and related housing identifiers are encrypted and stored on Cloudflare R2. Our application database keeps only non-reversible hashes, last-four digits for support, and housing type — not the full personnummer. Only administrators can decrypt and export claim data for Skatteverket filings.

Payments: Card numbers, expiry dates, and CVC are processed and stored by Stripe, not on Moppsy application servers. We store payment metadata such as PaymentIntent IDs and amounts so we can confirm bookings and handle disputes. Account details needed to run the marketplace (name, email, booking addresses, messages) remain on our systems under this policy.

8. Retention and transfers

Data is kept while your account is active and as required for disputes, insurance, and law. Accounting records may be kept up to seven (7) years. Some processing uses providers outside the EU/EEA with appropriate safeguards (e.g. standard contractual clauses). Account deletion triggers prompt anonymisation where possible.

9. Your rights

Access, correction, deletion, restriction, portability, objection, and complaint to your supervisory authority (e.g. IMY in Sweden). Request deletion via Delete data or info@moppsy.se.

10. Cookies

Necessary cookies for login and security. Analytics or marketing only with consent where required.

11. Incidents and job documentation

Photos, checklists, and timelines submitted for disputes may be processed and stored (e.g. Cloudflare R2) until the case is closed, to fulfil contracts and ensure quality.

12. Updates

We may update this policy. The latest version is always published here. Material changes may be announced in the service or by email.