Політика конфіденційності

1. Who is responsible

TipTap LTD is the data controller for personal data processed to operate the Moppsy marketplace (accounts, matching, bookings, payments metadata, support). Privacy contact: info@moppsy.se. Processing complies with the EU GDPR and applicable national law. TipTap LTD processes this data as the marketplace operator, not as the company that performs the cleaning; the cleaning service itself is between customer and cleaner.

2. Categories of personal data

We may process, among other things:

• Account & contact: name, username, email, phone, profile photo, login identifiers; Swedish personal identity number / Personnummer is collected for RUT claims and held encrypted on Cloudflare R2 (not as plaintext on application servers after checkout).
• Bookings & RUT data: address, property designation / BRF details (encrypted on Cloudflare R2 with RUT claims), time slots, service type, price, messages, status, reviews, incident reports.
• Cleaner profile: hourly rate, city, equipment, services, languages, “Available now”, schedule, daily equipment check-in.
• Verification (KYC): identity document images (ID / passport / driving licence / selfie), stored only on private Cloudflare R2 and never on Moppsy servers, plus payout / Stripe Connect status where used.
• Location: approximate or precise position when cleaners enable availability or when you allow location in the app.
• Technical data: IP, device, logs, cookies.
• Payment details: card and wallet details are collected and stored by Stripe, not by Moppsy, so Stripe can charge bookings (including platform fees on cash checkout), place holds, refund, and pay cleaners via Stripe Connect when card payouts apply. We keep only transaction IDs, amounts, status, and (where offered) whether a booking used cash or card at checkout. TipTap LTD does not process or store the cash cleaning amount paid hand-to-hand.

3. Live map

Customers see cleaners on the live map. Available now means the cleaner has turned availability on, appears on the map, and has no job in progress right now. During an active job they may still appear on the map but are not shown as available for new bookings. Between 00:00 and 06:00 (market local time), cleaners are not shown on the public live map even if availability is on; live tracking for a confirmed booking is unaffected.

4. Profile photo on map pins

When a cleaner has an uploaded profile photo, a Google-linked photo, or a selfie they provide for their public profile, that photo may be shown on the map pin so customers can recognise them. Without such a photo, the Moppsy logo is shown. Images of identity documents uploaded only for verification are stored privately and are not shown on the public map.

5. Retention of location

We do not normally keep a full location history longer than needed for the service, security, disputes, or law.

6. Purposes and legal bases

• Provide the platform (contract — GDPR Art. 6(1)(b)).
• Payments and payouts (contract / legal obligation).
• Accounting and tax (legal obligation).
• Fraud prevention and security (legitimate interests).
• Consent where required, e.g. precise location or marketing cookies.

7. Processors

We use processors under data processing agreements, including:

• Stripe — payments, Connect, payouts, and off-session supplementary charges
• Cool Company Skandinavien AB — umbrella employment and payroll reporting for cleaners in Sweden
• Skatteverket — Swedish Tax Agency for RUT tax deduction claims
• Brevo — transactional email
• Cloudflare (incl. R2) — files, CDN, security
• Mapbox — maps and geocoding
• Google / Apple — optional sign-in
• KYC providers — identity checks where required

7b. Identity documents, RUT data & payment details

Identity documents (Cloudflare): Images of national ID cards, passports, driving licences, and related selfies that cleaners upload for verification are stored only in a private Cloudflare R2 bucket (Cloudflare’s storage service). They are never stored on Moppsy’s own servers or on local disks. We use Cloudflare so those images stay off our application servers, are not available at a public web address, and can be opened only by Moppsy administrators through signed-in admin tools, for identity verification and fraud prevention.

RUT (Sweden): When you claim RUT-avdrag on moppsy.se, your personnummer, fastighetsbeteckning / BRF organisation number, and related housing identifiers are encrypted and stored on Cloudflare R2. Our application database keeps only non-reversible hashes, last-four digits for support, and housing type — not the full personnummer. Only administrators can decrypt and export claim data for Skatteverket filings.

Payments (Stripe): When you pay for a booking, your card number, expiry date, CVC, and wallet details (such as Apple Pay or Google Pay) are entered in Stripe’s payment form and sent directly to Stripe. Stripe collects and stores those payment details so it can authorise and charge the booking (full amount or platform fee only on cash checkout), place a card hold, process refunds and disputes, keep a payment method for agreed later charges, and pay cleaners through Stripe Connect when card payouts apply. Moppsy does not receive or store full card numbers, expiry dates, or CVC on its own servers or locally. We only keep payment metadata, such as PaymentIntent IDs, amounts, status, and checkout payment mode (card vs cash where offered), so we can confirm bookings and handle disputes. Account details needed to run the marketplace (name, email, booking addresses, messages) remain on our systems under this policy.

8. Retention and transfers

Data is kept while your account is active and as required for disputes, insurance, and law. Accounting records may be kept up to seven (7) years. Some processing uses providers outside the EU/EEA with appropriate safeguards (e.g. standard contractual clauses). Account deletion triggers prompt anonymisation where possible.

9. Your rights

Access, correction, deletion, restriction, portability, objection, and complaint to your supervisory authority (e.g. IMY in Sweden). Request deletion via Delete data or info@moppsy.se.

10. Cookies

Necessary cookies for login and security. Analytics or marketing only with consent where required.

11. Incidents and job documentation

Photos, checklists, and timelines submitted for disputes may be processed and stored (e.g. Cloudflare R2) until the case is closed, to fulfil contracts and ensure quality.

12. Updates

We may update this policy. The latest version is always published here. Material changes may be announced in the service or by email.