Privacy policy

1. Who we are

Sawaahla is run by [Company name AB] (organisation number [556000-0000]), [Street, postcode, city, Sweden]. We are responsible (the controller) for the personal data of the people who hold an account with us.

Questions about your data and requests to use your rights go to privacy@example.com.

2. Hosts and guests

When you create an invitation and add guests, you decide whose data is handled and why: you are the controller of your guests' data, and we process it on your behalf and only to run your invitation (see the terms of use).

If you are a guest, the host who invited you is your first point of contact. You can also write to us and we will pass your request on.

3. What we collect

Account: your name, email address, password (stored only as a one-way hash), language, when you accepted these terms, and the support messages you send us.

Invitations: the texts, dates, places, design and images you add.

Guests: what the host enters (name, phone number, email address, how many people are invited, a private note) and what guests send (their answer, the number of people, answers to the host's questions), when an invitation was sent and opened, and check-ins at the door.

Payments go through our payment provider (currently Stripe). We receive the amount, the status, any coupon and when you confirmed that the invitation should be published at once — never card details. Your email address is passed to the provider for its receipt, and we email you an order confirmation.

Technical data: IP addresses, used for security and to limit abuse, in short-lived server logs.

Reports: when someone reports an invitation, what they write and, if they give it, their email address.

4. Why, and on what legal basis

To provide the service you signed up for (performance of a contract); to keep payment records and to handle reports about content (legal obligations, including the EU Digital Services Act); and to keep the service secure, prevent abuse and never email an address that opted out (legitimate interest).

We do not sell data, show ads, build profiles or use third-party analytics or tracking.

5. Who receives data

Our suppliers, only as far as each one needs: Stripe (payments), our email provider (sending email) and our hosting provider (servers and storage). Each is bound by a data processing agreement.

A guest who adds an entry pass to Apple Wallet or Google Wallet shares that pass with Apple or Google. Messages sent through WhatsApp are sent from the host's own WhatsApp.

Data leaves the EU/EEA only with the safeguards the GDPR requires, such as the EU standard contractual clauses or an adequacy decision.

6. How long we keep it

Your account and invitations: until you delete them.

Guest lists, answers and door check-ins: deleted automatically 90 days after the invitation's last date — or earlier, when the host removes the guest or the invitation.

Payment records: seven years, as the Swedish Accounting Act requires, without other personal data. An address that opted out of our emails is kept as a keyed hash so that it is never emailed again. Server logs: a short time.

When an admin acts on an account (for example changes its role), a record of it is kept for security; when the account is deleted, the record no longer names it.

Reports and our decisions on them: kept as a record of how each report was handled. A reporter's email address is used only to confirm the report and tell them the decision.

7. Cookies and local storage

Two strictly necessary cookies: one keeps you signed in, the other remembers the language you chose. Your browser's local storage remembers your theme, a guest's personal link on that device, an invitation message a host wrote for their guests, and the door scanner's gate name. We use no tracking cookies.

8. Your rights

You may ask for access to your data, a copy of it, correction, erasure or restriction, and object to processing based on legitimate interest. On the account page you can download your data and delete your account yourself.

You may also complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the authority where you live.

9. Security

Connections are encrypted, passwords and one-time links are stored only as hashes, and access to data is limited to what each part of the service needs.

10. Children

Account holders must be at least 18 years old.

11. Changes

When this policy changes materially we tell account holders by email. The date at the top shows the current version.