We protect your data in accordance with the GDPR and the guidelines of the Swedish Data Protection Authority. Servers in Frankfurt, EU. No data is shared with third parties beyond what is stated here.
RotRutCoach AB (org. no. 559123-4567), Stockholm, Sweden is the data controller for the processing of your personal data when you use our app ROT/RUT Coach and the associated website rotrutcoach.se.
Questions about this policy: privacy@rotrutcoach.se.
We only collect the data required for the app to work:
| Category | What | Source |
|---|---|---|
| Identifiers | Email address, Apple ID / Google ID (hashed) | Apple Sign-in / Google Sign-in |
| Profile | Display name, language, theme, consents | You (voluntary) |
| Transactions | Invoice amount, materials, labor cost, invoice date (encrypted) | You, via manual entry |
| Vendor data | Org. number, company name, F-tax status | You + Skatteverket's public API |
| Usage | Anonymous usage statistics (screen views, taps) | PostHog (EU) |
| Technical | IP address (briefly), device type, app version, crash logs | Sentry (EU), Supabase |
| Payments | Stripe customer ID, RevenueCat user ID — no card details | Stripe / RevenueCat |
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the app's features (transaction tracking, F-tax checks) | Performance of a contract (Art. 6.1.b) |
| Account administration, support, billing | Performance of a contract (Art. 6.1.b) |
| Analytics and service improvement | Legitimate interest (Art. 6.1.f) |
| Marketing (newsletter) | Consent (Art. 6.1.a) — opt-in, can be withdrawn |
| Security and fraud prevention | Legitimate interest (Art. 6.1.f) |
| Legal obligations (tax and accounting law) | Legal obligation (Art. 6.1.c) |
We share the minimum possible amount of data with the following trusted parties, all under data processing agreements (DPA):
| Provider | Service | Location | What is shared |
|---|---|---|---|
| Supabase Inc. | Database + authentication | EU (Frankfurt) | All user data, encrypted |
| Vercel Inc. | Web hosting | EU edge nodes | Static pages, no user data |
| Stripe Payments Europe | Payments (web) | EU (Ireland) | Email, payment amount |
| RevenueCat Inc. | App subscriptions (iOS/Android) | USA (SCC + DPA) | Apple ID hash, subscription status |
| Resend Inc. | Transactional email | EU | Email address + message content |
| PostHog Ltd. | Anonymous product analytics | EU | Pseudonymized events, no PII |
| Sentry GmbH | Error monitoring | EU | Crash logs, scrubbed of PII |
| Skatteverket | F-tax verification | Sweden | Vendor org. number only, never your data |
| Apple / Google | Sign-in | USA (SCC + DPA) | Standard Sign-in data |
eu-central-1)| Data | Retention |
|---|---|
| Account information and transactions | As long as the account is active + 5 years (Swedish Accounting Act 1999:1078) |
| Deleted account (soft delete) | 30 days — can be restored |
| Deleted account (permanent) | Erased. Only minimal metadata kept for accounting/tax purposes for 5 years |
| Support tickets | 12 months after the case is closed |
| Marketing consents | Until withdrawn |
| Anonymous usage statistics | 14 months |
| Security logs | 12 months |
As a data subject you have the following rights under the GDPR:
Send requests to privacy@rotrutcoach.se. We respond within 30 days.
The website uses a minimal number of cookies:
We use no third-party advertising or tracking cookies.
The service is not intended for persons under 16 (the minimum age under the Swedish implementation of the GDPR, and the ROT/RUT deduction requires being 18). We do not knowingly collect data from children under 16. If we discover such data, it is deleted immediately.
For material changes (e.g. a new third party or changed retention) we give at least 30 days' notice via email and in-app notification. Minor adjustments (clarifications) are published with a new revision date.
Data controller: RotRutCoach AB · Org. no. 559123-4567
Email: privacy@rotrutcoach.se
Data protection officer: Not mandatory (below threshold) — questions to the same email.
Supervisory authority: Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy.se