Privacy policy
Last updated 28 October 2026
The short version
- We collect only what a booking needs: your email, first names, car details, your home area (not your address) and your bookings.
- Your card is handled by Stripe. We never see the full number.
- A shop sees only what it needs for your visit.
- No ads, no selling data, no tracking cookies.
- You can see, correct, export or delete your data in the app, under Household ("Download my data" and "Delete my account"), or by writing to [contact email].
1. Who is responsible
The controller of your personal data is [Company name] OÜ, registry code [registry code], [registered address], Tartu, Estonia. Contact us about anything in this policy at [contact email].
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | Signing in with a code, booking confirmations, reminders | Contract, Art. 6(1)(b) |
| First names of you and your household, car make and plate | So the shop knows who and what to expect, and to book back-to-back slots | Contract, Art. 6(1)(b) |
| Home area (a district, not an address) | To find shops within reach | Contract, Art. 6(1)(b) |
| Errands, offers you skipped, bookings, cancellations, no-shows | To match offers, run bookings and apply the cancel and no-show rules | Contract, Art. 6(1)(b); legitimate interest in fair use, Art. 6(1)(f) |
| Payment records (amount, date, and only the card brand and last four digits) | To charge for visits and fees, and for accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Ratings you give | To show other customers how shops do | Legitimate interest, Art. 6(1)(f) |
| Shops: business details, staff names and emails, services, prices, bank details via Stripe | To list the shop, let staff sign in and pay out | Contract, Art. 6(1)(b) |
We don't use your data for advertising and we don't sell it. We only send you marketing emails if you have said yes to them, and you can say no at any time.
If you add children to your household, add only their first names. You are responsible for adding them, and you can remove them at any time.
3. Who sees your data
- The shop you book with sees the first names, car details and service for that visit. It doesn't see your email, other errands or your card.
- Other shops see only anonymous counts, such as "14 people nearby want a hand wash this week".
- Service providers that run parts of Vahel for us, under data processing agreements:
- Supabase (database and sign-in), data stored in the EU (Stockholm, Sweden)
- Vercel (website hosting; its servers keep short-lived logs that include IP addresses)
- Resend (sending sign-in codes, booking confirmations and reminders)
- Stripe processes card payments and shop payouts, and receives your email address with your card. For payments Stripe is also a controller in its own right; see stripe.com/privacy.
- OpenStreetMap (OpenStreetMap Foundation, UK): when a shop presses "Find on the map", the typed shop address and the browser's IP address go to its Nominatim service to find the location. Customers never use it.
- Authorities, only when the law requires it.
Some of these providers are based in the United States. Where data leaves the EU, it goes to a country the European Commission recognises as protecting it adequately (such as the UK), or is protected by the EU–US Data Privacy Framework or the Commission's standard contractual clauses.
4. How long we keep it
- Account and household data: while you have an account. When you delete it, we remove it within 30 days.
- Bookings and payment records: 7 years, as Estonian accounting law requires. After your account is deleted, these are kept without your household details.
- No-shows count toward the pause rule for 6 months. After that they remain only as part of the booking record.
- Sign-in codes: until used, or 10 minutes at most.
5. Cookies and storage
We use only what's needed to keep you signed in, stored in your browser or phone. We set no cookies of our own and use no analytics, advertising or tracking, so we don't ask you to accept any.
When you save a card or a shop connects its bank account, that happens on Stripe's own pages, which set Stripe's cookies for security and fraud prevention.
6. Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy you can take elsewhere;
- correct anything that's wrong;
- delete your data, except what we must keep by law;
- stop or limit a use of your data that's based on legitimate interest.
You can do this yourself in the app, under Household. Or write to [contact email] from the email you signed up with. We answer within one month. If you're not happy with how we handle your data, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
7. Security
Data is encrypted in transit and at rest. Each person can only reach their own data, and each shop only its own bookings. Access on our side is limited to the people who need it to run Vahel.
8. Changes
If we change this policy in a way that matters to you, we tell you by email before it applies.