Language: EN
Join the waitlistMenu

Privacy policy

Last updated: 

1. Who we are

SIA "Kvedo" (registration number 40203788443, registered address Bāriņu iela 4/6-36, Liepāja, LV-3401) is responsible for the data processed on the website kvedo.com, in the web app app.kvedo.com and in the Kvedo mobile app.

Privacy contacts: info@kvedo.com, +371 27 30 60 77 (Erlens), +371 20 51 05 02 (Rūdolfs).

We have not appointed a data protection officer, as the law does not require one. We answer all questions about data ourselves.

2. When we are the controller and when the processor

We are the controller for data we collect for our own purposes: website visits, the waitlist, the contact form and chat, accounts, subscriptions, support and our communication with you.

For data a company enters into Kvedo in its work (customers, jobs, work time, materials, invoices, photos, employee location), the controller is the company itself. We process it as a processor on the company's behalf, in accordance with the data processing annex to the terms of use. If you are an employee or a customer of a company and have a question about this data, contact the company first. We will help the company respond.

In this policy we describe both, so that everything that happens with the data is visible.

3. The website kvedo.com

Visits. The website does not use cookies, analytics or advertising tracking. The website is hosted by Vercel, whose server logs briefly receive the visitor's IP address, as happens on any web server. The fonts are our own, not from Google. Basis: our legitimate interests in displaying the website and protecting it (Article 6(1)(f) GDPR).

Waitlist. We store the e-mail address you enter, the date and time of signing up, the page language, a note of which page the signup came from, and a hash of the network address (IP), not the address itself, to stop mass signups. Purpose: to notify you when the app is available and to give you 50% off the first month if you create an account with the same e-mail address. We do nothing else with the address. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time by writing to info@kvedo.com.

Contact form. We store your name, e-mail address, phone number if you provide it, your question, the time of sending, the page language, a note of whether the message was sent from the website or from an account, and a hash of the IP address. A notification of a new message is sent to us by e-mail. Purpose: to answer your question. Basis: our legitimate interests in answering a message you sent yourself (point (f)).

Chat on the website. If you ask a question in the chat, it reaches our server and the AI service provider Anthropic, which prepares the answer. We store the question, the answer, the page language and a random conversation number, to see which questions lack answers. We do not store your IP address; for rate limiting we store only its hash. Do not write passwords, card details or personal identity numbers in the chat. Answers are prepared by a bot, not a human. Basis: our legitimate interests in answering questions about Kvedo (point (f)).

Video tutorials. The videos on the Help page are on YouTube. Until you press play, nothing is loaded from YouTube. There is a notice about this next to the video. When you press it, the video loads from youtube-nocookie.com, and Google, as an independent controller, receives your IP address and may store data in your browser in accordance with its own privacy policy. Basis: your consent, which you give by pressing play (Article 6(1)(a)).

Status page. The Status link opens a separate page, status.kvedo.com, which shows whether Kvedo is working.

4. Account and subscription

Account data. Company name, your name, username, e-mail address, phone number if you provide it, role in the company, language and settings. We store the password only as a hash, so we cannot read it ourselves. If you turn on two-step sign-in, we store its secret key encrypted and the recovery codes as hashes. We also store sign-in keys as hashes, the device name in the list of active sessions and the latest app version you signed in with.

Company data. The details and settings you enter: e-mail, phone, address, registration and VAT number, bank account for invoices, logo, invoice and quote numbering, country, time zone, currency. If you search for a company by name or number, we fill in the details from the Register of Enterprises open data (data.gov.lv).

Users added by a company. If your employer added you to Kvedo, we received your name, username, e-mail, phone and role from them. We also store a record of who added you and when.

Security. For every attempt to create an account, sign in, sign out, change a password or use two-step sign-in, we store the IP address and a note of which account it relates to, to limit password guessing. We store the password reset code together with the IP address of the person requesting it.

Acceptance of terms. When you agree to the terms of use and confirm that you have read this policy, we store the version, time, platform and a hash of the IP address, so that we can prove it.

Subscription and payments. We store the plan, subscription status, Stripe customer number and our invoices to you. Payments are processed by Stripe. When you choose a plan, Stripe receives the company name, address, VAT number and e-mail. You enter card details on the Stripe page; we do not see or store them. If you cancel the subscription, we may ask you to fill in a short survey about the reason; it is not mandatory.

Referral programme. If you recommended Kvedo to another company, we store who recommended it, which company and what discount it gave.

Messages during the trial. During the trial we may send the company administrator a few e-mails and notifications with tips on how to get started. Each e-mail contains a link to unsubscribe from them, and they can be turned off in the app: Profile, Notifications, Tips. They stop after subscribing.

Support. If you e-mail us, call us or send a message in the app, we store the correspondence in order to respond.

Error monitoring. When an error occurs in the app or on the server, Sentry receives technical information: the device, app version, error location and the internal user and company number. We do not send names, e-mails, IP addresses, passwords or entered content.

Our administrators. Our staff access company data only when it is needed for support or security. We record every such action in a log with the reason.

Basis. For the operation of the account, subscription and app: the contract with you or your company (Article 6(1)(b)). For employee accounts created by a company: our and the company's legitimate interests, so that the employee can use the service the company has bought (point (f)). For security, fixing errors, support, the survey and tips during the trial: our legitimate interests (point (f)). For our invoices: legal obligation, accounting regulations (point (c)). Account data are needed to conclude the contract: without an e-mail or username and password the account cannot work.

5. Data a company enters in the app

We process this data as a processor on the company's behalf (see section 2). The app may contain:

  • customers: name or company name, address, e-mail, phone, registration and VAT number;
  • jobs, projects and equipment: descriptions, addresses, deadlines, checklists, comments, assigned employees and job history;
  • work time: start, end, breaks and trips;
  • materials, stock, purchases and expenses;
  • quotes, invoices, credit notes, acceptance certificates and contract terms, with the details of both parties;
  • signatures: the user's signature for documents and the customer's signature on a certificate, which the customer draws on the phone;
  • photos and videos: photos of the site and videos up to 2 minutes; if it is saved in the photo file, we store the time and place (coordinates) where the photo was taken, and we store the file itself without this metadata;
  • documents and drawings: receipts, delivery notes, invoices, PDF and drawing files that are uploaded;
  • voice: if you use voice input or voice commands, we send the recording for conversion to text and delete it immediately; if you record a voice comment, the recording is stored with the comment so that it can be listened to;
  • imported files: spreadsheets with customers or materials that are uploaded;
  • notifications: the push notification token for the phone and the notification text (for example, the job name and customer).

What the company's customer sees. When a company sends a quote or invoice, the customer receives an e-mail with a link to a page. If the customer approves or rejects the quote, we store their name, comment, time, browser name and a hash of the IP address, so that it is visible who did it and when. If the company turns on payment reminders, we send them to the customer e-mail given on the invoice, on the company's behalf.

Navigation. If you tap in the app to drive to an address, the address is opened in your navigation app (for example, Waze or Google Maps), which processes it in accordance with its own terms.

Each company's data are kept separate from other companies' data. Within a company, each user sees only what their role allows.

6. Location

We use location only in these cases:

  • Trips and addresses. When you start a trip or set your base from your location, we save the trip's starting point or the base point. For address suggestions and trip distance and time, our server sends Google the address or coordinates, without names or invoice data.
  • Team map. If the company turns on this feature, the app, while the employee's work time has started and the app is open, sends the phone's latest location (coordinates, accuracy, approximate address, and when driving also direction and speed). Company administrators and dispatchers see it. We store only the latest point and delete it when work ends, no later than after 24 hours. The address is determined from the coordinates by the phone's operating system (Google on Android phones, Apple on iPhones).
  • Work action history. If the Team map feature is turned on in the company, at the moments of work actions (setting off, arriving, starting, pausing, resuming, finishing a job, adding a photo, signature or invoice) we save the location, accuracy, address and distance to the job address, so that the company can check whether the work was done on site. If an action takes place away from the job site, managers may receive a notification. We do not create a continuous route. We keep it for 12 months.
  • Automatic work time. If the company turns it on and you yourself agree to it on your phone, the app notices in the background when you arrive at or leave today's job site, and starts or ends work time. We send the server only the event "arrived" or "left" with the time, without coordinates. Each time you receive a notification with a Cancel button, and you can turn the feature off at any time. We keep it for 12 months.
  • Photos. If the place where a photo was taken is saved in the photo file, we store it with the photo (see section 5).

We use location in the background only for automatic work time and only if you allow it yourself on your phone. You can see what your manager currently sees about you in the app: Profile, What your manager sees. We process location at work on the employer's behalf, so contact the employer first with any questions.

7. Artificial intelligence

Part of the work in the app is done by artificial intelligence (AI). Every AI result is marked "Created with AI", and a human checks and approves it before it is saved. AI does not make decisions that would have legal effects for you; we do not carry out automated decision-making within the meaning of Article 22 GDPR.

AI features and what they receive:

  • reading receipts, delivery notes and documents: the document image or PDF (we reduce photos and remove metadata);
  • creating a job from text or voice: the job description or voice transcript, together with the names of the company's customers and employees and street names as spelling hints;
  • voice commands and AI assistant: your question or command and the company data needed for the answer; we store assistant conversations with your account;
  • choosing a job icon: the job name;
  • grammar correction, if turned on: the content of one text field;
  • photo description in exports, if turned on: the job photo (reduced, without metadata; people or addresses may be visible in the photo);
  • speech to text: a voice recording up to 1 minute.

Text and image tasks are performed by Anthropic, speech to text by OpenAI (with Google Gemini as backup). They do not use the data to train models and keep it for no longer than 30 days for security monitoring. We process company data in AI features as a processor on the company's behalf (see section 2). For the other AI features, the basis is the contract (Article 6(1)(b)), as they are used by choice.

8. Who data are shared with

We do not sell data or share it for advertising purposes. The following service providers process it on our behalf, each only what is needed for its task:

  • Oracle Cloud: server, database, private file storage (photos, videos, PDFs, exports) and encrypted backups. All account and app data. Sweden, Stockholm (EU).
  • Anthropic: AI features in the app and chat on the website (see sections 3 and 7). USA.
  • OpenAI and Google Gemini: speech to text. USA and EU.
  • Google Maps Platform: address suggestions and trip distance and time. Address and coordinates, without names. EU and USA.
  • Stripe: subscription payments. Company name, address, VAT number, e-mail; card details only to Stripe. Ireland (EU), partly USA. For fraud prevention and to fulfil its own legal obligations, Stripe acts as an independent controller.
  • Resend: sending e-mails (quotes and invoices to customers, reminders, password resets, notifications, contact form messages to us). Recipient address, content, attachments. Sends from Ireland (EU), logs in the USA.
  • Sentry: error monitoring, technical information only. Germany (EU).
  • Expo: push notification delivery and app updates. Push token and notification text; for updates, the device IP address and app version. USA.
  • Google Firebase Cloud Messaging and Apple Push Notification service: delivering notifications to the phone. Push token and notification text. EU and USA.
  • OpenStreetMap Foundation: map images in the Team map feature. They are requested by our server, not your phone, so no personal data are shared. United Kingdom.
  • Vercel: hosting of the website kvedo.com. Visitor IP address in server logs. EU and USA.
  • Supabase: database for the waitlist and contact form. Ireland (EU).
  • Cloudflare: domain name (DNS) service only. No data pass through it.
  • Spacemail (Spaceship) and Google Workspace (Gmail): our mailbox info@kvedo.com. Letters and attachments. EU and USA.

If a processor is located outside the European Economic Area, data are transferred under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, if the processor has joined it. A copy of these documents can be obtained by writing to info@kvedo.com.

We notify company account owners of the addition of a new processor or the replacement of an existing one 30 days in advance by e-mail and in the app. The company may object as described in the data processing annex to the terms of use.

We may also share data with public authorities if the law requires it.

The app stores Google Play and App Store and the website YouTube are operated by Google and Apple as independent controllers in accordance with their own privacy policies.

9. How long we keep data

  • waitlist: until the message that the app is available and for 3 more months after it, so that the discount can be given, but no longer than 24 months from signing up;
  • contact form messages and correspondence with support: 24 months;
  • chat questions and answers: 90 days; IP address hash for rate limiting: 24 hours;
  • IP address and its hash for limiting sign-in attempts, the waitlist and forms: 24 hours; IP address hash with a waitlist entry, contact form message, quote approval and acceptance of terms: as long as the entry itself;
  • password reset codes together with the IP address: 24 hours;
  • sign-in keys (sessions): 7 days after they expire;
  • account and company data, app data and acceptance of terms: as long as the account exists;
  • two-step sign-in key and codes: until it is turned off;
  • invoices we issue: 5 years, as required by accounting regulations; invoices a company issues to customers: 5 years, also after the account is deleted, as set out in the terms of use, and they can be downloaded before deletion (Company, Data export);
  • subscription cancellation survey: 24 months, after that only totals without text;
  • AI assistant conversations: 12 months after the last message;
  • unsent voice comment: 72 hours; voice recordings for speech to text: not stored;
  • Team map latest point: until work ends, no longer than 24 hours;
  • work action history with location and automatic work time events: 12 months;
  • data export files: until the link expires;
  • error records in Sentry: 90 days;
  • server access logs with IP addresses: 14 days;
  • backups: database 90 days, files 30 days; deleted data disappear from backups no later than within this time, and until then we do not use them;
  • on the side of AI service providers: no longer than 30 days.

Account deletion. You can delete your account in the app: Profile, Delete account, or by writing to info@kvedo.com. Deleting an employee account deletes their name, e-mail and phone and disables sign-in; the company's work history remains without this data. If you are the company's only administrator, deletion deletes the whole company and its data, except issued invoices, which we keep for 5 years.

10. How we protect data

All connections are encrypted (HTTPS/TLS). We store passwords only as hashes, and there is two-step sign-in, short-lived sign-in keys, a list of active sessions with the option to sign out of other devices, and limiting of sign-in attempts. Each company's data are kept separate in every request, and this is checked by automated tests. Files are stored in private storage and are opened only with a link that is valid for a limited time. Backups are encrypted, and restoring them has been tested. If a security incident affects data for which we are the controller and may pose a risk to your rights, we will notify the Data State Inspectorate (Datu valsts inspekcija) within 72 hours of becoming aware of it, and, if the risk is high, also you without delay. If an incident affects data we process on a company's behalf, we will notify the company without delay.

11. Your rights

You have the right to:

  • find out what data of yours we have and receive a copy of it;
  • correct incorrect data;
  • ask for data to be deleted;
  • ask for processing to be restricted;
  • receive your data in a portable format: the app has a full export of company data (Company, Data export);
  • opt out of e-mails with tips during the trial (link in every e-mail or in the app: Profile, Notifications, Tips);
  • withdraw consent at any time; this does not affect processing before the withdrawal.

Right to object. You may at any time object to processing based on our legitimate interests (sections 3, 4 and 13). We will then stop the processing, unless we have compelling legitimate grounds that override your interests, or the data are needed for the establishment or defence of legal claims. You can always object to the use of data for direct marketing, and we then stop it without conditions.

Write to info@kvedo.com. We will respond within one month; in complex cases we may extend this period by a further two months, informing you of this. Before responding we may ask you to confirm that the data are yours. If the question concerns data we process on a company's behalf, we will pass it on to the company and help it respond.

If you believe we are acting incorrectly, you may lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija): Elijas iela 17, Rīga, LV-1050, pasts@dvi.gov.lv, +371 67223131.

12. Cookies and data on your device

The website kvedo.com itself does not use cookies. Data are stored on your device only in these cases:

  • the chat keeps the conversation in the browser session (sessionStorage) until the tab is closed, so that it is not lost when you go to another page;
  • after sign-in, the account pages and app.kvedo.com store one sign-in key in the browser so that you do not have to sign in every time; if Remember me is not ticked, only until the tab is closed. When you sign out, the key is deleted;
  • the mobile app stores on the phone the sign-in key in secure storage, settings and data for working without signal;
  • if you press play on a video tutorial, YouTube may store data in your browser (see section 3).

The first three are needed for the service you use yourself to work, so consent is not required for them.

13. Company contacts we use to communicate about Kvedo

We write to Latvian construction and utility network companies to tell them about Kvedo and find out whether it would be useful to them.

We have not bought the contact information. It is taken from public registers and information published by the company itself:

  • the register of construction merchants and the register of construction specialists of the Construction Information System (BIS);
  • the Register of Enterprises open data;
  • company annual reports;
  • the company's own website.

For each company we store the name, registration number, published e-mail address, website address and publicly available information about its field of activity and number of employees. If the published address is a specific employee's named address on the company domain, it is personal data, and this section applies to it.

The legal basis is our legitimate interests (Article 6(1)(f) GDPR): offering our product to companies that may need it given their field of activity. We have assessed that such communication does not infringe the recipient's rights: it is sent to a work address, about a work matter, and can be stopped at any time with one word.

We send no more than four letters to any one company. If you reply "no" or otherwise indicate that you are not interested, we stop and do not write again.

We send letters from info@kvedo.com. The mailbox is provided by Spacemail (Spaceship), and we handle the correspondence in a Google (Gmail) mailbox, so these service providers process the content of the letters on our behalf. We keep the contact list in our own database.

We keep the data as long as they are needed for this communication, and no longer than 24 months after the last letter. If you have opted out, we keep only the address on a list of those we no longer write to, for as long as we send such letters, so that we do not accidentally write again.

To object to processing or ask for your data to be deleted, write to info@kvedo.com.

14. Children

Kvedo is intended for companies and their employees. It is not intended for persons under 16 years of age, and we do not knowingly collect their data.

15. Changes

If the policy changes, we will change the date at the top of the page. We will also notify you of significant changes in the app or by e-mail before they take effect.