Privacy policy
Last updated:
1. Who we are
Kvedo is an app in development for tradesmen and small crews in Latvia. The data collected on kvedo.com is the responsibility of Erlens Toms Rukers and Rūdolfs Šuklais.
Contact: info@kvedo.com, +371 20 51 05 02
2. What data we collect
On the waitlist: only what you enter yourself in the form, and a few things that come about automatically:
- the email address you enter;
- the date and time you signed up;
- the language the page was open in;
- a note of which page the signup came from;
- a fingerprint (hash) of your network address (IP), not the address itself, to stop mass signups from one network; we keep it no longer than this limit needs and delete it with the next signup once it is older than 24 hours.
In the account area: what you enter when you create the account and later inside it, and a few things that come about automatically:
- the company name, your name, username, email address and phone number, if you give one;
- the password, which we keep only as a hash, so we cannot read it ourselves;
- the company details and settings you enter or change in the account: the company email address and phone, address, registration and VAT numbers, VAT rate, invoice and quote numbering, country, time zone, currency and language;
- the users you add to your company: their name, username, email address, phone number and role, and a record of who added the user and when;
- if you turn on two-step login: its secret key (kept encrypted) and the recovery codes (kept only as hashes);
- the date and time the account was created and the login keys we issue (kept only as hashes);
- your network address (IP) at every attempt to create an account, log in, sign out or change the password, every time you turn two-step login on or off, and every time a login key is renewed, together with a note of which account or key it concerns, to limit password guessing; for two-step code attempts we keep only the account and the time, with no address, to limit code guessing; all of it we keep no longer than these limits need and delete with one of the next attempts once it is older than 24 hours;
- location: only when you start a trip or set your base from your location; we keep the trip's starting point and the base point;
- the chosen plan and the subscription status, which Stripe reports to us.
In the contact form on the site: what you type into it, and a few things that happen by themselves:
- your name, email address, phone number if you give one, and your question;
- the date and time the message was sent;
- the language the page was open in;
- a fingerprint (hash) of the network address, not the address itself, to stop mass messages from one network; we keep it no longer than that limit needs and clear it with the next message once it is more than 24 hours old.
Payment card details do not reach us: you enter them on Stripe's page. The site has no analytics, no ad tracking and no cookies.
3. Why we collect it
On the waitlist: to send you a message when the app is available, and to send the 50% discount code for the first month. We do nothing else with your email address.
In the account area: to make the account work. Your email address or username and your password log you in, the company details go on your invoices and quotes, the users you add can log in to the app, and the plan sets how many users you may add. The network address is used only to limit password guessing. If we need to, we will contact you about the account by email. Location is used only to find addresses and work out the distance and driving time of a trip for your trip log.
In the contact form: to answer your question. We do nothing else with it.
We do not sell any of it and do not pass it to third parties for advertising purposes.
4. On what basis
On the waitlist: on the basis of your consent, Article 6(1)(a) of the General Data Protection Regulation. You gave it the moment you entered your email address and pressed the button. You can withdraw your consent at any time, and this does not affect the lawfulness of the processing up to the moment of withdrawal.
In the account area: to provide the service you asked for when you created the account, Article 6(1)(b) of the same regulation. The network address at login attempts we keep on the basis of our legitimate interest in protecting accounts from password guessing, Article 6(1)(f). Location is processed to provide the same service, Article 6(1)(b).
In the contact form: on our legitimate interest in answering a message you sent us yourself, Article 6(1)(f) of the General Data Protection Regulation.
5. How long we keep it
The waitlist address: until the app has launched and the message about it has been sent, and no longer than 24 months from signup. After that we delete the address. If you ask us to delete it sooner, we delete it right away.
Account data: for as long as the account exists. If you ask us to delete the account, we delete it. The two-step login key and codes are deleted when you turn two-step login off. The network address at login attempts: by the 24 hour rule described in section 2.
Contact messages: 24 months from when the message arrives, then we delete them. If you ask us to delete one sooner, we do it at once.
6. Where the data is
Waitlist database: Supabase, servers in Ireland (EU, AWS region eu-west-1).
Account area data: the account area is not yet available. When we launch it, we will write here where its data is kept.
Page hosting: Vercel. The visitor's IP address briefly ends up in Vercel's server logs, which is normal web server operation.
Payments: Stripe. When you choose a plan, Stripe receives the company name and email address, and you enter the card details on Stripe's page, not on ours.
Notifications about contact messages are sent to our email by Resend, which sends from Ireland and keeps logs and metadata in the USA.
Route and address lookup in the app: Google Maps Platform (Google Ireland Limited). When you start a trip or type or pick an address in the app, our server sends Google that address or the location coordinates to find the address and work out the distance and driving time. Google does not receive your name, client data or invoice details. Google may process this data outside the EU under the European Commission's standard contractual clauses.
All of them are our data processors and process the data only on our instructions.
7. Your rights
You have the right to know what data of yours we have, to receive a copy of it, to correct mistakes, to ask for deletion, to restrict processing, to object to processing and to withdraw consent. Write to info@kvedo.com and we will reply within one month.
If you think we are handling things wrongly, you can lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, pasts@dvi.gov.lv, +371 67223131.
8. Cookies
The home page, the waitlist page and this policy do not use cookies and store nothing on your device. The chosen language is carried only in the address bar, not saved.
The account area does not use cookies either, but it keeps one login key in your browser so that you do not have to log in again every time. When you sign out, the key is deleted.
Payment card details never reach kvedo.com. They are handled by Stripe, our payment processor, and we receive only the status of the subscription.
9. Company contacts we use to get in touch about Kvedo
Before Kvedo launches, we write to Latvian construction and building services companies to tell them about the product and to find out whether it would be useful to them.
We have not bought the contact details. They were gathered from sources where the company published them itself:
- the Register of Construction Merchants and the Register of Construction Specialists in the Construction Information System (BIS)
- the open data of the Register of Enterprises
- company annual reports
- the company's own website
For each company we keep the name, the registration number, the published email address, the website address and the publicly available information about its field of activity and number of employees. If the published address is in a particular employee's name on the company's domain, it is personal data, and this section applies to it.
The legal basis is our legitimate interest (Article 6(1)(f) of the GDPR): to offer our product to companies that, judging by their field of activity, might need it. We have assessed that this kind of contact does not infringe the recipient's rights: it goes to a work address, concerns a work matter, and can be stopped at any moment with a single word.
We send one company no more than four emails. If you reply "no" or otherwise let us know you are not interested, we stop and do not write again.
We send the emails from info@kvedo.com. The mailbox is provided by Spacemail (Spaceship), and we handle the correspondence in a Google (Gmail) mailbox, so these service providers process the content of the emails on our instructions. The contact list is kept in our own database.
We keep the data for as long as it is needed for this contact, and no longer than 24 months after the last email. If you have opted out, we keep only the address, on a list of those we no longer write to, so that we do not write to you again by mistake.
To object to the processing or to ask us to delete your data, write to info@kvedo.com.
10. Changes
If the policy changes, we will change the date at the top of the page.