Privacy policy

1.Data controller

Serv AB, company registration number 559299-5020, registered in Stockholm, Sweden, is the controller for the processing of personal data described in this policy. Contact for data protection matters: rasmus@kreyva.com

2.Scope

This policy covers the kreyva.com website only. Kreyva is under development and has not launched. An extended policy covering the application itself will be published when the application becomes available.

3.Personal data processed

• Email address, provided voluntarily when joining the waitlist.
• A link to a social account, only if provided voluntarily on the page for cooks and creators. The field is optional.
• Timestamp of signup, recorded automatically.

No name, address, telephone number, payment details, location data, biometric data or special categories of personal data under Article 9 GDPR are collected.

4.Purposes and legal basis

Consent is given by actively entering an email address and submitting the form. Providing the data is voluntary, and consent may be withdrawn at any time.

The data is not used for profiling or automated decision-making.

5.Recipients

• Supabase — the database in which signups are stored.
• Lovable — hosting and operation of the website.

Data processing agreements have been or will be concluded with all processors in accordance with Article 28 GDPR, and processors act only on documented instructions from the controller. Transfers outside the EU/EEA may occur and rely on the European Commission's standard contractual clauses or another valid transfer mechanism under Chapter V GDPR.

Personal data is never sold and never disclosed to third parties for marketing purposes. Creators never receive users' email addresses. Data may be disclosed to authorities where required by law or by a binding decision.

6.Retention

Data is processed until whichever of the following occurs first:

• Consent is withdrawn or erasure is requested, in which case the data is deleted without undue delay.
• The service launches and notification is sent, after which the data is deleted within twelve months unless the person becomes a user.
• A decision is made not to launch, in which case all data is deleted.

7.Security

Appropriate technical and organisational measures are taken to protect the personal data. Row-level access control means that email addresses cannot be read from the website. Data is transmitted encrypted.

8.Your rights

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

• Access — Article 15 GDPR
• Rectification — Article 16 GDPR
• Erasure — Article 17 GDPR
• Restriction of processing — Article 18 GDPR
• Objection — Article 21 GDPR
• Data portability — Article 20 GDPR

Requests are made to rasmus@kreyva.com and are answered without undue delay and in any event within one month.

9.Complaints

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se

10.Cookies

The site uses no analytics, marketing or tracking cookies — only what is technically necessary for the site to function. If cookies requiring consent are introduced later, information will be given and consent obtained beforehand.

11.Changes

This policy may be updated. Material changes affecting the processing will be notified by email where we still process the address.