Privacy Policy

About Us and Data Controller

Paxaden is operated by Jane Doe Communication AB (org. no. 556663-5321), which is the Data Controller responsible for your personal data in Paxaden. We comply with the EU General Data Protection Regulation (GDPR) and applicable data protection laws to safeguard your privacy. This policy describes what we process, for what purposes, on which legal bases, how long we keep it, how we share it, and your rights.

Information We Collect

We collect various types of information to provide and improve our services. This information is obtained from your input, your use of our services, and cookies or similar technologies:

• Account Data: Information you provide when creating an account, such as your name, email address, phone number, and other contact details.
• Usage Data: Information about how you use our services, including device information, IP address, and interaction logs.
• Optional Data: Data related to optional features you use, like bookings or preferences.

Purposes and Legal Basis

We process your personal data only when we have a valid legal basis and for clearly defined purposes under GDPR Article 6. The main purposes and their legal bases are:

• Account and sign-in – to create and administer your account and authenticate you. Legal basis: Contract (Art. 6(1)(b)).
• Carrying out bookings – to provide and maintain our services, including booking flows, reminders and updates. Legal basis: Contract (Art. 6(1)(b)).
• Payments and invoicing – e.g., via Stripe. Legal basis: Contract (Art. 6(1)(b)) and legal obligation for accounting (Art. 6(1)(c)).
• Support and troubleshooting – to assist you with questions or issues. Legal basis: Legitimate interests (Art. 6(1)(f)).
• Operations, security and abuse prevention – logs, access controls and fraud prevention. Legal basis: Legitimate interests (Art. 6(1)(f)).
• Optional features and preferences – only if you choose to use them. Legal basis: Consent (Art. 6(1)(a)) or Contract (Art. 6(1)(b)), depending on the feature.
• Marketing communications – only if you have explicitly consented. Legal basis: Consent (Art. 6(1)(a)). You may withdraw your consent at any time.

Service‑related (Transactional) Messages

Paxaden may send service‑related messages such as booking confirmations, reminders, cancellation and change notices via email and SMS. These messages are necessary for carrying out bookings and are considered part of the contracted service. They therefore do not require separate marketing consent.

Messages are sent to the contact details that you or your customers provide when making a booking. Where available, you can control certain types of notifications in your settings.

Retention: transactional SMS (including delivery logs, sender/recipient details and metadata) are stored for a maximum of 30 days for security, troubleshooting and audit purposes before being deleted automatically.

Data Sharing and Processors

We engage trusted third-party service providers to assist in operating our services, including Supabase for database management, Stripe for payment processing, and hosting providers. These processors only access the data necessary to perform their functions and are bound by data protection agreements that comply with GDPR requirements, including Standard Contractual Clauses (SCCs) where applicable.

We do not sell your personal data to any third parties.

Data Storage and Location

Your personal data is stored within the European Union or in countries that provide an adequate level of data protection as recognized by the European Commission. Where data is transferred outside these areas, appropriate safeguards are in place to protect your information. Where data is transferred outside the EU/EEA, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and apply supplementary technical and organizational measures.

Retention: Transactional SMS messages (including logs of delivery, sender, recipient, and message metadata) are stored for a maximum of 30 days for security, troubleshooting and audit purposes. After this period, they are automatically deleted.

Security

We implement appropriate technical and organizational measures, including encryption and access controls, to protect your personal data against unauthorized access, alteration, disclosure, or destruction. You are also responsible for maintaining the confidentiality of your account credentials and promptly notifying us of any unauthorized use.

Your Rights under GDPR

Where We Store Your Data

All personal data is hosted within the EU/EEA. Our primary database runs on Supabase in Sweden, SMS traffic is delivered by EU-based providers (currently ProSMS) and payments are processed by Stripe’s EU infrastructure. If we ever transfer data outside the EU we rely on Standard Contractual Clauses and equivalent safeguards.

Processors We Use

• Supabase – database, hosting and authentication (Sweden/EU).
• Stripe – payment processing and invoicing.
• ProSMS – sending verification and status SMS messages.
• Email providers (e.g. Postmark) – transactional email delivery.

Each processor may only access the data needed to provide their service and is bound by data‑processing agreements.

Retention

• Bookings and related communications are retained up to seven years due to accounting laws.
• Technical logs, OTP codes and short links are stored for a maximum of twelve months.
• Where a specific SMS log retention is stated above, that specific period overrides the general log retention.
• Ghost profiles (temporary profiles created for anonymous SMS bookings) and banned identities are kept only as long as necessary to prevent abuse. Legal basis: Legitimate interest (Art. 6(1)(f)).
• Support conversations are normally deleted within 24 months after closure.

When the legal basis expires (for example if you delete your account) we delete or anonymise the data as soon as possible while observing statutory retention obligations.

Cookies

We only use the cookies that are necessary to deliver the Service and—if you consent—analytical and functional cookies. For detailed information about the cookies we use and how to manage them, please refer to our separate Cookie Policy.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We encourage you to review this page regularly. The date of the latest update is indicated below.

Contact