Privacy Policy
Who's responsible for your data
The controller of your personal data in VillaLog is Johan Persson, who runs the service. You can reach us at hello@villalog.app. If responsibility moves to a company, we will update this page and let you know.
What we collect
Account: your name, email address and password (Supabase stores the password as a salted hash; we never see it in plain text), the language and country you chose, your time zone and when you accepted the terms. If you turn on two-step verification it is stored with Supabase, and Supabase keeps your sign-ins (browser, IP address and time) so you can see and sign out other devices. Household: the household name and who its members are. When someone in the household removes something, we record who did it and when, so the household owner can see it and bring it back within 30 days (90 days with Plus). Invitations are links, so we do not store the email address of the person you invite. Property data: whatever you choose to log, such as properties, addresses, renovations, garden areas, plants, care and maintenance tasks, optional house facts (such as year built, heating and ventilation) and photos or documents you upload. When you upload a photo, we remove location data and other hidden information from the image. We keep only the date the photo was taken, so it lands in the right place in the timeline. Contractors: names and contact details you add yourself; only add details the contractor has made available. We keep them so you can keep track of who did what in your home, on the basis of legitimate interest (GDPR Art. 6(1)(f)). Settings: your choices in the app, such as for reminders and email, whether you want the newsletter and when you said yes, the date format and how the cards on Today are arranged, which roadmap items your household votes for, and a log of reminders sent so the same email never goes out twice. Notifications: if you turn on push notifications, we store the address your browser gives us so we can send them. Calendar: if you subscribe to the calendar, we create a private link that your calendar app fetches your upcoming tasks from. Share links: if you share a sale report, we store which parts you chose to show, when the link expires, and when and how many times it has been opened. Tell us: when you report a problem or send an idea, we store the text, any screenshot, the page you were on, your browser and the app's version, and whether we may contact you. Only you and VillaLog see it. We collect nothing beyond this. The approximate country your IP address points to is used only to preselect a country in forms and is not stored.
Why we collect it
Every piece of data above exists only to run the renovation and garden log you signed up for — there's no advertising or profiling. If you come to us through a link with a campaign code (for example from an email or an ad), we store the code with your interest sign-up and your account. We use it only to count, in groups, how many get started and where they came from, and our reports never show individual people. The legal basis is performance of the contract formed when you create an account (GDPR Art. 6(1)(b)). For security, protection against abuse, troubleshooting, backups and counting, in groups, where users come from, the basis is our legitimate interest in keeping the service secure and working (Art. 6(1)(f)). The only things you must give us to create an account are an email address and a password; everything else is up to you. We make no decisions about you based solely on automated processing.
The interest list
Before registration opens, you can register your interest on the start page. We then store your email address, the language you chose, and when you signed up and confirmed. If you tick the second, optional box, we also store your choices from the preview (country, house type, heating and garden), so you do not have to choose them again when registration opens. The address is used for the confirmation email right after you sign up and for one email when registration opens. If you tick the optional newsletter box, we also store when you said yes and send VillaLog's newsletter with seasonal tips for the house and the garden, a few times a season, until you unsubscribe with the link in every issue. The legal basis is your consent (GDPR Art. 6(1)(a)), which you give with the checkboxes and confirm through the link in the email. A sign-up that is not confirmed within seven days is deleted. You can leave at any time through the link in the email or by emailing hello@villalog.app, and we then delete the address and your choices. The whole list is deleted no later than twelve months after the service opens.
Where it's stored
Your data lives in a Supabase project hosted in the eu-north-1 (Stockholm) region — inside the EU/EEA. The app itself is hosted on Vercel, whose global content-delivery network may route and briefly process web requests through infrastructure outside the EU/EEA as they reach our servers; the underlying database and file storage stay in Stockholm regardless. Backups of photos and documents are stored with Hetzner in Helsinki, also inside the EU. Several of our providers are US companies (Vercel, Cloudflare, Google, Microsoft and Sentry). Where data may be transferred outside the EU/EEA, it is protected by the European Commission's standard contractual clauses or by the EU-U.S. Data Privacy Framework.
Who else sees it
Anyone you explicitly invite into your household can see that household's data — nobody else can, except through links you share yourself. If you share a sale report, anyone with the link can see the parts you chose. If you share the emergency profile (with a neighbour or a tradesperson, say), anyone with the link sees the shut-offs, contacts and documents you chose to show, and the address only if you turn it on. Both links work until they expire or you close them. The calendar link, which you add to your own calendar, shows the titles and dates of the household's tasks to whoever has it, until you turn it off. We don't sell, rent, or share your data with advertisers or data brokers. Supabase (database/storage) and Vercel (hosting) process data on our behalf as infrastructure providers, under their own data processing agreements — they don't use your data for their own purposes. If you add a town for weather to a property, the place name you type (to find the town) and then its approximate position (rounded to about 1 km) is sent to Open-Meteo (open-meteo.com) to fetch the forecast. No account details are sent. To find and fix bugs, the app sends technical error reports to Sentry (sentry.io), which stores them in the EU (Frankfurt). A report contains the error and where in the code it happened, not your name, email, IP address or the contents of your records. If you use Snap it, the photo or PDF you choose, without location data and other hidden information, is sent to Google Cloud (Vertex AI, Google Cloud EMEA Ltd, Ireland). Google reads it in its EU region and returns the details, which you then check. Google processes it on our behalf under its data processing terms and does not use it to train AI. If Google's automated checks suspect abuse, a request may be kept for up to 90 days within the EU for review. VillaLog keeps the picture only if you save the thing. When you search for a manual, only the brand and the model are sent. Emails from VillaLog, such as confirmations and reminders, are sent through Scaleway (scaleway.com) from its data centre in Paris, inside the EU, which processes the recipient's email address and the content of the email. The sign-up and interest forms are protected against automated abuse with Cloudflare Turnstile (cloudflare.com), which checks technical details about the browser but sets no tracking cookies. Email to hello@villalog.app is received and read in Microsoft 365 (Microsoft), which stores it within the EU. Push notifications are sent through your browser's own service (for example Google, Apple or Mozilla); their content is encrypted on the way. If you subscribe to the calendar, your calendar app (for example Google or Apple) fetches your upcoming tasks through your private link.
How long we keep it
We keep your data for as long as your account is active. When you remove something in the app (a property, renovation, plant, task, photo and so on) it disappears from the app straight away. We keep it for 30 days (90 days for households with Plus), so the household owner can bring it back under Settings → Recently deleted, and after that it is deleted for good, together with its photos and documents. The history of work done stays for as long as the property does. When you delete your account, the households deleted with it are removed straight away, with all their files. Database backups are kept for 7 days and backups of photos and documents for at most about 35 days, so something you have deleted can remain there for that long before it disappears automatically. If you want something deleted for good sooner, contact us at hello@villalog.app.
Your rights
Under GDPR you can ask to access, correct, delete, or receive a copy of your data at any time, and you can ask us to restrict or object to its processing. In Settings you can download everything stored for your household yourself (including photos and documents) and delete your account. You can also email hello@villalog.app and we'll help you. If you are not happy with how we handle your data, you have the right to complain to the Swedish Authority for Privacy Protection (IMY, imy.se).
Cookies
VillaLog uses only cookies that are strictly necessary: to keep you signed in and to remember the language you chose (the vl_lang cookie) and the date format you chose (the vl_dates cookie). Both are kept for one year. No advertising or tracking cookies. If you try the plan on the start page, your choices are kept only in your own browser for at most 60 days, so the guide can fill them in when you create an account. They reach us when you save a step in the guide, or if you choose to save them with your interest registration. Your browser also keeps a few small settings that stay there: that you have seen the cookie notice and the news, whether names are shown on the map, and where you are in a guide.
Children
VillaLog isn't directed at children, and knowingly collecting a child's data isn't something we do.
Changes to this policy
If this policy changes in a way that matters, we'll update the date at the top of this page.
Contact
Questions about your data go to hello@villalog.app.