Privacy Policy

1.Who we are

Raiven Inspect ("the App") is provided by Speed Up Mobile AB, a company registered in Sweden (org. nr 556615-9520), postal address Kivra: 556615-9520, 106 31 Stockholm ("we", "us").

Data protection contact: privacy@raiveninspect.com

Raiven Inspect is a business application for property-inspection work. It is not a public consumer app. Accounts are created and managed by the organisation that licenses the App (the "Customer"); there is no public sign-up. The App's users are the Customer's staff (inspectors and administrators).

2.Our role: processor on behalf of the Customer

For the inspection data and account data handled through Raiven Inspect, we act as a data processor on behalf of the Customer, who is the data controller under the EU General Data Protection Regulation (GDPR). The Customer decides what data is recorded and why. We process it only to provide and support the App, under a separate Data Processing Agreement (DPA) with the Customer.

3.What data the App processes

Account data

• Name (firstname.lastname), email address, role (administrator/inspector), and an account identifier.
• A securely hashed password. Authentication uses JWT; password resets are sent by email.

Inspection data (the core content)

• Inspection records: dates, assessments, comments, status, the responsible inspector, and the contractor.
• Deviations (anmärkningar): descriptions, actions (åtgärder), comments, dates.
• Photos of property conditions taken by inspectors. Photos may incidentally capture people, vehicles, or other identifiable details.
• Location: The App collects precise location via device GPS (`ACCESS_FINE_LOCATION`/`ACCESS_COARSE_LOCATION`) to tag inspection and deviation (anmärkning) records, plus addresses/areas of inspected properties. Location is optional and permission-gated: if the user denies permission or GPS is unavailable, no location is recorded (it is not estimated or faked).
• Base data: areas/properties, contractors (company names and contacts), and users.

The App does not ask for or process special-category data deliberately; however, photos and free-text comments could incidentally contain personal data. Users should avoid recording more personal data than the inspection requires.

4.Why we process it (purpose) and legal basis

We process the data solely to provide, secure and support the App for the Customer — to record and manage inspections, authenticate users, and operate the service. We do not use it for our own purposes, do not sell it, and do not use it for advertising.

The legal basis for the underlying processing is determined by the Customer as controller.

5.Where data is stored and how it is protected

• Data residency: all data is stored within the EU/EEA on Hetzner Online GmbH infrastructure. Structured data (PostgreSQL) and backups are in Helsinki, Finland; photos are in Hetzner Object Storage (EU-only; data stays in its selected EU location). No transfer outside the EU/EEA in normal operation.
• In transit: data is transmitted over encrypted connections (TLS/HTTPS).
• Access control: data stores are access-controlled with scoped credentials and are not publicly accessible.
• Tenant isolation: each Customer's data is scoped to its own tenant.
• Backups: backups are immutable (Object Lock — cannot be altered or deleted during their retention period), held in the same EU region, and removed in the normal backup cycle.
• Hardware: the hosting provider destroys decommissioned drives on-site.

6.Sharing and third parties

We do not sell data, do not use it for advertising, and the App contains no analytics, crash-reporting, or push-notification SDKs and no AI/LLM processing of user data. Photos only — no video or audio capture.

Service provider acting on our behalf:

• Hetzner Online GmbH — hosting and storage (EU).

Third party that receives location data directly from your device:

• OpenStreetMap Foundation — when location is enabled, the App sends coordinates directly from the device (not routed through our servers) to OpenStreetMap services: Nominatim for reverse-geocoding (exact coordinates, to look up an address) and OSM map tiles to display the map (approximate location). In doing so, OpenStreetMap services may also receive technical connection data (such as IP address, user agent, and the map or geocoding request itself). This transfer is governed by the OpenStreetMap Foundation's own privacy policy.

We may disclose data where legally required (e.g. a valid court order).

7.Retention

Inspection data and photos are retained for the duration of the customer agreement, as directed by the Customer (controller). There is no fixed expiry while the agreement is live.

On termination, data is returned and/or deleted at the controller's direction, as set out in the Data Processing Agreement (DPA). Once data is deleted from the live system, any copies held in immutable backups (Object Lock, which cannot be selectively edited) are removed in the normal backup cycle.

Where the Customer is subject to legislation governing public records and archiving (in Sweden, archive legislation such as Arkivlagen, and rules on public documents), some records may be required to be retained under those rules even where erasure is otherwise requested.

8.Your rights and data deletion

Data subjects have rights under GDPR — access, rectification, erasure, restriction, and objection. Because Speed Up Mobile acts as processor, requests are directed to the Customer (controller): contact your organisation's Raiven administrator. The controller evaluates the request and, where needed, instructs us under the Data Processing Agreement; we assist as processor and do not decide data-subject requests ourselves. Requests concerning rectification, restriction of processing, or objection are handled through the same controller-routed process. There is no public self-service deletion, because accounts are provisioned by the Customer, not by public sign-up.

How to request deletion. To request deletion of personal data in Raiven Inspect (provided by Speed Up Mobile AB), contact your organisation's Raiven administrator — or email privacy@raiveninspect.com and we will route the request to the responsible Customer (controller).

What is deleted, anonymised or pseudonymised, and what is retained (implemented in accordance with the Data Processing Agreement and the Customer's instructions):

• Account identity — on an approved request, a person's identifying data (name, username, email, and stored copies of these) is scrubbed and the account replaced with a generic tombstone. Linked inspection history is preserved but no longer contains direct identifiers in the operational records. The surviving activity trail (timestamps and actions) may still be re-identifiable by the Customer using their own records, so it is pseudonymised, not fully anonymised.
• Photos — where the controller determines that deletion is required or appropriate under applicable law, a photo capturing an identifiable person can be deleted, including the underlying image file (not only the database record).
• Audit and operational logs — records of who performed which actions remain personal data and are retained, under a legal basis and for a period determined by the Customer (controller), for accountability and to establish or defend legal claims. The identifying elements are removed, or the logs deleted, once that period ends, in accordance with the controller's retention policy. These logs are not altered, to preserve their integrity.
• Inspection content and free-text — forms part of the Customer's business records and is generally retained. Where such content contains personal data relating to a requester, the Customer assesses each request individually under applicable law; where removal is required, an administrator can edit or remove that personal data on a per-record (individual) basis. There is no automated, bulk, or self-service removal of personal data from free-text.
• Backups — deletion takes effect in the live system immediately; copies in immutable backups (Object Lock) are removed in the normal backup cycle.

Where the Customer is a public authority or a municipally owned company, retention and erasure may additionally be governed by legislation on public records and archiving: some records may be required to be retained, in accordance with the Customer's applicable archiving and disposal rules, even where a data subject requests erasure.

9.Children

Raiven Inspect is a workplace tool for the Customer's staff and is not directed at children.

10.Changes

We may update this policy. Material changes will be communicated to the Customer. The "Last updated" date reflects the latest version.

11.Contact

Speed Up Mobile AB — Kivra: 556615-9520, 106 31 Stockholm — privacy@raiveninspect.com

Supervisory authority (Sweden): Integritetsskyddsmyndigheten (IMY).