Privacy policy

Who we are

Errander (errander.eu) is a bounty and errand marketplace operated from Sweden, with users mainly in the EU.

The data controller is Errander, operated by Gustav Rukhadze, enskild firma (org.nr 870607-6315).

You can reach us about privacy at hi@errander.eu.

What data we collect and why

Account and profile: name, email address, password hash (we never store your password in plain text), optional profile text, skills, rates, and avatar image stored in Cloudflare R2. We need this to run the service, communicate with you, and show your public profile to other users.

Sign-in: we support email and password, Google OAuth, and BankID via Criipto. For OAuth and BankID, the provider sends us identifiers and verification status — not your national ID number stored on our servers.

Location: when you post a bounty we store geocoded coordinates and related place text from Amazon Location Service so erranders can find tasks. You choose what you share.

Payments: amounts, Stripe customer and Connect account identifiers, invoice metadata, and payout status. Card numbers and full bank details are handled only by Stripe — they never pass through our application servers.

Messaging: content you send through in-task messaging between poster and errander.

Reviews: ratings and text you submit about completed tasks.

Referrals: referral codes and links so we can attribute finder's fees.

Technical logs: we avoid logging personal data. We may log security and reliability events without content that identifies you personally.

Lawful bases: we process data to perform our contract with you (Art. 6(1)(b) GDPR), for legitimate interests such as fraud prevention and service improvement where balanced against your rights (Art. 6(1)(f)), and where consent is required (for example marketing — we do not send marketing without opt-in). Identity verification via BankID relies on your use of the Criipto flow, which is governed by their terms as well.

How we use your data

We use data to provide the marketplace: matching posters and erranders, messaging, payments in escrow, reviews, referrals, and support.

We use processors listed below under strict agreements. We do not sell your personal data.

If we must disclose information to authorities, we will only do so when legally required and proportionate.

Processors and where data is stored

We aim to keep personal data in the EU or EEA.

Railway — application hosting and database in the EU (Stockholm region).

Cloudflare — CDN, DNS, and R2 object storage for avatars and uploads; EU configuration where available.

Brevo (France) — transactional email such as verification and password reset.

Stripe Payments Europe Ltd (Ireland) — payments, Connect, invoicing including Swedish VAT on invoices.

Criipto (Denmark) — BankID and other eID flows for identity verification.

Amazon Location Service — geocoding and place search; we use the eu-north-1 (Stockholm) Region.

If a processor stores data outside the EU, we rely on appropriate safeguards such as the EU Commission's standard contractual clauses.

Retention

We keep account data while your account is active.

After you delete your account via Settings, we delete or anonymise personal data within a reasonable period, except where law requires longer retention (for example accounting records).

Uploaded files in R2 may be removed sooner by automated lifecycle rules (for example temporary uploads).

Messaging and task history may be kept in anonymised form for analytics after deletion where permitted.

Your rights

Under GDPR you may request access, rectification, erasure, restriction of processing, data portability (where applicable), and object to certain processing.

You may withdraw consent where processing is consent-based, without affecting prior lawful processing.

You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

How to exercise your rights

Email hi@errander.eu from the address associated with your account and describe your request.

To delete your account and much of your data in one step, use Settings → delete account and confirm by typing DELETE as instructed.

If we have appointed a Data Protection Officer, their contact details will appear here: Not yet appointed — use hi@errander.eu.

Cookies

We use functional cookies and similar technologies required for sign-in and security (Better-Auth session cookies).

We do not use analytics or advertising cookies today, so we do not show a cookie consent banner for non-essential cookies.

Changes

We may update this policy. We will change the "Last updated" date and, for material changes, provide a reasonable notice on the site or by email.

Contact

Website: https://errander.eu

Privacy contact: hi@errander.eu