Privacy policy

This is an English translation, provided for your convenience. The Swedish version is the legally binding one; if the two differ, the Swedish version applies.

This policy describes the personal data we process when you use Bostadsvaka.se, why we do it and what rights you have.

Last updated 26 October 2026

Who is responsible for your data?

Qonera AB (company reg. no. 559590-7543) is the data controller. You can reach us at info@bostadsvaka.se.

The data we process

Account details: your email address, your password and when you created the account and accepted the terms of use. The password is only stored in hashed form, so we can never see it.
Your alerts and settings: which municipalities, how many rooms, what maximum rent and size you are looking for, which housing queues and landlords you have left out or marked that you have an account with, how often you want notifications and whether you have quiet hours. If you give a mobile number, it is stored.
Mobile notifications: if you turn on notifications we store, for each device, the address your browser gives us for sending notifications there, keys to encrypt them and what type of device and browser it is, for example “Chrome on Android”.
Queue places we keep active: if you ask us to keep your place in a landlord's queue, we store what you log in with there (personal identity number, email address or username) and the password we created for you. Both are stored encrypted, with a key that is not in the database. When we log in we store how long the queue place is valid, which queues you are in, since when, and your queue points. If you ask us to remind you about a queue place where we don't log in, we store the landlord and when you last renewed the queue place.
Notification history: which apartments we have emailed you or sent notifications about, and when.
Subscription and payment: the status of the subscription, trial and billing period, and the customer ID the payment provider Stripe gives you. Card and payment details are only handled by Stripe, and by Klarna if you pay with Klarna – we never see or store them.
Technical information: when you visit the site, our server handles your IP address and your browser's technical details. They are only logged briefly, to detect errors and stop abuse.
Statistics about visits, if you allow it: which pages you visit, where on the page you click, how far you scroll, which forms you start filling in and which field you left them in, errors that occur and how fast the pages load, linked to a random ID for your browser. We never store what you type in forms. We also store what type of device you use, where you came to the site from, roughly where you visit us from (country and town) and a shortened IP address. If you create an account or log in, the statistics are linked to your account, including those from before you logged in. We use them to see where the site is awkward and to make it better.
Contact with us: if you email us or write via the contact form, we store what you write, your name if you give it and your email address for as long as needed to help you.

Why we process the data and on what legal basis

Purpose	Legal basis
Create and manage your account, watch for apartments and send notifications	Contract (Article 6(1)(b) GDPR)
Log in to landlords on your behalf so that you keep your place in the queue. If you log in with a personal identity number, we process it with your consent, which you give when you connect the account and can withdraw by stopping.	Contract (Article 6(1)(b)), and consent for personal identity numbers (Article 6(1)(a))
Charge for the subscription and handle the trial and cancellation	Contract (Article 6(1)(b))
Keep accounting records	Legal obligation under the Swedish Accounting Act (Article 6(1)(c))
Keep the service secure, troubleshoot and prevent abuse	Legitimate interest (Article 6(1)(f))
Ask you once, two weeks after you started subscribing, what you think of the service	Legitimate interest (Article 6(1)(f))
Remind you at most twice, in the first days after you created an account, to create your alert and start your trial. You can say no when you create the account, and turn it off under My account or with the link in the email.	Legitimate interest (Article 6(1)(f))
Keep statistics on how the site is used, to make it better. You can withdraw your consent at any time, under Cookie settings at the bottom of the page or under My account.	Consent (Article 6(1)(a))
Reply when you contact us	Contract or legitimate interest (Article 6(1)(b) and (f))

We send no marketing mailings, never sell your data and do not use it for profiling or automated decisions with legal effects for you.

Who gets access to the data

We use a few providers that process data on our behalf, under data processing agreements:

DigitalOcean – runs the servers where the service and the database are.
Cloudflare – all traffic to the website goes via Cloudflare, which protects it against attacks and handles the encrypted connection. Cloudflare therefore sees, among other things, your IP address. When you create an account, reset your password or use the contact form, Cloudflare Turnstile checks, based on technical details about your browser, that it is a human who is sending.
Amazon Web Services (Amazon SES) – sends our emails, for example notifications and links to reset your password.
Zoho – receives and stores emails you send us at info@bostadsvaka.se.
Apple, Google, Mozilla and Microsoft – if you turn on mobile notifications, they are delivered via the service that belongs to your browser or phone. The content of the notifications is encrypted so that only your device can read it. The service only sees that a notification is sent to your device.
Stripe – handles payments. In some respects Stripe is an independent data controller, for example to prevent fraud. Read more in Stripe's privacy policy.

When we log in to a landlord on your behalf, we send what you log in with and the password to the landlord's login. The landlord is itself responsible for your account and your data there.

We may also need to disclose data to authorities if the law requires it.

Transfers outside the EU/EEA

We aim to have the data processed within the EU/EEA, and the database is on servers in the EU. Stripe, Cloudflare, our hosting provider, our email provider and the services that deliver notifications are or are owned by American companies and may transfer data to the USA. This is done under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

How long we keep the data

Account, alerts, settings and notification history are kept for as long as you have an account. When you delete the account, they are deleted immediately.
Login details for queue places we keep active, and reminders about queue places, are deleted immediately when you stop on the Housing queues page or delete your account.
Accounting records for payments are kept for seven years under the Swedish Accounting Act. They are mainly held by Stripe.
Statistics about visits are kept for 90 days. After that they only remain as totals per day that cannot be linked to you. If you withdraw your consent, the statistics about you are deleted within a day, and if you delete the account they are deleted immediately.
Technical logs are deleted continuously within a short time.
Deleted data may remain for a limited time in backups before it is overwritten.

Your rights

You have the right to:

access your data and move it – under My account you can download everything we have stored about you,
rectify incorrect data – you can change your email address and settings yourself,
have your data erased – you can delete your account under My account,
request restriction of and object to processing based on legitimate interest.

Contact us at info@bostadsvaka.se if you want to exercise your rights or have questions. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (imy.se).

Cookies

Some cookies are needed for the site to work, and for them we don't need your consent:

session – keeps you logged in for 30 days. The time is extended when you use the site.
CSRF protection – a security token in the session that protects forms against forged requests.
bv_consent – remembers whether or not you have allowed statistics, for six months. Then we ask again.
lang – remembers which language you have chosen for the site, Swedish or English, for a year.

Only if you allow statistics do we also use these, for the statistics about visits:

bv_vid – a random ID for your browser, for twelve months.
bv_sid – a random ID for your visit, which changes after 30 minutes without activity.

If your browser asks not to be tracked (Do Not Track or Global Privacy Control), we collect no statistics, whatever you have chosen. You change your choice under Cookie settings at the bottom of the page or under My account. We use no cookies for marketing. Most of the site comes from us, but a few things are fetched from others, who then see your IP address:

The photos of the apartments are shown directly from the landlords' sites.
The map of available apartments fetches its map images and fonts from OpenFreeMap.
Where we show reviews from Trustpilot, they are fetched with Trustpilot's widget. If you leave a review on Trustpilot, Trustpilot is responsible for it.

When you pay, you are sent to Stripe's payment page, which has its own cookies.

Security

All traffic to the site is encrypted, your password with us is only stored hashed, login details for landlords are stored encrypted and access to the database is restricted. If a security incident should still affect your data, we will notify you and the Swedish Authority for Privacy Protection as required by law.

Changes to the policy

We update the policy when the service or the law changes. If the changes are significant, we email you before they take effect.