Privacy Policy
Last updated: 14 October 2026
What changed on 14 October 2026. Additions in Sections 3, 5 and 8. You can now answer an invitation to a private event without an account, with your name and email address. We use them to run that event: to count your answer, to email you a confirmation with a link to change it, and to show the people running the event your name. If you later make a Händer account with the same email address, those answers move to your account. Without an account, your name and email address are deleted 90 days after the event. Nothing else has changed. The previous version was dated 6 October 2026.
What changed on 6 October 2026. Changes in Sections 3, 6 and 7. Marketing email (only if you opted in) is now sent through Customer.io instead of Resend. It can include events picked for you based on the events you have liked, and Customer.io records whether the email was opened and which links were clicked, so we can see what is useful. If you unsubscribe from a marketing email, that is the same as turning “Email from Händer” off on your account page. Nothing else has changed. The previous version was dated 5 October 2026.
What changed on 5 October 2026. Additions in Sections 3, 6 and 8. Members can suggest events from our listings to a club they belong to, and say whether they are in; the club's members see who suggested what and who is in. A club can start a friend calendar: once a week we email members to ask which parts of the coming week they are free (morning, afternoon or evening), the club's members see the answers, and answers are deleted after 8 weeks. A big club can run a poll to find a time. If you are not signed in, events you save with the heart are kept in your own browser until you create an account. Nothing else has changed.
What changed on 30 September 2026. Additions in Sections 3 and 6. If an invitation to help run (co-admin) a club or a private event has not been answered, we send up to two reminders to the invited address, the day after and a week after the invitation, and never after it is accepted, declined, withdrawn or expired. Every invitation can now be declined from its page without signing in. When you are signed in, we show you invitations that were sent to your email address so you can accept or decline them. Nothing else has changed.
Also added on 29 September 2026. Additions in Sections 3, 6 and 8. Guests who said yes to a private event get a reminder email the day before and a couple of hours before it starts. The people running an event or a club can write messages to its guests or members, which we email to them and show on the event or club page. Club members get an email when a new meetup is posted, and can turn these club emails off on the club page. An event or club can show a link to its group chat (for example WhatsApp) and its Instagram page. Nothing else has changed.
What changed on 29 September 2026. Two additions in Sections 3, 6 and 8. The people running a private event can invite a guest by typing the guest's email address; we email that person one invitation with their personal link, and delete the address once the invitation is used, declined, withdrawn or 30 days old. And when the time or place of an event changes, we can email the guests who said yes, maybe, or are on the waitlist. Nothing else has changed.
What changed on 28 September 2026. A few additions in Sections 3 and 6: an organiser can write a name next to each personal invite link to remember who they sent it to; club members can answer a club meetup; and a club can let people ask to join, with an optional note to the club's admins. We also send three new kinds of email: to guests when an event they said yes to is cancelled, to a waitlisted guest when a place opens up and they move up, and to a club's admins when someone asks to join. Nothing else has changed.
What changed on 26 September 2026. When a new account is created, our team gets one internal email about it (name, email address, how you signed up), so we can check that getting started worked (Section 6). Nothing else has changed.
What changed on 25 September 2026. We now describe clubs, club cover images, and invitations to join or co-admin a club or an event, including the invitation email we send to someone whose address another user typed in (Sections 3, 5, 6 and 8). Nothing else has changed. The previous version was dated 15 September 2026.
What changed on 15 September 2026. We now offer optional marketing email, so this policy describes it: what we collect when you opt in, the legal basis (your consent), how we keep a record of that consent, and how to withdraw it (Sections 3, 5, 6, 8 and 9). We also describe the emails we send about your account, such as confirming your email address and resetting your password, and the investor updates list (Section 3). Nothing else about how we handle your data has changed. The previous version was dated 16 July 2026.
This policy explains what personal data Händer (“we”, “us”, the “Service”) collects when you use our Stockholm event-discovery service at vad-hander.com, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable Swedish data-protection law.
1. Who is responsible for your data
The Service is operated by its two founders, who are establishing it as a business that is currently in the process of incorporation as a Swedish private limited company (aktiebolag). The registration application is in progress and the company is not yet registered.
Because the company is not yet formed, the two founders act as joint data controllers in their personal capacity for the purposes of Article 26 GDPR. Once incorporation is complete and the company is registered, the registered company will become the data controller and this policy will be updated to reflect its statutory name, organisation number and registered address. The change of controller will not reduce the protections described in this policy.
Contact for privacy matters: privacy@vad-hander.com. You can use this address for any question about this policy or to exercise the rights set out in Section 9.
2. Our commitment to protecting your data
We are an early-stage service and, as explained above, not yet an incorporated company. That early stage does not mean a lower standard of care. We hold ourselves to the same data-protection principles expected of a large, established organisation, and we have built those principles into how the Service works rather than bolting them on afterwards:
- Data minimisation. We collect only what the Service actually needs — your account details and the preferences that power event recommendations. We do not collect data we have no use for.
- Your personal data is stored in the EU — in Stockholm. Your account, profile and activity data are held within the European Union, in the Stockholm (Sweden) region, through our database provider (Supabase), inside the scope of the GDPR.
- Analytics never contain personal identifiers. Our usage analytics measure how the Service is used in aggregate only. We never send your name, email address or account identifier to any analytics tool — only coarse, non-identifying attributes — and only after you have given consent.
- Consent-first by default. No non-essential cookies or analytics run until you actively accept them. Using Google Consent Mode, everything non-essential is denied by default for every visitor, in the EEA and everywhere else.
- Security enforced at the database, not just the perimeter. Access to your data is enforced at the database row level (row-level security), so one user can never read another user’s records. Data is encrypted in transit (HTTPS) and at rest, and passwords are salted and hashed by our authentication provider — we never see or store them in plain text.
- We never sell your data. We do not sell personal data, and we never share individual user records or email addresses with third parties for their own purposes.
- You stay in control. You can withdraw analytics consent at any time, turn marketing email off with one click on your account page, and you can ask us to access, correct or delete your data — handled within 30 days (see Sections 8 and 9).
3. The data we collect
Account and profile data
When you create an account we collect the information you provide: your first name, last name, email address, and a password (stored only in hashed form by our authentication provider — we never see or store it in plain text). During sign-up you may optionally tell us your age range, gender, neighbourhood, and whether you prefer events solo or with friends. We use this to personalise the events we show you.
Emails about your account
We send the emails needed to run your account: a link to confirm your email address when you sign up, and a link to choose a new password if you ask for one. These are part of providing the Service and are sent whether or not you have opted in to marketing email.
Marketing email (only if you opt in)
When you sign up we ask, with a separate box that is unticked by default, whether you want tips on events and news from Händer by email. Saying no does not affect your account in any way. If you say yes, we use your email address and first name to send those emails. Some of them suggest upcoming events picked for you: we choose those from the events you have liked on Händer, and send the email address, first name, an internal account number and the list of picked events to our email provider Customer.io (Section 6). Customer.io records whether each marketing email was opened and which links were clicked. Every marketing email has an unsubscribe link; using it turns marketing email off on your account, exactly like unticking the box. People who have not opted in are never sent to Customer.io.
To be able to show that you agreed, we keep a record of your answer: whether you are opted in, when you last changed that, and where you did it (at sign-up or on your account page). Every change is also stored in a history that cannot be edited, so we can show what you agreed to and when you withdrew. You can see your current choice, and change it, on your account page under “Email from Händer”.
Investor updates (only if you sign up)
If you sign up for investor updates on our investor relations page, we keep your email address, the wording you agreed to, and when you did it, and we use the address only to send those updates, starting with a short welcome email. No account is needed. Our founders are told by email that you signed up. You can unsubscribe with the link in any update or by writing to us.
Your activity in the app
To power our event recommendations we record which events you mark as “interested” or “not interested.” These signals are used to match you to events you are likely to enjoy. We do not use this data to identify you to any third party.
If you are not signed in, an event you save with the heart is kept only in your own browser (local storage on your device), not on our servers. When you create an account or log in, those saved events are added to your account as events you are interested in, and removed from your browser.
Private events you create or join
Händer lets you create a private event and invite people, or join one you were invited to. Because these features are social, some of your information is shown to other people in that event: the organiser sees the first name of everyone who joins, and a person you invite sees your first name as the sender of their invitation. If you enter a contact detail (such as an email) when creating or accepting an invite, it is used only to run that event — to send the invitation, a confirmation, and a notice to the organiser that you joined. This information is shared only with people involved in the same event, never publicly, and private events are never indexed, shown on the map, or used to train recommendations. An organiser, and anyone who helps run the event, can invite a guest by typing the guest's email address. We use that address only to email the guest one invitation with their personal link; only the people running that event see it. We delete it within a day of the invitation being used, declined or withdrawn, of the event being cancelled, or of the invitation turning 30 days old, whichever comes first. (Before 29 September 2026 they could instead write a name next to a link; those names are visible to the same people and deleted with the event.) If the time or place of an event changes, the people running it can have us email everyone who said yes, maybe, or is on the waitlist. That email shows the old and the new time or place, and never names the other guests.
You can answer an invitation without an account. You give your name and email address, and we use them only to run that event: to count your answer, to send you a confirmation (with a calendar entry and a link where you can change your answer) and the same reminders and messages as other guests, and to show the people running the event your name. They see your name, not your email address. Other guests see how many are coming, and only guests with an account see first names. If you make a Händer account with the same email address and confirm it, your answers move to that account. Without an account, we delete your name and email address 90 days after the event.
If you said yes to a private event, we email you a reminder the day before and again a couple of hours before it starts (not for an event created at the last minute). You can change your answer on your invitation page; if you step back from a full event, your place goes to the person who has waited longest. The people running an event can write messages to its guests: we email each message to everyone who said yes, maybe or is on the waitlist, and show it on their invitation pages with the writer's first name. They can also add a link to the event's group chat (such as a WhatsApp group) and its Instagram page. The chat link is shown only to guests who are coming or waiting for a place. When you open it you leave Händer, and the chat service's own privacy terms apply; we do not see or store anything from the chat.
Clubs and invitations
You can start a club and invite people to it, and you can invite someone to help run (co-admin) a club or a private event. To invite someone you enter their email address. We use that address only for that invitation: to make a personal invitation link and to send them one email with that link through our email provider. If a co-admin invitation is not answered, we send up to two reminders to the same address, the day after and a week after, each with a way to decline; we stop as soon as it is answered. Anyone with the link can decline it, without an account. When you are signed in, we look up invitations sent to your own verified email address and show them to you. A co-admin invitation can only be accepted by an account with that same email address. Once the invitation is accepted, declined, withdrawn or 30 days old, we delete the address and keep only a one-way code of it (a hash) so we can tell that the invitation was sent. Other members of a club see members' first names only. A club's cover image is visible to its members, and to anyone with the club's link if the club is set to "anyone with the link".
If you answer one of your club's meetups (going or not going), the people running that meetup see your first name and your answer, the same as for any guest. If the meetup is full you go on its waitlist; when a place opens up, the person who has waited longest moves up and we email them to say so. If an organiser cancels an event or a meetup, we email everyone who had said yes or was on the waitlist. That email names the event and the organiser, never the other guests. If a club lets people ask to join and you ask, the club's admins see your first name and any note you write with your request, and we email them your first name and note so they know to look. We keep the request, including a declined one, so that the same person cannot keep asking; it is deleted with the club or with your account.
When a new meetup is posted in your club, and when the club's admins write a message to members, we email you (one email for several meetups posted at once). You can turn these emails off for each club with the switch on the club page; messages still show on the club page. A club can show a link to its group chat, which only members see, and its Instagram page, which anyone who can see the club sees.
Club members can suggest an event from our listings to their club, and say "I'm in" or "Not for me". The club's members see the suggestion, who suggested it (first name), and the first names of who is in. This commits nobody to anything; we do not sell tickets. Your likes and saves are never shown to other members.
A club's admins can start a friend calendar. Every Sunday evening we then email each member to ask which parts of the coming week they are free (morning, afternoon or evening of each day). You can answer from the email without signing in, using a personal link that only works for your own answer. In clubs of up to 15 members the other members see who is free when; in bigger clubs they see only how many. You can pause the weekly email for a club from the email or the club page, and if you leave three in a row unanswered we pause it for you. In a big club, admins can instead run a poll with a few proposed times, and members see how many can make each one.
Usage and analytics data (only with your consent)
If you accept analytics cookies, we collect information about how you use the Service — for example which pages, filters and events you view — together with standard technical data such as your browser type, device, and an approximate location derived from your IP address. This is collected through Google Analytics 4 (see Section 6). None of this is collected until you give consent, it never includes your name, email or account identifier, and you can withdraw consent at any time.
4. Cookies and similar technologies
We use a small number of cookies and browser-storage entries. You control the non-essential ones through our cookie banner.
| Type | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary | Keep you signed in (authentication session) and remember your cookie choice. | No — exempt under the ePrivacy rules |
Analytics (e.g. _ga, _ga_*) |
Help us understand how the Service is used so we can improve it. | Yes — set only after you accept |
You can review or change your choice at any time:
5. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account; providing the Service | Performance of a contract (Art. 6(1)(b)) |
| Personalised event recommendations | Performance of a contract / our legitimate interest in providing a useful service (Art. 6(1)(b)/(f)) |
| Emails about your account (confirming your address, resetting your password) | Performance of a contract (Art. 6(1)(b)) |
| Sending an invitation to a club or event that another user asked us to send you | Our and the inviting user's legitimate interest in letting people invite others to what they organise (Art. 6(1)(f)); the address is used for that one invitation only |
| Answering an invitation without an account (your name and email for that event) | Performance of a contract at your request (Art. 6(1)(b)): you ask to take part in the event |
| Marketing email (event tips and news) | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Investor updates | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Keeping a record of your marketing consent and its history | Our legal obligation to be able to demonstrate consent (Art. 6(1)(c) together with Art. 7(1)) |
| Analytics cookies and usage measurement | Your consent (Art. 6(1)(a)) and the ePrivacy rules |
| Security, fraud prevention and keeping the Service working | Our legitimate interest (Art. 6(1)(f)) |
6. Who we share data with
We do not sell your personal data and we never share individual user records or email addresses with third parties for their own marketing. We use the following service providers (“processors”) to run the Service. Each processes data on our instructions under a data processing agreement.
| Provider | Role | Notes |
|---|---|---|
| Supabase | Database, authentication and backend hosting | Stores your account, profile and activity data, within the European Union (Stockholm, Sweden region). |
| Netlify | Hosting / delivery of the website | Processes technical request data (e.g. IP) to serve the site. |
| Google (Tag Manager & Analytics 4) | Tag management and analytics | Analytics only, after consent, and without personal identifiers. May involve transfer to the USA. |
| MapTiler | Map tiles and geocoding | Processes technical request data to render maps. |
| Google Fonts & jsDelivr (CDN) | Delivery of fonts and code libraries | May log your IP address as part of serving these assets. |
| Resend | Email delivery | Sends our emails: invitations and confirmations for private events, invitations to join or co-admin a club or an event, a notice to our own team when a new account is created (your name, email address and how you signed up), up to two reminders about an unanswered co-admin invitation, a notice to guests when an event they said yes to is cancelled or its time or place changes, a private-event invitation to a guest whose address the organiser typed in, a notice to a waitlisted guest when a place opens up for them, a notice to a club's admins when someone asks to join (that person's first name and note), reminders before an event you said yes to, the friend calendar's weekly question to club members (your first name, the club's name and a personal answer link), messages the people running an event or club write to its guests or members, a notice to club members when a new meetup is posted, emails about your account (address confirmation and password reset), and investor updates to people who signed up for them. Processes the recipient’s email address, first name and the content of the email, for sending only. May involve transfer to the USA. |
| Customer.io | Marketing email | Sends marketing email, only to people who have opted in: event tips and news, including events picked for you from the events you have liked. Processes your email address, first name, an internal account number, the events picked for you, and whether each email was opened and its links clicked. Data is held in Customer.io’s EU region; Customer.io is a US company, so this may involve transfer to the USA. |
| OpenAI | Semantic search | When you type in the search box, your query text (not your account data) is sent to OpenAI to compute a search embedding. Used only to return matching events. |
| Mixpanel | Product analytics (via Google Tag Manager) | Anonymous usage events, only after you consent to analytics. No name, email or account identifier. May involve transfer to the USA. |
7. Transfers outside the EEA
Your account, profile and activity data are stored within the EU/EEA (Stockholm, Sweden). Some of our supporting providers (notably Google, for consented analytics, and Resend and Customer.io, for sending email) may process certain data in the United States. Where that happens, the transfer is protected by an appropriate legal mechanism such as the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
8. How long we keep your data
We keep your account and profile data for as long as your account exists. You can delete your account yourself at any time from your account page (“Delete my account”), which immediately removes your account, profile and activity and strips your name from any events you created or joined; you can also ask us and we will action it within 30 days. Contact details tied to a private event are kept for the life of that event so it can run, and removed with it. If you answered an invitation without an account, your name and email address are deleted 90 days after the event (or 90 days after it was created, if it never got a date), unless you made an account with that address first. An email address entered to invite someone to a club or to co-admin an event is deleted when the invitation is accepted, declined, withdrawn or 30 days old, whichever comes first; only a one-way hash of it is kept after that. An email address entered to invite a guest to a private event is deleted within a day of the invitation being used, declined, withdrawn, the event being cancelled, or the invitation turning 30 days old; no hash of it is kept. Messages written to an event's guests or a club's members are kept until they are deleted by the people running it, or with the event or club; if the writer deletes their account, the message stays but their name is removed. Friend calendar answers and the personal links in the weekly emails are deleted after 8 weeks; club suggestions and the "I'm in" answers are kept with the club and deleted with it, and an answer is deleted with your account. Events you saved without an account stay in your browser until you sign up, log in or clear your browser's site data. If you withdraw marketing consent, we stop sending marketing email straight away; the record of your consent and its history is kept for as long as your account exists, so we can show what you agreed to, and is deleted together with your account. An investor-updates sign-up is kept until you unsubscribe or ask us to delete it. Consented analytics data is retained in line with the retention period configured in Google Analytics 4 (up to 14 months).
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent for marketing email at any time, by unticking “Email from Händer” on your account page or by writing to us;
- withdraw consent for analytics at any time (via Cookie settings) — this does not affect processing done before you withdrew it.
To exercise any of these, contact us at privacy@vad-hander.com.
You also have the right to lodge a complaint with the Swedish supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), at imy.se.
10. Children
The Service is not directed at children under 13, and we do not knowingly collect the personal data of children under that age.
11. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you in the app.