Privacy policy

Last updated 4 November 2026

How Nollby Service handles personal data: what we store and why, who else gets it, how long we keep it and what your rights are.

Who is responsible

Nollby Group OÜ runs Nollby Service. For some data we decide how and why it is used: there we are the controller. Other data we only handle for a business: there we are its processor.

The same company runs Nollby Mat and Nollby Taxi. This policy covers Nollby Service, and we don't use your Nollby Service data in those products.

Where we are the controller

• Accounts and sign-in, for clients and businesses.
• Businesses on Nollby Service: their pages, our checks and their plans.
• Search, reviews and reports.
• Security: bot checks, limits on requests and logs.

Where we handle data for a business

When you book or ask for a quote, the business is the controller of your booking: your details, the booking, your messages and photos, and any RUT or ROT details. The same goes for the business's client list. We handle this data for the business under our data processing agreement. Questions about it go to the business, and we help it answer.

What we store and why

• Your account: your email, and if you add them, your name, phone and language. To sign you in and show your bookings. Legal basis: our agreement with you.
• Bookings and quote requests: name, email, phone, address, the booking, messages and photos. The business needs them to do the job. We handle them for the business, as above.
• RUT and ROT: your personal identity number, and the property designation or your housing association's details. Only when you choose the deduction. Encrypted, shown only to the business you book, and every view is logged.
• Businesses: the owner's email and name, and the business's name, contact details, address, organisation number (for a sole trader that can be a personal identity number), F-tax, VAT number, staff names, services, opening hours and photos. To run the page and check the business. Legal basis: our agreement with the business, and our legitimate interest in a marketplace people can trust.
• Plans: the plan, its status and Stripe's references. Stripe holds the payment details. Legal basis: our agreement with the business.
• Reviews: the first name, rating and text, linked to the booking. To help others choose. Legal basis: legitimate interest.
• Reports about a business: what you write, and your email if you give it. To keep the marketplace safe. Legal basis: legitimate interest.
• Security: IP address and browser details for bot checks and limits on requests, logs of requests and errors, and a log of sensitive actions, such as who viewed a personal identity number. Legal basis: legitimate interest in keeping the service and your data safe.

We only send emails about your account, your bookings and, for businesses, the plan. No newsletters and no ads. We make no automated decisions about you that have legal or similarly significant effects.

Cookies and storage

We only use what the site needs to work: a sign-in cookie that lasts 30 days, a cookie that lasts 10 minutes during Google sign-in, and storage in your browser for your language and how far you got in sign-up. Cloudflare Turnstile checks that forms come from people. No analytics or advertising cookies.

Who else gets data

These providers handle personal data for us, and only what they need to run the service:

• Cloudflare Cloudflare, Inc. (United States)

  What for

  Runs the website, the app and the database, stores files and photos, checks that forms come from people (Turnstile), stops floods of requests and keeps logs.

  Data

  Everything stored in Nollby Service, and the IP address and browser details of each visit.

  Where

  The database and files are kept in the EU. Each visit passes the nearest Cloudflare data centre, and logs and bot checks can be handled outside the EU, including in the USA.

• Resend United States

  What for

  Sends our emails: sign-in codes, booking confirmations and reminders, quotes, and messages to businesses.

  Data

  The recipient's email address and what the email says, such as names, booking details and links.

  Where

  USA.

• Stripe Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States)

  What for

  Takes payment for businesses' plans, and takes online payments and makes refunds for bookings on the business's own Stripe account.

  Data

  For plans: the business's name, email and payment details. For bookings: the client's email, the service, the amount and a booking reference. Card details go straight to Stripe and never reach us.

  Where

  The EU (Ireland), with access from the USA.

Others get data in these cases, each responsible for its own handling:

• The business you book with gets your booking details.
• When you pay online you pay on Stripe's page, and Stripe handles the payment as the business's payment provider. If you pay with Klarna or Swish, they get the payment too.
• Google, if you choose to sign in with Google. We get your email and name from Google.
• OpenStreetMap: when a business enters its postcode, the browser looks up the place in OpenStreetMap's Nominatim service in the UK. It sends the postcode or town, and the browser's IP address.
• Search engines: when a business's public page changes, we tell them through IndexNow. Only the page's address is sent.
• Links you choose to open, such as Google Maps or Google Calendar from a booking, send what the link holds, such as the business's address or the booking's time, to that service.
• Authorities, when the law requires it.

We never sell personal data.

Transfers outside the EU and EEA

Our database and files are kept in the EU. Cloudflare, Resend and Stripe are US companies or have US parent companies, so data can be handled in or reached from the USA: Cloudflare's network and logs, Resend's emails and Stripe's systems.

For these transfers we rely on the EU–US Data Privacy Framework where the company is certified under it, and otherwise on the EU's standard contractual clauses in its data processing agreement. OpenStreetMap's service is in the UK, which the EU has found to protect personal data adequately. Email hej@nollby.com for a copy of the safeguards.

How long we keep data

• Sign-in codes and links work for 20 minutes and are deleted a day after they expire.
• A sign-in lasts 30 days. Signing out ends it at once, and expired sign-ins are deleted.
• Personal identity numbers and other RUT and ROT details are deleted automatically after 1 March the year after the booking.
• Your account stays until you delete it under My bookings. Then your profile is deleted, and your name, email, phone and street address are removed from your bookings and quote requests, along with booking notes. Your reviews stay without your name. The rest stays with the business for its records: a booking's service, time, price, postcode and town, and a quote request's description and photos. RUT and ROT details stay until their own deletion date. You can't delete an account that has upcoming bookings or runs a business.
• Business accounts, bookings, quote requests, client lists, reviews, reports and the log of sensitive actions are kept as long as the business's account exists. We don't delete them on a schedule. A business can erase a client itself, and you can ask us or the business to delete data sooner.
• Deleted data stays in the database's restore history for up to 30 days. Cloudflare keeps request logs for up to 7 days.
• Stripe and Resend keep their own records as their terms and the law require.

Your rights

You can ask to see the data we have about you, to correct or delete it, to restrict how we use it, and to get it in a file you can take elsewhere. Where we rely on legitimate interest, you can object at any time.

Under My bookings you can download your data and delete your account yourself. For anything else, email hej@nollby.com. We answer within a month.

For bookings and client lists we handle for a business, the business decides. We pass your request on and help it answer.

Complaints

If you think we handle your data wrongly, tell us first at hej@nollby.com. You can also complain to a data protection authority. As the company is in Estonia, our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). In Sweden you can turn to the Swedish Authority for Privacy Protection (IMY, www.imy.se), and anywhere in the EU to the authority where you live or work.

Changes

We update this policy when the service changes. The date at the top shows the latest version.