Privacy

How Svift handles your personal data: what we collect, why, who gets to see it, and what you can demand.

In short

We use your data to pick up, repair and deliver your gear. If you say yes, we also use our own analytics to make booking better, and send you reminders and offers by email. We show no ads, use no cross-site tracking and never sell data on.

Who is responsible

Svift AS is the data controller for the data described on this page.

Svift ASReg. no.: 936 277 306Gamle Herregårdsvei 11, 1168 Oslo, Norwaysupport@svift.no

Questions about privacy, access or deletion go to this address.

What we collect

Everything we store either comes from you or arises when you use the service. We do not buy data about you from anyone.

The order: Name, email, phone, street address, postcode and housing type. Plus what the driver needs to find the gear: where it is kept, entry code, floor and any notes you add.
The gear: Category, brand, model, model year, serial or frame number, photos you upload, and your notes. The service history is built from the jobs that have been done.
The payment: Amount, payment status and a reference from the payment provider. If you save a card, we also store its brand, last four digits, expiry date, and when/for what scope you authorised its use. The card number and security code are handled entirely by Stripe and never reach us. If you pay with Vipps, we receive a payment reference and status from Vipps, but no card or account details.
Use of the service: A login cookie, and a log of the emails we have sent you. If you have said yes to analytics, what is described under “Our own analytics” comes in addition.
Logging in with Vipps: If you log in with Vipps, we receive what you agree to share in the Vipps app: name, email address, phone number and a permanent Vipps ID. We use it to log you in, or to create an account if you do not already have one, in which case we also store your name and phone number in your profile. We store the link between the Vipps ID and your account, and when you last logged in. You can disconnect Vipps on My page. The legal basis is our contract with you (Article 6(1)(b)).
Signing in with Google: If you sign in with Google, Google gives us your name, your email address, a link to your profile picture and a permanent Google ID. We use this to sign you in, or to create an account if you don't have one. We then also save your name in your profile. The link between your Google ID and your account is stored by our sign-in provider (Supabase). The legal basis is our contract with you (Article 6(1)(b)).
Approximate location: When you open the site, our hosting provider (Vercel) derives an approximate location from your IP address and passes us the city, region and coordinates as part of the request. We use it for one thing: to suggest which of our cities you are closest to, so you don't have to pick manually. We never receive the IP address itself at this step, we store neither the location nor the address, and the suggestion is not carried any further. If you answer the question, it is your answer, not your location, that is remembered in your browser.
Postcodes you check: When you enter a postcode to see whether we pick up there, on the front page, in the booking or under Delivery zones, we store the postcode, whether we cover it, and the time. It is stored on its own: without your IP address, name, email or anything else that ties it to you, and we do not link it to your order. We use it only as combined statistics on where there is demand and how many go on to book. This happens without consent because it is not about you as a person. The legal basis is legitimate interest (GDPR Article 6(1)(f)), and the lookups are deleted after 13 months.

Why, and on what legal basis

To deliver what you ordered: Pickup, the workshop job, delivery, updates along the way and customer service. The basis is our contract with you (GDPR article 6(1)(b)).
Because you said yes: Our own analytics, reminders and offers by email, offers and news as push notifications in the app, the copy of an unfinished booking and a message when we come to your area. The legal basis is your consent (Article 6(1)(a)). You can withdraw it at any time.
Because the law requires it: The purchase must be recorded in our accounts, and accounting records must be kept for as long as the Norwegian Bookkeeping Act requires. The basis is legal obligation (article 6(1)(c)).
To keep the service safe: Preventing abuse, debugging, making sure only you can see your own orders, and linking bookings from the same customer (see below). To stop misuse, we keep a coded version of your IP address, not the address itself, for at most 24 hours. The basis is legitimate interest (article 6(1)(f)).
The collective figures on the site: Order and equipment data is combined into anonymised figures about repair and reuse. The figures cannot be traced back to you, and are therefore no longer personal data.

Who gets to see it

Only those who must, and only what they need. We never sell data, and we do not share it for marketing.

The workshop: The workshop doing the job sees the gear, your description and what it needs to answer you on price and work.
The driver: The driver sees name, address, phone and the time of the pickup or delivery.
Our providers: Supabase (database, sign-in and files), Vercel (website hosting), Resend (email), Stripe (payment) and Google Firebase (push notifications in the app). They process data on our instructions, not for their own purposes.
Vipps MobilePay: If you pay or log in with Vipps, we exchange data with Vipps MobilePay AS: amount, order reference and phone number for payments, and for login what you agree to share in the Vipps app. Vipps MobilePay processes the data as an independent controller under its own terms and privacy policy.
Google: If you sign in with Google, we send you to Google for the sign-in itself, and Google tells us who you are. Google can then see that you are signing in to Svift. Google processes the data as an independent controller under its own terms and privacy policy.
The maps: The maps on the site fetch map tiles from CARTO. CARTO therefore sees your browser's IP address. The map stores nothing about you with us.
The valuation: When we estimate the second-hand value of your gear, we send category, brand, model and model year to a language model at Anthropic. Never name, address, photos or order history.

Some of these providers are established outside the EEA, or may process data there.

Our own analytics

If you say yes to “Analytics”, we record how the site is used: which pages you view, which website you came from (just the site's name), city and language, how far you get in the booking, what you choose, the price you are shown, whether you tap a button several times without anything happening, and which fields show an error, but never what you type in them. We also see whether you use a phone or a computer, from the screen width, and how far workshops get in the application form.

The events are held together by a random code that disappears when you close the tab. We do not store your IP address, your browser or who you are with them. The analytics are our own: they are stored with us, shared with no one and deleted after 13 months. If you say no, we record none of this.

When you answer the cookie question, we count the answer: only the number per day and language, not who answered. We do this when you say no as well.

If you have said yes and leave the booking, we may ask “What stopped you?”. The answer is stored without anything that points to you. If you choose “Other”, you can write a few words. Please don't include personal information there; we remove email addresses and phone numbers automatically. Answers are deleted after 13 months.

Reminders and offers by email

If you tick “Yes, send me reminders and offers from Svift by email”, we may send you reminders and offers. You can tick it when you create an account, when you book, when you ask us to tell you when we reach your area, and under Notifications on My page. You get updates about your order either way; they are part of the booking.

If you start a booking and don't finish it, we may send you one reminder, about a day later, with a link back to the booking.

So we can show that you said yes, we store the email address, when and where you said yes, which wording you saw, and the language. If you unsubscribe, we store when you did.

You unsubscribe with the link in every email, or under Notifications on My page. It takes effect immediately. If our emails don't get through, we stop sending.

Push notifications in the Svift app

If you allow notifications in the Svift app, we store a code that identifies your phone with the notification service (a push token), whether the phone is an iPhone or Android, which language the app uses, and when the app was last used. The code is linked to your account, so notifications arrive on the phones where you are signed in.

Notifications about your orders, for example that your equipment has been picked up or is on its way back, are part of the service you have ordered. The legal basis is our agreement with you (GDPR Article 6(1)(b)). You can turn them off under My page → Notifications, or in your phone's settings.

Offers, discount codes and news about new workshops and services in your city are only sent if you have ticked the box for them under My page → Notifications. This is marketing, and the legal basis is your consent (Article 6(1)(a), and section 15 of the Norwegian Marketing Control Act). We record when you said yes or no, and you can withdraw your consent at any time.

Notifications are sent through Firebase Cloud Messaging from Google. Google receives the phone's code and the content of the notification, and processes them on our instructions to deliver the notification.

The code is deleted when you sign out of the app, when you delete your account, when the notification service reports that the app has been removed from the phone, and at the latest when the app has not been used for 270 days.

Unfinished bookings

Your browser keeps an unfinished booking, so you don't lose what you have filled in. If you have said yes to reminders and offers, we also keep a copy with us, so the link in the reminder can bring it back. The copy holds what you have filled in so far, such as name, email, phone, address and what you want fixed. It is deleted at the latest 14 days after you last changed the booking. If you haven't said yes, we keep no copy.

When you book more than once

We link bookings that share an email address, or the same name and phone number, to the same customer. We use this only for statistics, such as how many people come back. The link is not used for advertising and is not shown to anyone else.

If you don't want us to link your bookings, you can object by writing to us. We will then leave your bookings out.

Tell me when you get here

If we don't pick up where you live yet, you can leave your email address. We store it with your postcode and use them only to tell you when we reach your area. On the site we only show how many people are waiting in an area, never who. This is not a yes to offers; you tick that separately.

Workshops that apply

When a workshop applies to become a partner, we store what is filled in: the workshop's name and organisation number, contact person, email, phone, what the workshop repairs and its prices. The application is saved along the way, so it can be finished later. If it is left unfinished, we may send one reminder by email with a link back.

If we invite a workshop, we store the name and email address we sent the invitation to. The basis is that we can enter into an agreement with the workshop (article 6(1)(b)).

Cookies

What the site needs in order to work is stored without asking: login, language, an unfinished booking and your cookie choice. The login cookies “svift_customer”, “svift_staff” and “svift.partner” last 30 days; “svift_vipps_login” exists only for the ten minutes a Vipps sign-in is in progress; Supabase's own login cookie is controlled by Supabase. Analytics is stored only if you say yes.

Your browser remembers the city you chose in “svift.city”. It is stored only once you pick or confirm a city yourself, holds just the city name and is not sent to us.

The full list, with names and durations, is on the cookie page.

Service-book links you share

You can create a public link to the service history for a single item, for example for a second-hand listing. The link shows only what was done and when, never name, address or price. It has an expiry date, and you can revoke it at any time from My page.

How long we keep it

Order data is kept for as long as you have an account with us, and after that for as long as the Bookkeeping Act requires for the purchase itself. Analytics and answers to “What stopped you?” are deleted after 13 months. The copy of an unfinished booking is deleted at the latest 14 days after the last change. Service-book links stop working on expiry or revocation. If you ask for deletion, we delete what we are not legally required to keep.

Proof that you said yes to reminders and offers: while the consent applies, and 3 years after you unsubscribe.
The email address you left for “tell me when you get here”: until we have told you, and at most 2 years.
Workshop applications: unfinished ones for 6 months, declined ones for 12 months. Accepted ones are kept under the partner agreement.
The coded IP address in the abuse protection: at most 24 hours.
Postcodes you have checked, with nothing that ties them to you: 13 months.
Phones registered for push notifications: until you sign out of the app or delete your account, and at the latest 270 days after the app was last used.

Your rights

You can demand access to what we hold about you, correction of anything wrong, deletion, restriction of processing, a copy of your data in a machine-readable format, and to object to processing we carry out on the basis of legitimate interest, such as linking bookings. If you have said yes to something, you can withdraw it at any time.

Write to support@svift.no. We answer as fast as we can, and within one month at the latest, as the law requires.

You can delete your account yourself under My page → Delete account. We then delete your login, profile, addresses, equipment, notification settings, phones registered for push and unfinished bookings, and your consent to offers is withdrawn. We keep orders and receipts for as long as the Norwegian Bookkeeping Act requires, unlinked from the account.

If you disagree with how we handle your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Changes

If we change how we process data, we update this page and the date below. If the change is significant, we say so by email.

Last updated October 2026.