Privacy Policy

The service is provided by Funkify AB, org. no. 559105-4084, Sweden — a Swedish company operating from Sweden. Contact us at support@funkify.se. For questions or requests about your personal data, contact the company directly; where applicable, you may also contact your state attorney general’s office.

Kvittla is a mobile-first web service that generates a co-signed digital receipt for private-party secondhand purchases. Both parties sign on their own phones and get the same PDF — and we only process the data needed to create that receipt and give it evidential value.

• The parties’ details: names (required), and optionally an ID number or EIN and address. Entered by the users themselves.
• The purchase details: date, price, description, location, payment reference.
• Attachments: screenshots or PDFs of the listing that you upload. These may contain the seller’s name, location and images.
• Signatures: a drawn signature per party, together with IP address, browser (user agent) and time of signing — the audit trail that gives the electronic signatures their evidential weight.
• Payment details: handled directly by Stripe. Kvittla only sees the Stripe session ID and whether the payment succeeded; we never receive or store card details.
• Cookie: one strictly necessary session cookie (kvittla_role_*) that keeps track of whether you are the seller or the buyer in the ongoing transaction. It contains no tracking or analytics parameters.
• Anonymous visitor statistics: we use Vercel Web Analytics to see page views and general trends. It sets no cookies, uses no local storage, and does not store your IP address — IP is processed only transiently to count unique visitors via a daily one-way hash that is rotated and discarded every day. We cannot identify you or follow you over time.

The session is stored temporarily in Upstash Redis and is deleted automatically:

• after 1 hour if the payment is never completed;
• after up to 14 days while the purchase is in progress (extended on every edit) — so both parties have time to sign;
• 24 hours after the receipt is complete, so both parties can download their copy.

We keep no backups and no history. When the session is gone, it’s gone — download your PDF before then.

Stripe retains payment information under its own terms and applicable financial regulations. Accounting records concerning Kvittla’s own revenue are kept for seven years under Swedish bookkeeping law.

We use the following providers to run the service. Each has its own agreements and security commitments toward us.

• Stripe Payments Europe Ltd.
  Payment processing (embedded Stripe checkout, receipt link).
  Ireland (EU). Some onward transfers to the US.
• Anthropic, PBC
  AI extraction of listing fields from an uploaded image or PDF (Claude model).
  USA. Retention up to 30 days under Anthropic’s terms.
• Vercel Inc.
  Hosting of the web service and edge/serverless functions, plus anonymous visitor statistics (Vercel Web Analytics — no cookies, no IP storage).
  USA / EU edge.
• Upstash Inc.
  Temporary session storage (Redis) while a purchase is in progress.
  EU region.
• FreeTSA
  RFC 3161 timestamping of the PDF hash (only the hash is sent — no personal data).
  Germany (EU).

Anthropic may, under its terms, retain submitted data for up to 30 days for abuse and safety purposes. The image or PDF you upload for AI extraction is therefore sent to Anthropic. If you’d rather avoid this, type the fields in manually instead of uploading a screenshot.

• We do not sell or share your personal data for advertising.
• We do not profile you and run no ad trackers.
• We do not send email or text messages — there are no addresses or phone numbers to collect.

You can ask us what data we hold about you, ask us to correct it, or ask us to delete it — contact support@funkify.se. Because Kvittla has no accounts and deletes sessions quickly, in practice we rarely hold any data at all. Depending on your state (for example under the California Consumer Privacy Act), you may have additional statutory rights; we honor such requests regardless of which state you live in.

The FTC publishes independent consumer privacy guidance at consumer.ftc.gov.

All traffic is encrypted (TLS). A session is reachable only via its randomly generated ID.

Material changes to this policy are published on this page. The date at the top is updated with every material change.