Legal

Privacy Policy

Last updated: 4 July 2026

On this page

Plain language summary

We collect the information needed to run the Keikkio marketplace — your account details, job or quote information, and payment records via Stripe. We never sell your data. We share only what's necessary between homeowners and contractors, and with trusted processors like Supabase and Stripe. You can request a copy of your data, ask us to correct it, or ask us to delete it at any time. The full legal text follows below.

1. Data controller

The data controller responsible for your personal data is:

Keikkio Oy
Sturenkatu 26 LT 36, 00510 Helsinki
Finland
Y-tunnus: 3623902-1
Email: privacy@keikk.io

If you have any questions about how we handle your personal data, or wish to exercise your rights, you can contact us at privacy@keikk.io.

2. Personal data we collect

We collect the following categories of personal data depending on how you use the platform:

2.1 Account data

When you create an account: full name, email address, phone number, and your role (homeowner or contractor). This data is required to use the platform.

2.2 Profile data (contractors)

Company name, trade specialties, operating areas, years of experience, biography, certifications and insurance documents, portfolio photographs, and languages spoken.

2.3 Job data (homeowners)

Project descriptions, property location (city and postcode), budget range, timeline preferences, and any photographs you upload of the work to be done.

2.4 Transaction data

Payment method information is collected and processed directly by Stripe. Keikkio receives transaction records including amounts, dates, job references, and payment status — but does not store your card number, CVV, or full payment details.

2.5 Communication data

Messages sent between homeowners and contractors through the Keikkio platform, and any communications you send to our support team.

2.6 Technical data

IP address, browser type and version, device information, pages visited, time spent on pages, and referring URLs. This data is collected automatically when you use the platform.

2.7 Usage data

Information about how you use the platform, including jobs posted, quotes submitted, jobs accepted, and reviews given or received.

2.8 Blog notification data

If you sign up to be notified when we publish new blog content, we collect only your email address for this single purpose. This list is kept separate from your account data and is not used for any other form of marketing.

4. How we use your personal data

  • To create and maintain your account on the Keikkio platform.
  • To match homeowners with relevant contractors based on location and job category.
  • To process payments and manage escrow through Stripe.
  • To calculate and display contractor Reliability Scores.
  • To send transactional emails including job notifications, quote alerts, and payment confirmations.
  • To send a one-time notification email if you sign up for blog updates.
  • To resolve disputes between homeowners and contractors.
  • To verify contractor credentials and monitor compliance with platform standards.
  • To detect and prevent fraud, abuse, or violation of our Terms of Service.
  • To improve the platform based on usage patterns and feedback.
  • To comply with our legal obligations including tax and accounting requirements.

5. Who we share your data with

We do not sell your personal data. We share your data only in the following circumstances:

5.1 Between homeowners and contractors

When a contractor submits a quote on a job, the homeowner's first name and general location are shared with the contractor. Full contact details are only shared after the homeowner accepts a quote. Similarly, contractor profile information is publicly visible to all users.

5.2 Service providers (data processors)

We share data with the following trusted service providers who process it on our behalf:

  • Supabase (Supabase Inc.): Database hosting and authentication. Data is stored in the EU (Frankfurt, Germany).
  • Stripe (Stripe Payments Europe Ltd.): Payment processing, escrow management, and contractor bank account verification. Stripe is PCI DSS Level 1 certified.
  • Vercel (Vercel Inc.): Platform hosting and deployment. Vercel is SOC 2 Type II certified.

5.3 Legal requirements

We may disclose your data if required to do so by Finnish law, court order, or at the request of law enforcement or other governmental authorities.

5.4 Tilaajavastuu

With your consent during contractor onboarding, we may verify your contractor status through the Tilaajavastuu service operated by Vastuu Group Oy, which checks tax compliance, pension contributions, and other legal obligations.

6. International data transfers

Some of our service providers, including Vercel, operate infrastructure outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements, including Standard Contractual Clauses approved by the European Commission.

Supabase stores your primary data within the EU (Frankfurt, Germany). Stripe operates under EU Standard Contractual Clauses and is subject to EU data protection requirements through its EU entity, Stripe Payments Europe Ltd.

7. How long we keep your data

  • Account data: Retained for the duration of your account, plus 2 years after account deletion to handle any outstanding disputes or legal claims.
  • Job and transaction data: Retained for 7 years as required by Finnish accounting law (Kirjanpitolaki).
  • Payment records: Retained for 7 years in accordance with Finnish tax law.
  • Support communications: Retained for 3 years.
  • Technical logs: Retained for 90 days.
  • Blog notification emails: Retained until you unsubscribe or until we delete the list after publishing our planned content.

When you delete your account, your personal data is anonymised or deleted within 30 days, except where retention is required by law or for legitimate dispute resolution purposes.

8. Your rights under GDPR

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Article 15): You have the right to obtain a copy of the personal data we hold about you.
  • Right to rectification (Article 16): You have the right to correct inaccurate personal data we hold about you.
  • Right to erasure (Article 17): You have the right to request deletion of your personal data, subject to our legal obligations to retain certain data.
  • Right to restriction of processing (Article 18): You have the right to request that we restrict how we process your data in certain circumstances.
  • Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to object (Article 21): You have the right to object to processing based on our legitimate interests.
  • Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at privacy@keikk.io. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Cookies and tracking

Keikkio uses cookies and similar technologies to operate the platform, maintain your login session, and understand how the platform is used.

  • Essential cookies: Required for the platform to function, including session management and authentication. These cannot be disabled.
  • Analytics cookies: Help us understand how users interact with the platform so we can improve it. These are anonymised and do not identify individual users.
  • Payment cookies: Set by Stripe during payment processing for fraud prevention and security purposes.

You can control non-essential cookies through your browser settings. Disabling essential cookies will prevent you from using the platform.

10. Security measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

  • All data in transit is encrypted using TLS (HTTPS).
  • Database access is controlled by row-level security policies — users can only access their own data.
  • Passwords are never stored — authentication is managed by Supabase using industry-standard hashed tokens.
  • Payment data is handled exclusively by Stripe and never passes through Keikkio servers.
  • Access to production systems is restricted to authorised personnel only.

If you become aware of a security vulnerability or suspect your account has been compromised, please contact us immediately at security@keikk.io.

11. Children

Keikkio is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at privacy@keikk.io and we will delete the data promptly.

12. Right to lodge a complaint

If you believe we have processed your personal data in breach of applicable data protection law, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu):

Tietosuojavaltuutettu
PO Box 800, 00531 Helsinki, Finland
tietosuoja@om.fi
www.tietosuoja.fi

We would, however, appreciate the opportunity to address your concerns before you contact the supervisory authority. Please contact us first at privacy@keikk.io.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email and update the "last updated" date at the top of this page. Continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.

Contact us about privacy

For any questions or requests relating to this Privacy Policy or your personal data:

privacy@keikk.io