Privacy policy

The controller of your personal data is Vagabond Haven AB (organisation number 559251-⁠0118), Geijersgatan 46B, 752 26 Uppsala, Sweden. Phone +46 (0)18 25 88 99, email [email protected].

For anything about your data, write to that address. We answer within one month at the latest, as the GDPR requires.

Like every website, ours receives some technical data from your browser to show you the pages: your IP address, the page you asked for, the time, your browser and device type. Our host, Cloudflare (Cloudflare, Inc., USA), processes this on our behalf to deliver the site quickly and to protect it against attacks. We do not use it to identify you.

Fonts and the brochure viewer are served from our own website, so loading a page sends nothing to Google or other font and code services. Videos come from YouTube in its privacy-enhanced mode (youtube-nocookie.com) and only load when you press play; from then on YouTube (Google) receives your IP address and can store information in your browser.

Legal basis: our legitimate interest in a website that works, loads fast and is safe (Art. 6(1)⁠(f) GDPR); for a video, the fact that you asked to play it.

The site itself sets no tracking cookies. Without your consent it only keeps what is needed for things you ask for:

• vh-consent and vh-consent-date (your browser’s local storage): your choice in the cookie box, kept until you change it or clear your browser.
• vh-news-seen (local storage): only after you close the newsletter box, so we don’t show it to you again.
• vh-country (local storage): only after you choose a country at the bottom of the page or answer the language suggestion, so we remember your choice. To make that suggestion, the page asks our server which country your connection comes from; our host Cloudflare reads this from your IP address, and we do not store it.
• vh-catalog-open (local storage): only after you leave your email address to see the whole catalogue, so it stays open the next time you come back.
• vh-compare (session storage): only when you choose houses to compare, so the comparison page knows which ones you picked; deleted when you close the tab.
• The chat conversation (session storage): only while the browser tab is open, so the assistant remembers what you asked.

If you choose “Accept all”, we also count the pages you open during the visit (session storage, to time the newsletter box), remember the first page of the visit and any campaign tags in its address (session storage, vh-src, so that a message you send us shows how you found us) and load Google Analytics (cookies such as _ga and _ga_…, kept up to 2 years) and the Meta Pixel (cookies such as _fbp, kept up to 90 days); see Analytics and advertising. If you choose “Essential only”, none of these are loaded.

You can change your choice at any time with “Cookie settings” at the bottom of every page or the button below. If you withdraw your consent, we delete the analytics and advertising cookies from your browser. Legal basis: your consent (Art. 6(1)⁠(a) GDPR together with the national rules on storing information on your device, such as the Swedish Electronic Communications Act and the German TDDDG).

Our forms (contact, interest in a house, booking a viewing, financing, the plot check, the catalogue, the model guide and the chat when you ask the team to answer) send us what you type: usually your name, email, phone number if you give it, your country and your message, together with the page you were on, the time and the country your connection comes from (as our host Cloudflare sees it; we do not store it anywhere else). If the address you arrived on had campaign tags (for example from an ad), the form also sends those tags and the first page of your visit.

We use this to answer you, to prepare an offer and to arrange what you asked for. Legal basis: steps you asked for before a possible contract (Art. 6(1)⁠(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)⁠(f) GDPR).

Viewings. Most of our viewing houses belong to customers who kindly show them. When you book a viewing, we pass your name, contact details, preferred dates, number of people and message to the host of that house, so they can agree a time with you. They use them only for the viewing.

Giving us your details is voluntary and not required by law, but without a way to reach you we cannot answer, make an offer or book a viewing.

The messages reach our team by email, sent through Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France), and are kept in our company’s Google Workspace (Google). Each request is also stored in our customer system Retailerhub (Dream Crazy Big AB, Östra Bangatan 40, 703 39 Örebro, Sweden), so that our team can follow it up; Retailerhub processes it on our behalf. Where a page promises it, we also email you a copy or a summary (for example the plot check summary, the houses from the model guide or the catalogue as a PDF), likewise through Brevo. We keep an enquiry as long as we are in contact about it, and delete it at the latest 24 months after our last contact. If it leads to an order, see If you buy a house.

To help our team answer, Retailerhub can suggest a reply to your email with an AI model from OpenAI. For that one suggestion the model sees the email thread, your name, country, email address and order number; nothing is stored.

To keep spam out, our forms use Cloudflare Turnstile. When you start filling in a form, your browser contacts Cloudflare, which checks that a person and not a program is sending it. For this check Cloudflare sees your IP address and technical data about your browser and device; we receive only the result.

The assistant in the corner of the page answers with the help of Claude, an AI model by Anthropic (Anthropic PBC, USA). What you type, the page you are on and the site language are sent to Anthropic to produce the answer. Anthropic processes them on our behalf and, under its commercial terms, does not use them to train its models.

We save the questions asked in the chat, with the page, language and time, for about 13 months, to see what visitors want to know and to improve the site and the answers. The same applies to the answers given in the model guide (“Find my house”). These records contain no name or contact details unless you type them into a question, so please don’t write anything sensitive in the chat. If you ask the team to answer you personally, the conversation is sent to us like a form (see above).

Legal basis: our legitimate interest in answering questions quickly and improving our information (Art. 6(1)⁠(f) GDPR). Answers from the assistant can be wrong; anything binding comes from the team.

If you sign up, we use your email address to send you our newsletter: houses in stock, viewings and new models, once a month. Legal basis: your consent (Art. 6(1)⁠(a) GDPR).

You can unsubscribe at any time with the link in every newsletter or by writing to [email protected]. We then delete your address from the list. The newsletter is sent through Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France), which acts on our behalf and only for this purpose. You only join the list after you click the link in the confirmation email we send you. To be able to show your consent, we keep the date of that click, the page and language you signed up in and the country your connection came from.

If someone recommended us to you and you register through their link or QR code, we receive the details you enter together with their reference code. We use them to answer your enquiry and to know who recommended us, so we can pay them if you buy a house. The person who recommended us can see that someone registered under their code and how far it has come, but not your contact details or your messages. Legal basis: steps you asked for (Art. 6(1)⁠(b) GDPR) and our legitimate interest in running the programme (Art. 6(1)⁠(f) GDPR).

If you join as a referral partner, we keep your name, contact details, company details where relevant, your referrals and your acceptance of the terms, to run the programme and pay you (Art. 6(1)⁠(b) GDPR). To pay a fee we also need your bank details and, where tax law requires it, your personal identity or tax number; without them we cannot pay you. Payment records and invoices are accounting records, which we must keep as long as Swedish bookkeeping law requires (Art. 6(1)⁠(c) GDPR). More in the referral programme terms.

Only if you choose “Accept all” in the cookie box, we use:

• Google Analytics (Google Ireland Limited) to see how the site is used: which pages are visited, for how long, from which kind of device and roughly where in the world. Google processes this data on our behalf.
• Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) to measure whether our ads on Facebook and Instagram lead to visits, and to show our ads to people who have visited us. For collecting this data on our site and sending it to Meta, we and Meta are joint controllers (Art. 26 GDPR). Under our arrangement with Meta, we are responsible for asking for your consent and informing you, and Meta is responsible for how it processes the data afterwards, which it does as its own controller (see Meta’s privacy policy). You can exercise your rights with us or with Meta. When you have chosen “Accept all” and send us a form, our server also tells Meta that a request was sent (Meta Conversions API), so that Meta can count it even if your browser blocks the pixel. Your email address, phone number and name are only sent in scrambled (hashed) form, together with your IP address and browser type.

Both set cookies and may transfer data to the USA (see Who else receives data). Using your visits to show you ads is a form of profiling; it has no legal or similarly significant effect on you. Legal basis: your consent (Art. 6(1)⁠(a) GDPR), which you can withdraw at any time with “Cookie settings”.

Without cookies, for every visitor: Cloudflare Web Analytics (Cloudflare, Inc., our host) counts visits: which pages are opened, from which site you came, the type of browser and device, and the country. It uses no cookies and stores nothing on your device, and Cloudflare states that it does not use it to follow individuals. Legal basis: our legitimate interest in knowing how our site is used (Art. 6(1)⁠(f) GDPR).

For an order we need the details that go into the contract, the invoices and the delivery: names, addresses, contact details, the delivery site and payment information. Legal basis: the contract (Art. 6(1)⁠(b) GDPR) and our legal obligations (Art. 6(1)⁠(c) GDPR). Accounting records are kept for as long as Swedish bookkeeping law requires.

Some buttons take you to other websites, which have their own privacy policies: the price calculator (house-configurator.com, run by our sales platform provider), the virtual tours (k2virtualtours.com), our reviews on Trustpilot and Google, and our pages on Instagram, Facebook, Pinterest and YouTube. We only show the link; what happens there is governed by those sites.

We never sell your data. It is only seen by the people and companies that help us, and only as far as they need it:

• Cloudflare (hosting and security)
• Google (company email and documents, videos you play, and with your consent Google Analytics, and the referral programme's sheet for older referral links, through Google Apps Script)
• Anthropic (the chat assistant)
• Brevo (Sendinblue SAS, France: the emails from our forms and the newsletter)
• Retailerhub (Dream Crazy Big AB, Sweden: our customer system, where your requests are followed up; for us it uses Salesforge and Nylas (our emails), Resend (its own emails, such as quotes) and OpenAI (reply suggestions))
• Supabase (Supabase, Inc.: the form behind a partner's link on our home page, run for us by Dream Crazy Big AB, which passes your details to Retailerhub)
• Meta (only with your consent, the Meta Pixel)
• the host of a viewing house you book
• our accountants and authorities, where the law requires it

Cloudflare, Google, Anthropic, Meta, Supabase, Resend and OpenAI may process data in the USA or other countries outside the EU. Such transfers rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission’s standard contractual clauses (Art. 45 and 46 GDPR). Nylas processes data in the United Kingdom, for which the European Commission has adopted an adequacy decision. Retailerhub stores its data within the EU (Stockholm).

• Enquiries and viewing bookings: deleted at the latest 24 months after our last contact, unless they lead to an order.
• Chat questions and model guide answers: about 13 months.
• Newsletter: until you unsubscribe.
• Your cookie choice: until you change it or clear your browser.
• Contracts, invoices and payments (customers and referral partners): as long as Swedish bookkeeping law requires.
• Analytics and advertising cookies: see Cookies.

We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects (Art. 22 GDPR). The model guide only suggests houses that might suit your answers; the chat assistant only answers questions. Every offer and every contract comes from people in our team.

You have the right to know what data we hold about you and to get a copy, to have it corrected, to have it deleted, to restrict how we use it, to take it with you in a common format, and to object to processing based on our legitimate interest. You can always object to direct marketing, and withdraw any consent you have given, without affecting what happened before.

Write to [email protected]; you can also send a complaint to us there first, and we confirm that we have received it. If you are not happy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the data protection authority in your own country.

Switzerland: the Swiss Federal Act on Data Protection also applies. Your data is processed in Sweden and other EU/EEA countries, and by the services named above also in the USA; transfers to the USA rely on the Swiss–US Data Privacy Framework where the company is certified, or on standard contractual clauses. You can complain to the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

United Kingdom: the UK GDPR gives you the same rights as described above. You can complain to us first at [email protected], and to the Information Commissioner’s Office (ico.org.uk).

The whole site uses an encrypted connection (https). Only the people in our team who need your details to help you can see them. No connection over the internet is completely safe, so please don’t send passwords or bank details through our forms or the chat.

When the website or our services change, we update this page. The date at the top shows when it was last changed.