Vavvo · Legal
Data & Permissions
Last updated September 19, 2026
A plain-language summary of the main categories of data Vavvo uses, why they are used, and the permissions the app may request.
1. How to read this page
This page is a plain-language inventory of data used by Vavvo. App Store and Google Play disclosures must match the production app and the actual providers enabled at launch, so they should be re-checked whenever Vavvo adds analytics, advertising, insurance, verification or support tooling.
2. Camera and photo library
Access is requested only when you choose to upload a profile photo, listing image, showcase post or claim evidence. Vavvo does not intentionally capture media in the background.
3. Location
Precise device location is used only when you choose a nearby-search feature and grant permission. Declining still allows city-based search. The exact device fix remains on-device for this flow; coordinates are rounded to coarse city-level precision before external reverse-geocoding or nearby-search requests. Exact venue addresses are kept private until the booking is paid and confirmed.
4. Identity verification
Vavvo uses a configured third-party identity provider, currently designed to support Veriff or Stripe Identity, to host the government-ID and selfie flow. The verification screen identifies the provider used for your session. Vavvo's app database does not copy or store the raw ID/selfie images. Hosts and guests see only verification status, not the underlying identity evidence.
5. Identity retention and deletion
Vavvo currently targets provider-side deletion or redaction of raw verification material 90 days after a successful check unless an active safety, fraud, dispute or legal obligation requires longer retention. Where the provider exposes a supported deletion API, Vavvo requests it automatically; otherwise Vavvo creates an internal privacy follow-up for provider-side handling. The verification screen offers direct deletion when the active provider integration supports it, or routes the request to support when it does not. A provider may still retain information it is legally entitled or required to retain independently. Vavvo keeps limited outcome and audit metadata for legitimate marketplace and legal purposes.
6. Biometric/selfie choice
Where consent or a non-biometric alternative is required by applicable law, Vavvo should offer or arrange an appropriate manual alternative instead of forcing selfie matching. The verification screen directs users to support if they cannot or do not wish to use selfie matching.
7. Messaging and booking records
Messages and required event details create a record of what the host and guest agreed. They are retained as reasonably necessary for the transaction, support, fraud prevention, disputes and legal obligations, and are not intended for advertising.
8. Analytics choices
Optional product analytics are off by default and can be enabled or disabled in Privacy settings. Vavvo keeps essential security, fraud-prevention and limited client-error diagnostics separate so disabling product analytics does not disable protections needed to operate the service safely.
9. Notifications
In-app alerts work through Vavvo's own notification records. When you explicitly enable Device alerts in a supported browser or installed PWA and Vavvo's production Web Push credentials are configured, Vavvo registers an opaque browser push endpoint and subscription keys. Background notification payloads are intentionally generic and link back into Vavvo. Disabling Device alerts removes the account's stored web-push registrations. Native iOS/Android background push remains disabled until production APNs/FCM credentials and signed store builds are connected.
10. AI support
When a signed-in member chooses Vavvo AI support, Vavvo may send the member's support question plus a limited summary of recent booking status, dates, totals, payment status and payout status to its AI service provider so the answer can be more relevant. The support assistant is designed not to receive stored card numbers, raw government-ID/selfie files or confirmed private venue addresses. AI answers can be wrong and cannot move money, cancel bookings or make moderation decisions.
11. International processing
Some providers may process personal information outside the user's country, including in the United States. Vavvo should maintain the contractual and legal transfer mechanisms required in the jurisdictions where it operates.
12. Deleting your data
Account deletion removes or de-identifies data that is no longer required. Certain transaction, booking, payout, fraud, audit and legal records may need to be retained for a limited period. Identity-provider data follows the separate verification retention process described above.
13. Age requirement
Vavvo is for adults 18 and over. You must be at least 18 to create an account, list a space or make a booking.