Vavvo · Legal
Privacy Policy
Last updated September 19, 2026
This policy describes how Vavvo processes personal information and the controls built into the marketplace. It should be read with Data & Permissions and the Regional Addenda. Local privacy law may provide additional rights or requirements.
1. Scope and controller information
This policy explains how Vavvo handles personal information across its website and mobile apps. Privacy and data-rights requests can be sent to hello@vavvoapp.com. Before broad public launch, Vavvo must still publish the final contracting/controller legal entity, registered address and any locally required representative or data-protection officer details. Where local law gives you additional rights, those rights apply.
2. Information you provide
Vavvo may collect account and profile information, listing content, booking details, messages, reviews, support requests, reports, host business/trader information, payout/tax settings, privacy preferences and other information you choose to submit. Fields that are required for a transaction or legal obligation are identified in the relevant flow.
3. Identity verification and sensitive data
Guests may be required to verify before booking and hosts must verify before a listing can go live. Verification is performed by Vavvo’s configured provider, currently designed to support Veriff or Stripe Identity. Vavvo’s application database does not copy or store raw government-ID or selfie images. It stores the verification result, an opaque provider reference, consent/version metadata and limited audit information. Provider processing is governed by the provider’s own terms and privacy obligations.
4. Biometric or selfie-based verification
Where selfie matching or other biometric processing is used, Vavvo presents a specific notice and records the notice/consent version where consent is the applicable legal basis. Because biometric laws vary by jurisdiction, Vavvo’s market review evaluates whether consent, a different lawful basis, a non-biometric alternative, retention restriction or additional notice is required before enabling that market.
5. Payments, payouts and tax data
Full payment-card details are collected and stored by the payment provider rather than Vavvo’s app database. For payout rails, bank/SWIFT and account-holder information is sent to the relevant payout provider and Vavvo is designed to retain masked or reduced metadata after provider recipient creation where possible. Tax settings may include tax country, legal name, VAT/GST information and limited taxpayer-ID metadata; regulated providers may separately collect additional tax/KYC data.
6. Device, location and media permissions
Camera or photo access is requested when you choose to upload profile, listing, showcase or claim media. Precise device location is used only when you activate nearby search and grant permission. Vavvo is designed to keep the precise fix on-device for that flow and send only coarse location to external reverse-geocoding or nearby-search services. Exact venue addresses are kept private from ordinary public listing views.
7. Usage, security and diagnostics
Vavvo may process limited device, network, session, error and abuse-prevention data needed to secure accounts, prevent fraud, diagnose failures and maintain reliability. Optional product/funnel analytics are separate, are off by default, and run only when the member enables Product Analytics in Privacy settings. Vavvo’s legal-acceptance records intentionally use coarse client categories rather than device fingerprinting.
8. How Vavvo uses information
Vavvo uses personal information to create and secure accounts; operate profiles and listings; search spaces; process bookings, payments, refunds and payouts; verify identity; communicate about reservations; provide support; enforce policies; investigate safety/fraud reports; meet accounting, tax and regulatory duties; defend legal claims; and maintain reliability. Personalized recommendations and optional product analytics are separate controls, both off by default, and can be enabled without changing essential fraud or safety processing.
9. Legal bases
Depending on the jurisdiction and processing activity, Vavvo may rely on performance of a contract, steps requested before a contract, compliance with legal obligations, legitimate interests such as fraud prevention and marketplace security, consent, or another lawful basis recognized by local law. Vavvo’s country review is intended to document the appropriate basis for material processing before live launch.
10. Sharing between hosts and guests
Vavvo shares only information reasonably necessary for the marketplace relationship. Public profile/listing information is visible according to the relevant settings and marketplace rules. Business/trader information may be displayed where marketplace law requires it. Exact venue access information is released only through an authorized booking flow. Hosts and guests never receive the other party’s raw identity-verification evidence.
11. Service providers and processors
Vavvo uses providers for infrastructure, payments, payouts, identity verification, email, push notifications, geocoding, support, analytics/reliability and other operational services. Providers receive only information reasonably necessary for their service and are subject to their own legal duties plus Vavvo’s contractual controls where required. Vavvo’s launch controls separately track whether required data-processing agreements and assessments are complete.
12. AI-assisted support
If you choose AI-assisted support while signed in, Vavvo may send a limited summary of relevant booking status, dates, totals and payment/payout state with your question to the configured AI service. Full card numbers, raw identity documents/selfies and confirmed private venue addresses are excluded from that support context by design.
13. International transfers
Providers may process personal information outside your country. Before enabling a market that requires special transfer controls, Vavvo’s country review evaluates the lawful transfer mechanism and provider contract. Depending on the jurisdiction this can include adequacy decisions, standard contractual clauses, comparable-protection contractual requirements, transfer assessments, consent only where legally appropriate, or another mechanism allowed by law.
14. Retention
Vavvo retains personal information only for as long as reasonably necessary for the purpose collected and applicable legal obligations. Account/profile data is generally removed or de-identified after valid deletion requests except for records that must be kept for booking, payment, payout, accounting, tax, fraud, safety, disputes, legal claims or regulatory requirements. Retention periods are reviewed by data category and market.
15. Identity-data retention and deletion
Vavvo currently targets provider-side deletion or redaction of raw verification material 90 days after a successful check unless law, fraud, safety, dispute or legal-hold needs require longer retention. Where a provider exposes a supported deletion API Vavvo requests it automatically; otherwise an internal privacy-cleanup task is created. A provider may separately retain information where its own law or regulatory obligations require it.
16. Your privacy rights
Depending on where you live, you may have rights to access, know about, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, opt out of certain profiling or sale/share activity, complain to a regulator, or appeal certain privacy decisions. Vavvo provides in-product export, profile correction, privacy preferences and account-deletion tools and handles additional rights through support. Lawful verification and retention exceptions may apply.
17. Sale, sharing and advertising choices
Vavvo does not sell personal information for money. If Vavvo later uses advertising, cross-context behavioural advertising or another activity legally treated as a sale/share, it must update this policy, applicable store disclosures and the required opt-out mechanism before that processing begins. Where a legally recognized browser opt-out signal such as Global Privacy Control must be honored, Vavvo’s market implementation must support it before such processing is enabled.
18. Marketing communications
Transactional, security and legally required messages may be sent where necessary to operate the account or booking. Marketing messages are controlled separately and require the consent or other lawful basis required in the recipient’s jurisdiction. You can change available marketing preferences in Settings; essential account and booking notices cannot always be disabled.
19. Security and incident response
Vavvo uses access controls, provider-hosted sensitive-data flows, restricted backend functions, audit logging, encrypted transport and data minimisation. No system is completely secure. Vavvo maintains incident-response procedures and will assess, document and notify regulators or affected people when applicable breach law requires it.
20. Children
Vavvo is intended for adults aged 18 and over. A person under 18 may not create a Vavvo account, list a space or make a booking.
21. Automated decisions and marketplace moderation
Vavvo may use provider fraud, identity or risk signals to protect the marketplace. Provider evidence and Vavvo marketplace access are tracked separately so a provider result does not erase Vavvo’s audit trail. Where applicable law requires human review, an appeal, explanation or non-automated alternative, Vavvo’s regional compliance process must preserve that path.
22. Changes and contact
Vavvo may update this policy when data practices, providers or law change. The effective date is shown on this page and material changes may require renewed acknowledgement. Privacy, data-access, deletion, correction, identity-verification and complaint requests can be submitted through Vavvo support, the Privacy settings available in your account, or by email at hello@vavvoapp.com.