Privacy Policy
Last updated: 2026-08-18
1. Data controller
Aura Media AB, reg. no 559463-5863, Hebbes Gränd 13, 131 60 NACKA, is the data controller for personal data processed in the Domea service (formerly HusFokus). For privacy matters, contact us at dataskydd@domea.io.
2. What data we process
Domea is a B2B tool for estate agents and photographers. We process, among other things:
- Account data – name, email address, phone number, agency/office and role.
- Order data – property addresses, bookings, deliveries and billing details.
- Seller data – names and contact details of sellers entered by the agent.
- Seller billing identity – for seller-financed orders, also the Swedish personal identity number (personnummer) of a private seller, or a company registration number and company name, together with a billing address.
- Media – photos, floor plans, video and other material linked to orders.
- Technical data – sign-in, device, log and error-reporting data for security and operations.
- Push token – a device identifier issued by Apple or Google that is required to send notifications to your phone, together with platform and app version.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Providing and operating the service (accounts, bookings, deliveries) | Performance of a contract |
| Invoicing and accounting | Legal obligation (incl. the Swedish Bookkeeping Act) |
| Notifications and confirmations by email/SMS | Performance of a contract / legitimate interest |
| Support, security and troubleshooting | Legitimate interest |
| Secure identification of a private individual being invoiced (personnummer) | Legal obligation (Bookkeeping Act); Ch. 3 s. 10 of the Data Protection Act |
| Push notifications to the app on a mobile device | Performance of a contract / legitimate interest |
About personal identity numbers. Where an order is invoiced directly to a seller as a private individual, we process that seller's Swedish personal identity number (personnummer). It is used solely to identify the correct payer on the invoice and in the accounting records – never for profiling, marketing or search. Under Chapter 3, Section 10 of the Swedish Data Protection Act (2018:218), a personnummer may be processed without consent where this is clearly justified by the importance of secure identification, which is the case when invoicing a private individual. Where the order is invoiced to a company instead, we process a company registration number rather than a personnummer.
About push notifications. If you use the app on a mobile device and allow notifications, we register a push token issued by Apple (APNs) or Google (FCM), together with the platform and app version. The token is linked to your account and is used only to notify you about your orders and deliveries – we do not use push for marketing. You can turn notifications off at any time in your device settings, which stops the token working. It is deleted when you delete your account.
4. Recipients and processors
We share data with suppliers that process it on our behalf. A data processing agreement is in place with each:
| Supplier | Purpose |
|---|---|
| Supabase | Database and sign-in (account and order data) |
| Cloudflare | Storage and delivery of images and media (Images, R2) |
| Resend | Sending email (notifications, confirmations) |
| Fortnox | Invoicing and accounting |
| Vimeo | Hosting and playback of video |
| Google Maps | Maps and address lookup |
| Sentry | Error and operations monitoring |
| Apple (APNs) | Delivery of push notifications to iPhone and iPad |
| Google (FCM) | Delivery of push notifications to Android |
This list reflects the services the app uses today; it is updated as suppliers are added or removed.
5. Transfers outside the EU/EEA
Some of the suppliers above may process data outside the EU/EEA (e.g. in the USA). Where this happens, the transfer is protected by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework, together with supplementary safeguards.
6. Retention
We keep personal data for as long as your account is active and as long as needed to provide the service. Records covered by the Swedish Bookkeeping Act (e.g. billing records) are kept for seven years. After that, data is deleted or anonymised.
7. Your rights
You have the right to request access to, rectification or erasure of your data, to object to or request restriction of processing, and to data portability. Contact us at dataskydd@domea.io.
Deleting your account. You can erase your account yourself at any time, from Profile → Delete account in the app. This removes your name, phone number, profile photo and stored contact details, closes your login permanently, and revokes every connected calendar and cloud-storage authorisation. You are signed out immediately and the login cannot be restored.
Completed bookings, deliveries and billing records are not removed. The Swedish Bookkeeping Act requires them to be kept for seven years, and Article 17(3)(b) GDPR excepts exactly that retention from the right to erasure. They are kept without your personal details and are no longer linked to you by name.
8. Cookies and local storage
The service uses necessary cookies and local storage for sign-in, security and basic functionality. We do not use cookies for marketing or third-party tracking.
9. Complaints
You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
10. Changes
We may update this policy. The latest version is always available on this page.