Private pilot
privacy notice.

Who is responsible

John Väisänen, Sweden, operating under the project name KARELIA LABS, is the data controller for this private pilot and its support correspondence.

For privacy questions or requests, email karelialabs@outlook.com. HourReserve and RefMatch are independent tools; this notice does not replace ServiceM8's own privacy policy.

Information used in the pilot

The apps obtain selected records from the connected ServiceM8 account and information submitted through their review forms. Synthetic business records still contain real account and staff identifiers.

• Account and access details: account and staff identifiers, account timezone, and the identity associated with an approval.
• HourReserve: selected client and job identifiers, client name, job reference and status, recorded activity dates and durations, staff identifiers, allowances, approval notes, corrections and saved receipts.
• RefMatch: the selected client's identity and job references, job status and existing PO references, CSV rows submitted for review, proposed references, approvals and saved outcomes.
• Support: your email address, message and any information you choose to include when contacting us.

Temporary ServiceM8 access tokens are used in memory during app requests. They are not saved in the apps' review or allowance records. The apps do not ask for your ServiceM8 password.

Purpose and legal basis

We use this information to test the requested hour-allowance and PO-review workflows, restrict access to the approved account, attribute approvals, inspect errors and answer pilot support requests.

For the limited personal information involved, our legal basis is legitimate interests under Article 6(1)(f) GDPR: developing and securing these tools using synthetic business records and responding to relevant enquiries. You may object using the contact details below. Authorising an app connection is not treated as consent to unrelated uses.

We do not sell pilot data, use it for advertising or cross-selling, or add analytics or advertising trackers to these help pages. The apps compare references and calculate balances; approvals require a user's action. This synthetic pilot does not make automated decisions about individuals with legal or similarly significant effects.

Where information is processed

• ServiceM8 provides the connected account, source records and native app execution. Approved RefMatch updates are written back to the selected ServiceM8 job. Read the ServiceM8 privacy policy and platform policy.
• Cloudflare hosts these help pages and the apps' request handling and stored review records. App records are separated by app and account. Read the Cloudflare privacy policy.
• Microsoft Outlook handles email sent to the project's support address. Read the Microsoft privacy statement.

The app code does not intentionally log complete request contents or temporary access tokens. Service providers may process connection, security and operational information under their own policies; visiting these pages can expose technical information such as your IP address to the hosting provider.

These providers operate internationally. Information may be processed outside the European Economic Area, including in the United States. We do not promise EEA-only storage. Verification of the contractual and international-transfer arrangements for a wider customer service is still outstanding; this notice does not claim that those checks have been completed.

Saved reviews do not disappear when a preview expires

Review, allowance, correction and receipt records are currently retained to check pilot outcomes and investigate problems. There is no automatic deletion schedule or fixed deletion date configured for this pilot; records remain stored until manually removed.

A preview's ten-minute approval window is not a deletion period. Expiry prevents a new approval under that preview; saved review and audit records remain. Uninstalling an add-on does not automatically erase its separately stored app records.

Complete export and permanent deletion of stored pilot records, including the treatment of provider copies, have not yet been fully verified. The same applies to a complete restore procedure. Do not rely on this pilot as the only copy of any important business record. These limits do not remove your data protection rights.

Support correspondence is used to handle the enquiry and follow-up. A final retention schedule for customer support has not yet been set; mailbox storage and deletion also depend on Microsoft's service.

Ask about your data or stop participating

Email karelialabs@outlook.com with the subject Private pilot privacy request. Say whether you want access, correction, deletion, restriction, an objection to processing, or to stop pilot access. Include only enough information to identify the account and request; do not send passwords or access tokens. Identity may need to be verified before information is disclosed.

Requests are handled directly by John Väisänen rather than through an automatic self-service tool. We will assess the request and explain the action taken or any applicable limitation. A request to stop access and a request to delete saved records are separate; ask for both if that is what you want.

Depending on the circumstances, GDPR rights include access, correction, erasure, restriction, objection and data portability. You can read IMY's explanation of your rights. You may complain to the Swedish Authority for Privacy Protection, IMY, or another competent supervisory authority, without first contacting us.

This is not a notice for a public customer product

Wider customer use requires a completed retention policy, a verified process for privacy requests and deletion, appropriate provider and transfer arrangements, and updated information for the actual customer service. Those checks are still in progress.

This notice describes the restricted pilot as it currently operates. It is not a statement of GDPR certification, marketplace approval or readiness to process customers' production records.

General guidance: European Commission — information for individuals.