Privacy policy

Our principles

• Minimisation — we ask for the least data needed to run a safe marketplace.
• Purpose limitation — data collected for verification is not used for advertising.
• Consent-first — data processing and marketing consents are separate, recorded, and withdrawable.
• In-region storage — production data is stored in your country/region.

What we collect

Account & profile

Name, email, phone, hashed password, role, and (for providers) headline, skills, service area and rates.

Verification (KYC)

A government ID image, a selfie, and address proof, held in restricted storage and accessible only to trained reviewers via short-lived links. We retain only the last four digits of ID numbers. Approved documents are kept for the legal retention period; rejected documents are deleted within 30 days.

Jobs & bids

Job descriptions, photos, addresses, bids, messages between matched parties, agreements, ratings.

Technical

IP address, device/user-agent and timestamps for security, fraud prevention and the audit log.

What we do not do

• We do not sell personal data.
• We do not show your address or unmasked phone to providers before you accept a bid.
• We do not share employee identities with organisation admins beyond enrolment status.

Your rights

From Privacy & data in your account you can export everything we hold about you, withdraw consent, or request deletion. Deletion requests are honoured within 30 days except where records must be retained for legal, tax or dispute reasons.

Contact

Data protection: privacy@servlets.local.