Privacy, explained clearly.

This Policy applies to Customers, Handymen or other service providers, visitors, and people who contact us. It does not replace the privacy notices of independent users, Stripe, or other third parties that process information for their own purposes.

HandyConnect operates a marketplace. Customers and Handymen may independently decide how to use information they receive from each other in connection with a job. They are responsible for their own handling outside the Platform.

Depending on how you use the Platform, we collect:

• Identifiers and account data: name, email, phone number, account role, authentication and account-status records, profile photo, and internal user and processor identifiers. Supabase handles passwords and authentication tokens; we do not receive a readable copy of your password.
• Profile and professional data: biography, skills, service categories, service radius, availability, rates, work history, portfolio media, licenses, insurance, certifications, union affiliation, verification status, ratings, and reviews.
• Job, contract, and communication data: job descriptions, budgets, photos, addresses, timing, applications, bids, messages and attachments, contracts, change orders, signatures, schedules, completion records, cancellations, reports, disputes, support requests, and related notes.
• Location data:city, ZIP code, service area, job address, map pin, approximate public job location, and precise device coordinates only when you choose the browser’s “Use my location” control and grant permission.
• Payment and commercial data: invoice and transaction amounts, payment method type and last four digits when provided by Stripe, checkout, subscription, refund, dispute, fee, payout, tax-related, and Stripe account or session identifiers. Stripe, rather than HandyConnect, collects full card and bank details.
• Identity and sensitive data: government-ID and selfie verification status and evidence of consent. Stripe Identity collects the ID and selfie and may create facial measurements for matching. HandyConnect is not configured to download or store those images. See our Biometric Privacy Policy. Manual credential uploads, such as a trade license or insurance document, are decoded and re-encoded as metadata-free JPEG images, then stored separately for review. PDF uploads are not accepted.
• Device, network, and activity data: IP address, user agent, browser and device information, page path, referring origin, cookie or visitor identifiers, campaign parameters, clicks, session and error information, and privacy choices. Optional analytics and marketing data are collected only after the applicable choice.
• Communications preferences: email, notification, cookie, analytics, marketing, unsubscribe, and Global Privacy Control choices, along with records needed to honor them.

We disclose information as reasonably needed for the purposes above:

• Other users and the public. Profile, trust, review, portfolio, and approximate service or job information may be visible as designed. Job parties receive additional job, address, message, contract, scheduling, and payment context needed to complete the work. Do not place unnecessary sensitive information in public or shared fields.
• Infrastructure and operations vendors. Supabase provides authentication, databases, realtime services, and file storage; Vercel hosts the Platform; Resend delivers email; Twilio delivers SMS if enabled; and Sentry may receive minimized error telemetry if enabled. Optional browser telemetry is consent-gated; operational server error handling may run without optional cookies.
• Payment and identity providers.Stripe processes payments, subscriptions, connected payouts, fraud signals, and optional Identity sessions under Stripe’s applicable notices and terms.
• Maps and coarse location tools. Browsers request map tiles from CARTO using OpenStreetMap-derived data. A server-side ZIP lookup may send a ZIP code to Zippopotam.us when it is not available in our bundled lookup.
• Analytics and marketing providers. Vercel Analytics and Speed Insights operate only after analytics selection. Google Analytics or Ads and Meta Pixel operate only after marketing selection and remain off when Global Privacy Control applies.
• Professional, legal, and transaction recipients. We may disclose information to auditors, insurers, advisers, authorities, or transaction counterparties when reasonably necessary for a legal obligation, claim, investigation, financing, merger, acquisition, reorganization, or sale, with appropriate safeguards where required.

We do not sell personal information for money. Some laws use broader definitions of “sale,” “sharing,” or “targeted advertising” that may cover disclosures to Google or Meta after you enable marketing. You can prevent those disclosures through Privacy Choices or a recognized Global Privacy Control signal.

Essential cookies and local storage support authentication, security, payments, routing, preferences, and the record of your privacy choice. Analytics and marketing technologies are off by default until you choose them. Rejecting them does not block core marketplace features. See the Cookie Policy for current technologies and durations.

When the Platform detects a browser Global Privacy Control signal, it disables marketing technologies and campaign attribution for that browser and clears supported optional marketing data. GPC does not turn off essential storage or analytics you separately chose, and it must be enabled on each browser or device. You may revisit Privacy Choices at any time.

We keep personal information only as long as reasonably necessary for the purpose for which it was collected, subject to operational, contractual, tax, accounting, security, dispute, and legal obligations. Retention depends on the data and context:

• Account and profile data generally remain while the account is active, then are deleted or deidentified after an approved request unless a documented exception applies.
• Open job, message, schedule, media, support, and trust-and-safety records remain while needed to provide the service and resolve related issues.
• Signed contracts, invoices, payments, refunds, payouts, tax and accounting records, disputes, and legal evidence may be kept longer when required or reasonably necessary for those purposes.
• Consent, agreement, preference, suppression, security, and privacy-request records may be kept as needed to honor choices and demonstrate compliance.
• Optional visitor and marketing event records are minimized and retained only while useful for the selected measurement purpose; browser-cookie durations are listed in the Cookie Policy.
• Manual verification files and Stripe Identity data follow shorter, purpose-specific schedules. Our Biometric Privacy Policy controls biometric information.
• Deletion from active systems may not immediately remove data from security backups. Backup copies age out under protected rotation and are not restored for ordinary business use.

We may preserve narrowly scoped information when subject to a legal hold, open dispute, fraud or safety investigation, chargeback, or other documented legal requirement. When the exception ends, the ordinary retention decision resumes.

Depending on where you live and whether a law applies to HandyConnect or the particular processing, you may request access to or confirmation of processing; categories or specific pieces of information; sources, purposes, and recipients; correction; deletion; a portable copy; restriction or withdrawal of consent; or an opt-out from sale, sharing, targeted advertising, or qualifying profiling. You may also have a right to limit certain uses of sensitive information and to receive equal service without unlawful discrimination.

Submit a request through Privacy Choices while signed in, or email support@handyconnect.us. Describe the request and the account email involved. We may verify your identity and authority, request information reasonably necessary for verification, or deny or limit a request where permitted by law. An authorized agent may submit a request, but we may ask for signed permission and direct confirmation from the account holder.

If we deny a request, use the appeal option in Privacy Choices and include the original request ID, or email us with that ID and “Privacy appeal” in the subject. We will explain the result and any further regulator-contact option required by applicable law.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including encrypted transmission, authentication, access controls, restricted service credentials, database row-level controls, private storage for selected documents, monitoring, and incident-response procedures.

No system is completely secure. Protect your password, use a unique credential, do not send card numbers or identity documents through chat, and notify support@handyconnect.us if you suspect unauthorized account activity.