Privacy Policy

1. Scope and contact

This Policy explains how the TaskBody marketplace collects, uses, shares, and retains personal data. It applies to visitors, Clients, Professionals, and administrators using the Platform.

Privacy questions, rights requests, support matters, and moderation appeals use one contact address: support@taskbody.com.

2. Data we collect

2.1 Account and profile data

• name, email, password hash, phone number, country, district, language and communication preferences;
• biography or profile description, services, skills, service areas, rates, qualifications, languages, website, professional social links, profile photo, and project photos;
• account verification fields, legal-acceptance version and time, account status, moderation reasons, and security data.

2.2 Marketplace activity

• jobs, descriptions, categories, districts, addresses, budgets, photos and documents;
• quotes, availability, proposed dates, prices, and status;
• messages, conversation participation, notifications, reviews, and saved jobs;
• conduct reports, reported content, moderation actions, and audit information;
• credit balance, purchase intents, credit transactions, and job-unlock records.

2.3 Payments

Stripe processes card details for one-time credit purchases. TaskBody receives Checkout identifiers, payment status, currency, amount, package and credit metadata, and reconciliation events. TaskBody does not store full card numbers.

2.4 Technical data

The Platform processes IP addresses and proxy-provided country headers to select a browsing market and may request IP-derived country information from ipapi.co. It also records operational request information such as route, status, and duration. Session and interface-state cookies and local storage preferences are used as described below.

3. Data from sign-in providers

The Platform’s federated sign-in uses Replit OpenID. If you use that option, Replit provides an account identifier, email, name, and profile picture. An upstream identity choice shown during that flow may involve another provider, such as Google, but the Platform does not directly configure a separate Google OAuth client in the current implementation.

4. Why we use data

• create accounts, authenticate users, and enforce account restrictions;
• publish and match jobs and professional profiles;
• manage quotes, protected job access, messages, reviews, and notifications;
• sell, verify, and reconcile credits and prevent duplicate charges;
• send transactional email when the email service is configured;
• detect prohibited content, investigate reports, prevent fraud, and secure the Platform;
• support exports, deletion, privacy requests, disputes, accounting, and legal obligations;
• select country-specific content and translate job descriptions.

5. Legal bases

Depending on the activity, processing may rely on:

• contract: to provide requested Platform functions and paid credits;
• legitimate interests: marketplace operation, security, fraud prevention, support, and service improvement;
• consent: optional communications or optional technologies where consent is required;
• legal obligation: accounting, regulatory, law-enforcement, or court requirements;
• legal claims and safety: establishing, exercising, or defending claims and protecting users.

6. What other users can see

6.1 Clients and jobs

Public and locked job views may show the job title, description, category, country, district, budget, timing and frequency details, status, stable Client identifier, avatar, district, Client initials, and whether media exists. A Client’s exact address, original job photos and documents, unmasked phone number, and email are available only to the Client, authorized administrators, and a Professional who has unlocked that job. Locked Professionals may receive masked contact values and a deliberately blurred, obscured derivative of a job photo.

6.2 Professionals

Public professional profiles may show a stable profile identifier, display name, avatar, biography, country and district, services, skills, service areas, rates, qualifications, languages, ratings, reviews, completed-job count, marketplace badge, plan tier, project photos, and business website or professional social links.

Public professional APIs do not include direct email, phone, WhatsApp, authentication identifiers, private verification records, subscription/payment identifiers, promotion dates, credit information, moderation records, or account timestamps. When a visitor logs in with an active account, the Professional’s available email, phone number, and WhatsApp number become visible on that Professional’s profile. This logged-in access does not require a credit purchase, job unlock, conversation, or previous relationship. Professionals should only provide contact details they are comfortable sharing with all active logged-in users. Profile and project photos uploaded directly through the Platform are intentionally public and normalized before storage. A profile image received through federated sign-in may remain hosted at the URL supplied by the identity provider.

6.3 Reviews and communications

Reviews and ratings are public. Quotes and messages are restricted to authorized participants and applicable job relationships. Reported content is available to authorized moderation personnel.

7. Service providers

The current implementation uses or may use these providers:

• Replit: application hosting, proxying, Replit OpenID authentication, and managed object-storage access;
• Neon: PostgreSQL database and session storage;
• Google Cloud infrastructure: underlying object-storage API used through Replit-managed storage;
• Stripe: one-time credit Checkout and payment verification;
• Resend: transactional email and notifications when configured;
• ipapi.co: IP-derived country lookup when proxy country information is unavailable;
• OpenAI: job-text and biography moderation, and job-text translation, when the service is configured.

These providers receive only the data needed for the stated function. Their own policies and retention practices also apply.

8. Cookies, local storage, and analytics

Essential session cookies support authentication and security. A user-interface cookie can remember sidebar state. Local storage records the cookie-notice choice and other necessary browser-side account preferences.

The cookie notice offers an analytics preference, but the application may use Replit-hosted analytics after publication to measure aggregate page visits and product interactions. Optional analytics activates only when the user accepts analytics cookies. Search analytics records result outcomes, language, selected service, and the search surface, but never the free-form text entered into search.

9. International processing

Some providers may process data outside Cyprus or the European Economic Area. The repository does not itself establish a specific storage region or transfer mechanism. Applicable processor terms, locations, adequacy decisions, contractual safeguards, and transfer assessments must be confirmed as part of the required Cyprus/EU legal review before final publication.

10. Retention and account deletion

Data is kept while needed to operate the account and Platform and for security, disputes, accounting, fraud prevention, and legal obligations. Retention depends on the record type; the Platform does not apply one blanket period to all data.

Account deletion starts an immediate application-level cleanup: login credentials, contact and profile data are erased or reset; professional services, saved jobs, notifications and project photos are deleted; open jobs are deactivated and identifying job content and stored attachments are removed. Pending quotes submitted by a deleted Professional are cancelled and their free-text fields are erased. Pending quotes received by a deleted Client may remain as limited records tied to deactivated and anonymized jobs. The deleted user’s message content is replaced with a deletion marker, and review comments involving that user are erased.

Pseudonymized identifiers and limited quote, rating, transaction, credit, unlock, privacy-request, report, and moderation records may remain for accounting, marketplace integrity, security, disputes, fraud prevention, and legal obligations. Operational logs, processor records, and legacy objects without reliable ownership metadata follow separate controls and may require manual handling.

11. Your choices and rights

Subject to applicable law, you may have rights of access, correction, erasure, restriction, portability, objection, consent withdrawal, and complaint to a supervisory authority. Account controls provide a JSON data export, account deletion, and privacy-request forms for access, portability, restriction, objection, consent withdrawal, and other requests.

Submitting a consent-withdrawal request immediately disables the Platform’s newsletter preference. Cookie choices are controlled through the cookie notice in the browser. Some processing needed to provide the requested service or meet legal obligations does not rely on consent and is not ended by withdrawing consent.

Requests can be submitted through account controls or sent to support@taskbody.com. Responses will be handled within the time required by applicable law.

12. Account restrictions and appeals

TaskBody records warnings, suspensions, bans, reinstatements, reasons, and administrative audit data. Suspended and banned users are blocked from authenticated access, active connections may be terminated, and related marketplace content may be removed from public discovery. Affected users receive a notification and, when email is available, an email.

Appeals are currently submitted by email to support@taskbody.com; there is no in-app appeal workflow.

13. Security

Controls include HTTPS in normal hosted operation, password hashing, authenticated and role-based routes, owner-scoped object access, live account-status checks, upload decoding and normalization, and audit records for moderation. No system is completely secure, and users should protect their credentials.

14. Children

TaskBody is for users aged 18 or older. If personal data from a child is identified, contact support@taskbody.com so it can be reviewed and removed as appropriate.

15. Changes and complaints

The current effective date and version appear at the top of this page. Material changes may be notified on the Platform, by email, or through renewed acceptance where appropriate.

You may complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority. The official Cyprus authority website is dataprotection.gov.cy.