Privacy Policy

Different categories of users have different data collected, depending on how they use the platform:

All users: name, email address, phone number, postcode, account credentials (stored hashed), login history, device and browser metadata, IP address, and basic usage data needed to operate the platform.

Customers: job postings (descriptions, photos, location), messages exchanged with Tradespeople, payment card details (stored by our payment processor, not by us), payment history, ratings and reviews you leave.

Tradespeople: business name, trades covered, bio, profile photo, compliance documents (Gas Safe, NICEIC, DBS, insurance, identity), live location data shared during active jobs, work photos, completed-job history, earnings records, bank details (stored by our payment processor for payouts, not by us).

Website visitors: basic analytics about which pages you visited, and any information you submit through contact forms. See the Cookies section below for details on what's stored on your device.

We process your data on the following bases under the UK GDPR:

• Contract performance: to provide the platform service you signed up for (matching, payments, messaging).
• Legitimate interests: to verify Tradespeople, prevent fraud, protect users from harm, and improve the platform.
• Legal obligation: to comply with tax, anti-money-laundering, and consumer protection law.
• Consent: for any optional marketing communications. You can withdraw consent at any time.

We use your data to: create and operate your account; match Customers to suitable Tradespeople; process payments and payouts; send transactional emails (job confirmations, completion receipts, dispute updates); verify Tradesperson credentials; show profiles, ratings, and reviews; provide customer support; detect and prevent fraud; comply with legal obligations.

We share data only with parties that need it to operate the service:

• The other party in a job: Customers and Tradespeople see each other's name, profile photo, postcode area (not full address until job acceptance), ratings, and messages exchanged about the job.
• Payment processor (Stripe): handles card payments, escrow, and payouts. Stripe is its own data controller for payment data and has its own privacy policy.
• Hosting and infrastructure providers: Supabase (database, authentication, file storage) and Vercel (web hosting). These act as data processors under our instructions.
• Email delivery (Resend): sends our transactional emails on our behalf.
• Verification partners: identity check, DBS, and trade certification verification services.
• Authorities: if required by law, court order, or to protect users from harm.

We do not sell your personal data. If in the future we use third-party analytics or advertising platforms (for example to understand how customers find us, or to reach new customers through targeted ads), we will update this policy and, where required by law, ask for your consent before any such tracking starts.

Some of our service providers (such as Vercel) store data outside the UK, including in the US. Where this happens, we rely on UK Government-approved transfer mechanisms (such as the UK International Data Transfer Agreement or adequacy decisions) to protect your data to UK standards.

We retain personal data only as long as we need it. Generally: account data is kept while the account is active and for 6 years after closure (to meet HMRC record-keeping rules); job records and messages are kept for 6 years; compliance documents are kept while the Tradesperson is active plus 1 year; live location data is deleted within 24 hours of job completion; analytics data is aggregated and anonymised after 14 months.

Under the UK GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; delete your data ("right to be forgotten", subject to legal retention obligations); restrict processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw consent at any time.

To exercise any of these rights, email us at hello@oncallfix.com. We will respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

We currently use only the essential cookies needed to keep you logged in and to remember your preferences. We may add analytics or advertising cookies in the future. When we do, we will show a cookie banner and ask for your consent first, in line with UK PECR and GDPR rules. Until then, no profiling or tracking cookies are set.

We protect your data using industry-standard measures: encryption in transit (HTTPS everywhere), encryption at rest (managed by our hosting providers), role-based access controls, audit logging on sensitive operations, and regular security reviews. Despite these measures, no online service can be guaranteed 100% secure. If we discover a personal data breach affecting you, we will notify you and the ICO within the time limits required by law.

The platform is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will remove the account.

We may update this policy from time to time. Material changes will be notified to active users by email at least 14 days before they take effect.

Lettly Limited, trading as OnCallFix. Registered in England & Wales.

Email: hello@oncallfix.com