Privacy Policy

This explains what we collect, why we collect it, who sees it and what you can do about it. We've tried to write it in plain English rather than the usual fog.

The short version

• We collect what we need to run a marketplace, and not much else.
• When you post a request, the professionals who unlock it see your name, email, phone number and the details of your job. That is the entire point of the service, but it's worth being clear about.
• We don't sell your data, and we don't serve advertising.
• Analytics only run if you say yes. We ask on your first visit and load nothing until you answer. You can change your mind from the footer at any time.
• You can ask us for a copy of your data, or ask us to delete it.

What we collect

When you create an account: your name, email address, password (stored only as a bcrypt hash — we never see it) and optionally your phone number.

If you're a professional: your business name, description, location and service areas, the categories you work in, portfolio photos you upload, and the verification documents you submit (business licence, insurance certificate, and any supporting documents you choose to send).

When you post a request: what you need done, where, your budget range and timeline.

As you use the site: messages you send through the platform, reviews you write, which profiles have been viewed, and basic technical information such as your IP address — which we use for rate limiting and abuse prevention.

If you buy credits or subscribe: payment is handled by Stripe. Card details go to Stripe, not to us. We keep a record of what was purchased and when.

Why we collect it

• To run the service — matching requests to professionals is the whole product.
• To let you and a professional communicate about a job.
• To send transactional email: confirmations, new leads, new messages, new reviews.
• To review verification documents and decide whether to grant a badge.
• To prevent fraud, spam and abuse.
• To understand what's working, using our own aggregate statistics.

Who sees your data

Professionals see your request details, and — once they spend a credit to unlock it — your name, email and phone number.

Customers see a professional's public profile: business name, description, location, categories, portfolio, ratings and reviews. Verification documents are never shown publicly; only our admin sees them.

Service providers we rely on: Resend for sending email, Stripe for payments, Cloudflare for network protection, Microsoft Clarity for site analytics (see below), and Vultr, where the server lives. Each sees only what it needs to do its job.

We may disclose data if the law requires it, or to protect someone's safety or our legal rights. We do not sell your personal data to anyone.

Analytics and session recording

We use Microsoft Clarity to understand how people use the site — which pages they visit, where they click, and where they get stuck. Clarity does this partly through session recording: a reconstruction of a visit, showing mouse movement, scrolling and clicks.

We run Clarity with masking switched on, so text you type into forms — your name, email, phone number, job details — is hidden from recordings rather than captured. We use this only to find and fix problems with the site. We don't use it to build a profile of you, and we don't sell or share the data for advertising.

None of this happens unless you allow it. On your first visit we ask, and Clarity is not loaded — no script, no cookie, nothing sent to Microsoft — until you choose “Allow”. Declining changes nothing about how the site works for you.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a decline and don't ask at all. Your browser has already answered.

You can change your mind whenever you like: the footer of every page shows whether analytics are on and lets you switch. Microsoft processes this data on our behalf under its own privacy terms, and you can also opt out globally at Microsoft's privacy dashboard.

Cookies

We use one essential cookie to keep you signed in. That one is required for the site to function, so it isn't something you can turn off.

If — and only if — you allow analytics, Microsoft Clarity sets its own cookies to recognise a returning visit and stitch a session together. We also store your answer to the analytics question in your browser, so we don't keep asking.

There is no advertising network on Gildcrew and nothing here follows you to other websites.

How long we keep things

• Account data: while your account is open, and up to 30 days after you close it.
• Requests, messages and reviews: kept as part of the record of the transaction.
• Verification documents: while the badge is active, and 12 months after it lapses.
• Email confirmation and password reset tokens: minutes to an hour, then deleted.
• Payment records: as long as tax and accounting law requires.
• Clarity analytics and session recordings: retained by Microsoft, currently 30 days.

Security

Traffic is encrypted in transit with TLS. Passwords are stored as bcrypt hashes. Email confirmation codes and password reset tokens are stored hashed, expire quickly and can only be used once. Access to the database and the admin panel is restricted.

No system is perfectly secure. If a breach affects your data, we'll tell you and the relevant authority as the law requires.

Your choices

Email us and we'll help you: get a copy of your data, correct something that's wrong, delete your account and personal data, or object to a particular use. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA — we apply these rights to everyone regardless.

Some things we can't simply erase: a review you left is part of another business's public record, and we keep transaction records the law requires us to hold. We'll explain if that applies.

Children

Gildcrew is for adults. We don't knowingly collect data from anyone under 18. If you believe we have, tell us and we'll delete it.

Changes

If we change this policy materially, we'll tell you by email or on the site before it takes effect.

Contact

Privacy questions or requests: [email protected]