Privacy Policy

When you register: your name, email address, and mobile phone number. If you choose to verify your identity: a photo of your driving licence or passport, and a selfie taken on your phone, both of which are used only for a manual face and name check and deleted after admin review. We retain only a one-way hash of the document number. ID verification is optional. When you use the platform: job records, reviews you submit, reviews submitted about you, search lookups you perform, and notification activity. When you subscribe: your Stripe customer ID and subscription status. We do not store card details. Device and connection data: IP address and user agent, used for fraud detection. Searches on Find and taps on Call or Email buttons are recorded, with no name, to measure demand and improve the service.

Contract: to provide the WorkedWith service. Legitimate interest: to detect fraud, prevent fake reviews, and maintain platform integrity. Legal obligation: to comply with applicable law.

To operate your account and provide the platform. To verify your identity. To facilitate job logging and review submission. To send transactional emails. To detect and prevent fake reviews and abuse. To comply with our legal obligations.

When an account is closed, we retain a one-way hash of your verified phone number and ID document number if provided. These hashes are retained indefinitely under legitimate interest to prevent banned users from creating new accounts. Raw numbers and licence images are not retained after closure.

Reviews submitted about you are retained even if your account is closed, as they form part of another user's history. Your name on those reviews is anonymised on closure.

Supabase: database and authentication. Resend: transactional email. Twilio: SMS verification. Stripe: subscription billing. AWS Rekognition: automated image moderation for profile photos. Companies House API: business verification. If you are a client, signed in tradespeople can look up your WorkedWith profile using your username, email address or mobile number, and each lookup is logged. What they see depends on their plan, and your full name is never shown. We do not sell your data. We do not use your data for advertising.

Active account data: retained for the duration of your account. Review data: retained indefinitely, anonymised on account closure. Identity hashes: retained indefinitely for fraud prevention. ID document images and selfies: deleted after admin review. Insurance certificates you upload: seen only by WorkedWith admins, never shown to clients, and deleted when you replace them or 30 days after they run out. Proof you send about a declined job request (invoices, bank transfers, messages): shown only to WorkedWith admins and deleted 30 days after we decide. Search audit logs: retained for 12 months. Find search records: kept for 12 months, then reduced to weekly totals with no personal data. Network and browser hashes used to spot fake reviews: salted one way hashes recorded when you sign up, log or confirm a job and submit a review, used only to detect fake reviews, and deleted after 90 days.

Under UK GDPR you have the right to access, correct, or delete your personal data, object to processing, and data portability. Contact hello@workedwith.co.uk. We will respond within 30 days.

We use only essential session cookies required to operate the platform. We do not use tracking or advertising cookies.

We use encrypted connections, row-level security on all database tables, and access controls. Sensitive identifiers are stored as one-way hashes where possible.

Data controller: WorkedWith, hello@workedwith.co.uk. You have the right to complain to the Information Commissioner's Office at ico.org.uk.