Privacy Notice

DRAFT – not legal advice. This text must be reviewed by a qualified privacy professional before launch. Text in [square brackets] still needs to be filled in. 1. Who we are StudentTask Galway is run by [legal name of the business], [registered address]. We are the data controller for the personal data described here. You can contact us about privacy at [privacy email] or through the Support page. 2. What we collect Account details: your name, email address, password (stored only in a scrambled form by our login provider), whether you are a customer or a student, and your phone number if you add one. Profile information: your display name, photo, area, and for students your college, skills, services, rates, availability and bio. Student verification: the evidence of enrolment you upload, such as a student card or a letter from your college. These files are kept in private storage and can be opened only by administrators, through links that expire after a few minutes. Jobs: job descriptions, dates, budgets, photos and locations. Public profiles never show email addresses, phone numbers or home addresses. An exact job address is shared only with the student who is hired and with authorised support staff. Messages between users are private to the people in the conversation. Authorised support staff can also read them, for example to look into a reported problem, a dispute or a safety concern. Payments: the job price, commission, refunds and payouts. During the pilot these are simulated and no card details are collected. When live payments start, card and bank details will be handled by Stripe and we will not see your full card number. Reviews, reports, disputes and support requests you make or that are made about you. Settings and devices: your notification and marketing choices, and if you use the phone app and allow notifications, a device token from Google Firebase Cloud Messaging so we can send notifications to that phone. Waitlist: if you join the waitlist we keep your email address, whether you want help or want to earn, and the date. To stop repeated sign-ups we keep a scrambled (hashed) version of your IP address for a short time [confirm how long]. Security records: a log of administrator actions, and limited technical information such as hashed IP addresses used to limit abuse. 3. Why we use it and our legal basis To run your account, show your profile, post jobs, handle applications, offers, messages, payments and reviews: this is needed to provide the service you signed up for (contract). To keep people safe and the marketplace fair, including verification, investigating reports and disputes, preventing fraud and limiting abuse: our legitimate interest in a safe and trustworthy service. To keep payment and accounting records: legal obligation. To send phone notifications and marketing emails: your consent, which you can withdraw at any time in Account settings or your phone's settings. To contact you about the waitlist and the launch: your consent, which you can withdraw at any time by asking us to remove you. 4. Who we share it with Other users see your public profile, reviews and the job details needed to do a job, as described above. We do not sell personal data. We use service providers who process data for us under contract: - Supabase, which hosts our database, login and file storage in the West EU (Ireland) region. - Vercel, which hosts the website. - Google Firebase Cloud Messaging, which delivers phone notifications. - Stripe, which will process payments once live payments start. - Apple and Google, when you download the app from their stores. [Add an email provider once one is chosen.] We may share data with the Gardaí or other authorities where the law requires it or to protect someone's safety. 5. Transfers outside the EEA Our main database stays in Ireland. Some providers, such as Vercel and Google, may process data in other countries, including the United States. Where they do, we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. [Confirm for each provider.] 6. How long we keep it We keep your account information while your account is open. When you delete your account, we remove your contact details, profile text, photo, services and availability, withdraw your open applications and cancel your draft and open jobs, and your name is replaced with "Deleted user". Some records are kept after deletion because the law requires it or so the other person keeps their own history: transaction records (for [6] years, for tax and accounting), messages and reviews you exchanged with other users (shown as from "Deleted user"), reports and disputes, and the log of administrator actions. Verification documents are deleted [within 30 days of a decision / when the account is deleted]. Waitlist entries are deleted [12 months after launch] or sooner if you ask. [Retention periods to be confirmed.] 7. Your rights Under the GDPR you can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. You can download a copy of your data and delete your account yourself from Account settings. For anything else, contact us at [privacy email]. We will reply within one month. You also have the right to complain to the Data Protection Commission (www.dataprotection.ie), 21 Fitzwilliam Square South, Dublin 2. 8. Security We protect your data with access controls in the database, private storage for documents and photos, and encrypted connections. Only authorised administrators can see private information, and their actions are logged. 9. Children StudentTask is for people aged 18 and over. We do not knowingly collect data from children. 10. Cookies We use only the cookies needed to run the service. See the Cookie Notice for details. 11. Changes We will update this notice when how we use data changes, for example when live payments start, and tell you about important changes in the app or by email.