Privacy Policy

Howdydothis is the "data controller" for the personal data described here, meaning we decide why and how it is used. We are based in Ireland and process data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts.

You can contact us about your data at privacy@howdydothis.com

You give us directly:

• your email address, name, town or county and password (stored as a secure hash, never as plain text);
• the jobs you post, the service profile you create, and the note you send when you apply for a job;
• the messages you send and receive through Howdydothis, and the time they were sent and read;
• reports you file, and anything you tell us by email or in a support message.
• optional professional details, education, experience, skills, languages, portfolio photos, availability, service listings and qualification evidence that you upload.

Created automatically: sign-in records, basic device and browser information, and technical logs the platform needs to keep the site running and secure.

We do not collect payment details (we do not take payments yet), and we do not collect special categories of data such as health information, religious beliefs or political opinions. Please do not include those in your job descriptions, service profile or messages.

• To run your account and the features you use — creating your profile, showing your jobs, passing on your application, delivering messages. Basis: performance of a contract with you (GDPR Article 6(1)(b)).
• To keep the site safe and honest — checking reports, investigating abuse, preventing spam and repeated account misuse. Basis: legitimate interests (Article 6(1)(f)) — our interest, and your interest, in a marketplace people can trust.
• To tell you things you asked for — confirming your email address, password resets, message and job alerts. Basis: performance of a contract and, where needed, your consent (Article 6(1)(a)).
• To improve the site — understanding in general terms which features people use. Basis: legitimate interests. We use aggregate information wherever possible.
• To meet legal duties — responding to a valid legal request, keeping records required by law. Basis: legal obligation (Article 6(1)(c)).

We do not make decisions about you by automated means that have a legal or similarly serious effect, and we do not sell your personal data to anyone.

This is the part of our privacy setup you should understand clearly:

• Public: open job listings (title, description, location, budget, timing) and the service profiles people choose to publish. Your name and town or county appear next to a job you post or a service profile you publish, because members need to know who they are dealing with.
• Only the two of you: the contents of a private conversation. Other members cannot read it.
• Professional sections: optional sections and photos are public only when you publish them. Draft and paused service listings are private to their owner.
• Qualification evidence: documents are private to the provider and authorised administrators reviewing them. Published qualification details never include the certificate file. Replacing evidence or changing reviewed details resets verification.
• Only the job owner: who applied for their job, and the note you send.
• Only signed-in members: the basic list of member names and towns. This is a deliberate trade-off so people can contact providers directly, and we have flagged it for review before launch.
• Only our admin team: reports and their status, and the list of admin accounts.
• Nobody via the site: your email address is never shown to other members, and is only used to sign you in and to email you.

We share data only with the companies that help us run the site: the platform that hosts our database, authentication, file storage and email delivery, and tools that help us monitor errors and traffic. They process data on our instructions under written contracts and cannot use it for their own marketing.

We may also disclose data if we are legally required to, or to protect someone's rights or safety.

Some of our processors operate outside the European Union or European Economic Area. Where data leaves the EEA we rely on safeguards such as the EU Standard Contractual Clauses and supplementary technical and contractual measures. We are still listing exactly which processors and transfers apply — this must be completed and checked before launch.

• Account and profile data: while you have an account.
• Professional records and uploaded files: until you remove them or delete your account. Account deletion removes uploaded files first; if removal fails, your account remains available so you can retry.
• Jobs: until you delete or close them, then removed from public view. Applications stay with the job owner.
• Messages: while both participants keep their accounts.
• Reports: while needed to keep the site safe and to show we acted fairly — we are still setting the exact retention period and must fix it before launch.
• Technical and hosting logs: as set by our hosting provider, typically a short period.

When you delete your account we remove your personal data from the site. Some records may remain in backup copies until those backups roll over, in hosting logs, or where we must keep them for a legal reason — for example to deal with a report of serious misuse or a legal claim. We do not keep payment records because we do not take payments.

You can ask us at any time to:

• confirm what we hold about you and give you a copy (access);
• correct anything that is wrong (rectification);
• delete your data (erasure), subject to the exceptions above;
• pause or limit how we use it (restriction and objection, including to direct marketing);
• give you your data in a usable format so you can move it (portability);
• stop using anything you agreed to by consent, without affecting what happened before (withdrawal).

You can do most of this yourself in Account Settings, including deleting your account. For anything else — a copy of your data, a correction, deletion, or any other request about how we handle it — email privacy@howdydothis.com and we will reply within one month. You also have the right to complain to the Data Protection Commission (DPC), the Irish supervisory authority — and we would much prefer you came to us first.

We use access controls at the database level so members can only read their own data, only the two participants can read a conversation, and only our admin team can read reports. Passwords are stored as secure hashes and email addresses must be confirmed before an account is fully active. No system is perfectly secure, so please use a password you do not use elsewhere and tell us if you think your account has been used by someone else.

We use your browser's local storage to keep you signed in so you do not have to log in on every visit. That technical storage is strictly necessary for the service you asked for, so it does not need a consent banner. We do not use advertising or cross-site tracking cookies. If we add analytics or marketing tools, we will ask for your consent first and update this section.

Howdydothis is for adults aged 18 and over and is not aimed at children. If you believe a child has given us personal data, email privacy@howdydothis.com and we will remove it.

If we change this policy in a way that matters to you, we will tell you before the change takes effect and update the "last updated" date at the top of the page.