Donefy Services Privacy Policy
Effective date: [date] · Last updated: [date]
This Privacy Policy explains how [Donefy legal entity name] ("Donefy", "we", "us") collects, uses, discloses and protects personal information through the Donefy Services app for clients, the Donefy Pro app for providers, our websites and related services (together, the "Platform"). It also explains your privacy rights, including under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the Texas Data Privacy and Security Act ("TDPSA"), and New York law.
This policy does not cover how independent providers handle your information after you hire them; they are separate businesses responsible for their own practices, and they agree with us to use client information only to perform the project.
1. Information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | Name, email, phone, postal address, account ID, device identifiers, IP address | You; your device |
| Account and profile | Password (stored hashed), language, profile photo, business name, trades, service area, years of experience, bio | You |
| Project information | Project title and description, category, property address, budget, desired dates | You (clients) |
| Photos and video | Photos of your property and the work area, milestone photos, chat attachments, past-work photos | You; providers |
| Measurement data | Room and surface measurements, areas, counts and labels, captured manually or with your device camera and augmented-reality features. We store the resulting measurements and the photos you choose to upload, not camera feeds or 3D scans of your home | You; your device |
| Location | Project location (from the address you enter, converted to coordinates); provider base location; approximate location from IP. If you allow it, precise device location to fill in an address or show nearby projects | You; your device |
| Communications | Messages between clients and providers, messages with support, reviews | You; other users |
| Agreement and signature data | Signed Project Agreements, your typed name, signature image, time, IP address, device and browser details, document fingerprint (hash) | You; your device |
| Payment and payout information | Amounts, fees, refunds, last four digits and type of card or bank account, payout status, tax information (providers). Full card and bank account numbers are collected and stored by our payment processor, Stripe, not by Donefy. | You; our payment processor |
| Identity verification (providers) | Legal name, date of birth, government ID details and images, and, if used, a selfie compared to the ID. | You; identity verification provider |
| Background check information (providers) | Consumer reports from a consumer reporting agency, which may include criminal history, sex offender registry, motor vehicle records and identity information, only with your written authorization | Consumer reporting agency |
| License and insurance documents (providers) | License numbers, classifications, expiry dates, insurance certificates | You; public licensing databases |
| Usage and device data | Pages and screens viewed, features used, crash logs, app version, operating system, push notification token | Your device; analytics tools |
| Inferences | Ratings, badges (vetted, licensed, insured, top rated), fraud and safety risk signals | Derived by us |
Sensitive personal information. Some of the above is "sensitive" under the CCPA or TDPSA: account login credentials, government ID numbers, precise geolocation, criminal history in background checks, and any biometric data used for identity verification. We use sensitive personal information only for the purposes allowed by law (providing the services you request, security, fraud prevention, safety, and legal compliance) and, where required (including under the TDPSA for precise geolocation), only with your consent. We do not use it to infer characteristics about you.
Children. The Platform is not directed to children under 18 and we do not knowingly collect their personal information. If we later offer tutoring or other services involving minors, we will update this policy before doing so.
2. How we use information
- Provide the Platform: create accounts, post projects, match projects to providers by category and distance, show bids, enable messaging, generate and store Project Agreements, process payments, releases and refunds, and send notifications.
- Trust and safety: verify identity, run background checks (providers, with authorization), check licenses and insurance, apply licensing gates, mask contact details before hire, detect fraud, enforce our terms, and protect users and property.
- Disputes and support: review messages, photos, agreements and payment records to resolve change requests, disputes and chargebacks.
- Improve the Platform: analyze usage in aggregated or de-identified form, debug, and develop features.
- Communications: service messages; marketing, only where allowed and with an easy opt-out.
- Legal: comply with tax, accounting, licensing and consumer protection laws, respond to lawful requests, and establish or defend legal claims.
We do not use automated decision-making that produces legal or similarly significant effects without human review. Provider approval decisions based on background checks are made by a person following written criteria.
3. How we share information
We do not sell personal information for money. We describe below whether we "share" for cross-context behavioral advertising.
| Recipient | What | Why |
|---|---|---|
| Other users | Before hire: providers see your project details, photos, measurements, city, ZIP and approximate location (about 1 km), and your first name; clients see provider profiles, ratings, badges and reviews. Contact details in messages are masked until hire. After hire: the hired provider sees your full address and contact details; you see theirs | To make the marketplace work |
| Payment processor (Stripe) | Payment, payout, identity and tax information | To process payments, payouts and refunds, prevent fraud, and meet financial regulations. Stripe's use is governed by its own privacy policy |
| Consumer reporting agency | Provider identity information | Background checks, with authorization |
| Identity verification provider | Provider ID images and, if used, a selfie | Identity verification |
| Service providers (processors) | Cloud hosting, storage, email, SMS and push delivery, mapping and geocoding, analytics, customer support tools, e-signature support | To operate the Platform under contracts that restrict their use of the data |
| Professional advisors | As needed | Legal, accounting, insurance |
| Authorities and others | As required | To comply with law, subpoenas or court orders; to protect safety; to report suspected crimes; licensing board inquiries |
| Business transfers | All categories | In a merger, acquisition or sale of assets, under this policy |
Analytics and advertising. We use analytics tools to understand how the Platform is used. If we use advertising cookies or pixels that count as "sharing" for cross-context behavioral advertising under the CCPA, or "targeted advertising" under the TDPSA, we will disclose it here, provide a "Do Not Sell or Share My Personal Information" link, and honor Global Privacy Control (GPC) signals as an opt-out.
4. Photos, measurements and the inside of your home
Project photos and measurements are visible to providers who can see your project (approved providers in your market and category within their service radius). Remove people, documents, and identifying items (for example, family photos, mail, license plates) before you upload. We do not use photos of the inside of your home in advertising without your separate permission. Location data embedded in photo files (EXIF) is [stripped on upload].
5. Location
We use the project address to place your project on a map and match it to nearby providers. Providers' base location is used to compute distance. Before hire, providers see only an approximate location. If you allow precise device location, we use it only to suggest your address or show nearby projects and do not track your location in the background. You can turn off location permission in your device settings.
6. Background checks
Background checks on providers are obtained only after a standalone disclosure and written authorization under the federal Fair Credit Reporting Act and applicable state and local laws (see the Background Check Disclosure and Authorization). Reports are accessed only by trained staff who need them, are used only to decide eligibility under our written criteria, are not shared with clients (clients see only the "vetted" badge), and are retained as described in Section 8. Providers have the right to a copy of their report and to dispute its accuracy with the consumer reporting agency.
7. Data security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit, encryption at rest for stored files, signed and short-lived links for photos and documents, access controls and logging, and vendor due diligence, in line with the New York SHIELD Act's reasonable safeguards requirement (NY GBL 899-bb) and similar laws. No system is perfectly secure. If a data breach affects your information, we will notify you and regulators as required by law (including NY GBL 899-aa, Cal. Civ. Code 1798.82, Tex. Bus. & Com. Code 521.053 and O.C.G.A. 10-1-912).
8. Retention
We keep personal information only as long as needed for the purposes above, then delete or de-identify it. Typical periods:
| Data | Retention |
|---|---|
| Account and profile | While your account is open, then up to 2 years after closure |
| Projects, photos, measurements, messages | While your account is open; for completed projects, up to [4] years after completion (warranty and dispute period; CSLB complaints can be filed up to 4 years, latent defects longer) |
| Signed Project Agreements and signing records | [10] years after completion (latent defect claims, e.g. California 10-year statute) |
| Payment and tax records | 7 years |
| Background check reports | Only as long as needed for the decision and any dispute, and no longer than [5] years or as required by law; then securely destroyed (FTC Disposal Rule) |
| Identity verification images and any biometric data | Deleted within [30] days after verification is complete, and in any case within the period required by law (Texas: within one year after the purpose expires) |
| Security logs | Up to 1 year |
We may keep information longer where needed for a legal claim, investigation or legal hold.
9. Your choices
- Account: update your profile in the app; close your account in settings or by contacting us.
- Notifications: turn off push notifications in your device settings; unsubscribe from marketing emails using the link; reply STOP to SMS.
- Location and camera: control in your device settings.
10. Your privacy rights
Depending on where you live, you may have the right to:
- Know / access the personal information we hold about you and how we use and share it;
- Correct inaccurate information;
- Delete your information (subject to legal exceptions, for example records we must keep for tax or legal claims);
- Data portability (a copy in a usable format);
- Opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, and profiling with significant effects;
- Limit use of sensitive personal information (California), and consent / withdraw consent to processing of sensitive data (Texas);
- Appeal our decision on your request (Texas);
- Non-discrimination for exercising your rights.
How to make a request: in the app (Settings, Privacy), by email to [privacy email], or by toll-free number [number]. We will verify your identity by matching information we hold (for example, confirming a code sent to your account email or phone). You may use an authorized agent with written permission; we may ask you to verify your identity directly. We respond within 45 days (extendable once by 45 days where the law allows) and confirm receipt of California requests within 10 business days.
Texas appeals: if we decline your request, you may appeal by replying to our decision or emailing [privacy email] with "Appeal" in the subject within [60] days. We will respond within 60 days. If you are not satisfied, you may contact the Texas Attorney General at https://www.texasattorneygeneral.gov/consumer-protection.
California "Shine the Light": we do not share personal information with third parties for their own direct marketing.
Other states: Georgia and New York do not currently have comprehensive consumer privacy laws comparable to the CCPA or TDPSA, but we extend the access, correction and deletion rights above to all users.
11. CCPA notice at collection (California residents)
In the last 12 months we collected the categories in Section 1 (identifiers; customer records under Cal. Civ. Code 1798.80; commercial information; internet or network activity; geolocation; audio/visual (photos); professional information (providers); sensitive personal information as described; inferences) for the purposes in Section 2, and disclosed them for business purposes to the recipients in Section 3. We do not sell personal information and [do not / do] share it for cross-context behavioral advertising. Retention is described in Section 8. We do not knowingly sell or share the personal information of consumers under 16.
12. Biometric information
If our identity verification compares a selfie to an ID photo using facial geometry, we will obtain your express consent before collecting it, use it only for identity verification and fraud prevention, not sell or disclose it except to the verification provider, and destroy it within the period in Section 8. This is intended to meet the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code 503.001) and CCPA sensitive data rules.
13. International users
The Platform is intended for users in the United States. Information is stored and processed in the United States.
14. Changes
We will notify you of material changes by email or in the app before they take effect and update the "Last updated" date.
15. Contact
[Donefy legal entity name], Attn: Privacy, [mailing address], [privacy email], [toll-free number].
Sources to verify
- CCPA/CPRA statute and regulations (Cal. Civ. Code 1798.100 et seq.; 11 CCR 7000 et seq.), thresholds ($25M revenue as adjusted, 100,000 consumers, or 50% revenue from selling/sharing): verify: https://cppa.ca.gov/regulations/ · https://oag.ca.gov/privacy/ccpa
- Texas TDPSA (Tex. Bus. & Com. Code ch. 541; effective July 1, 2024; applies broadly with a small-business carve-out except for sale of sensitive data): verify: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Texas CUBI (biometrics), Tex. Bus. & Com. Code 503.001: verify: https://statutes.capitol.texas.gov/
- New York SHIELD Act (GBL 899-aa, 899-bb): verify: https://ag.ny.gov/resources/organizations/data-breach-reporting
- FTC Disposal Rule (16 CFR 682) for consumer report information: verify: https://www.ftc.gov/legal-library/browse/rules/disposal-consumer-report-information-records-rule