Privacy Policy

Who We Are

HandFlow is a hyperlocal micro-task marketplace connecting clients in Oxford, UK with verified university students for small home jobs. We are the data controller responsible for your personal data collected through our platform. Our registered domain is handflow.co.uk.

HandFlow is currently operating as an early-stage platform ahead of formal business registration. ICO registration is in progress. If you have any data protection questions in the meantime, please contact us at handflow.general@gmail.com.

What Data We Collect

We collect and process the following categories of data:

• Identity Data: Name, profile photograph.
• Contact Data: Email address (including .ac.uk for Taskers), general location (Oxford postcode area).
• Task Data: Details about tasks created, accepted, and completed.
• Technical Data: IP address, browser type, device identifiers, essential cookies.
• Communication Data: Messages exchanged through the in-app chat.

How We Use Your Data

Your data is used to: register and manage your account, match you with appropriate Taskers or tasks, facilitate in-app communication, provide customer support, send task-related notifications, and improve platform functionality.

Lawful Basis for Processing

We process your data under Contractual Necessity (Article 6(1)(b) UK GDPR — to provide our platform services to you) and Recognised Legitimate Interest (Article 6(1)(f) — for marketplace security, fraud prevention, and service improvement). We do not rely on consent as a lawful basis for core platform functionalities.

Data Sharing

We share limited data with: hosting providers (Vercel, Supabase), email service providers (Resend), and AI processing (Google Gemini — for task parsing only). We share Tasker profile information (name, photo, rating, bio) with matched Clients, and vice versa. We do not sell your personal data to any third party.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements. When you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

Your Rights Under UK GDPR

Under UK GDPR, you have the right to: access your personal data, request correction of inaccurate data, request erasure of your data, object to processing based on legitimate interest, request restriction of processing, and data portability.

Cookies

HandFlow uses essential cookies only — required for authentication, session management, and platform security. We do not use advertising, tracking, or analytics cookies. For more details, see our Cookie Policy.

International Transfers

Our hosting infrastructure (Vercel, Supabase) is configured for the eu-west region. Where data is processed outside the UK, we ensure appropriate safeguards are in place, including UK adequacy decisions or Standard Contractual Clauses.

Children's Privacy

Our platform is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If we learn that we have collected personal data from a person under 18, we will delete it promptly.

Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated date. We will notify you of significant changes via email.

Contact Us & Data Protection