Privacy policy

1. Who is responsible for the data

The data controller is Needolo. For any question about your data, write to us at the platform's contact address.

2. What data we use

• Your account: name, email, password (stored only in encrypted form, we cannot read it), chosen language.
• Your profile, if you fill it in: photo, bio, phone, city, company, experience, areas, hours, certifications, prices and portfolio.
• Your listings: texts, photos, prices, city, salary and the other details you add.
• Messages and files sent in chat (including CVs sent for jobs).
• Orders, payments and refunds: amount, status, date. Card details go only to Stripe, not to us.
• Reviews given and received, favorites, "Notify me" alerts, reports and blocks.
• Phone notifications: the technical address of your device, only if you turn them on.
• Technical data: the servers hosting the site may briefly log your IP address and browser, for security. To stop spam and password guessing, we count attempts (sign-ins, new accounts) using an encrypted fingerprint of your IP address, not the address itself, and delete it within a day at most.

3. Why and on what legal basis

• To provide the platform (account, listings, messages, orders) — performance of a contract (Art. 6(1)(b) GDPR).
• Payments and their accounting records — legal obligation (Art. 6(1)(c)).
• Safety: preventing fraud and spam (including attempt limits), the automatic warning when a message asks for payment off the platform, handling reports, the log of administrator actions — legitimate interest (Art. 6(1)(f)).
• Emails about your account and orders — performance of a contract; new offer and new message notifications can be turned off in Account.
• Phone notifications — your consent, which you can withdraw at any time in Account or in your browser.

4. What is public

Your public profile (name, photo, bio, city, badges, reviews) and active listings can be seen by anyone and may appear on Google. Without an account, only the beginning of listings is shown and prices are hidden. Your phone is shown only to signed-in users and only if you chose to show it. Your email is never shown.

5. Who we share data with

We use providers that process data only on our instructions, to make the platform work:

• Vercel — hosting the site and files (photos, documents);
• Vercel Web Analytics — visitor statistics (page views and where visitors come from), without cookies and without identifying you;
• Neon — the database;
• Stripe — card payments;
• Stripe Identity — ID document checks, only if you choose to verify your account (Stripe receives the document and selfie; we only learn the result);
• Resend — sending emails;
• Google — only if you choose "Continue with Google";
• browser notification services (Google, Apple, Mozilla) — only if you turn on notifications.

Some providers are outside the European Economic Area (for example in the US). In those cases the transfer uses the safeguards required by the GDPR: the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We may also share data with authorities, only when the law requires it.

6. How long we keep it

• For as long as you have an account. Closed or expired listings stay in your account until you delete them or your account.
• When you delete your account, your identifying data is deleted or anonymized. Messages you sent stay with the other participant, without your name. Reviews stay without a name.
• Payment records are kept for as long as accounting law requires (usually 10 years).
• The log of administrator actions is kept for the safety of the platform.

7. Your rights

You have the right to know what data we hold about you, to correct it, to delete it, to restrict its use, to object to processing based on legitimate interest and to withdraw your consent. From Account → My data you can download all your data yourself (portability) and delete your account.

For any other request write to us at the platform's contact address; we reply within one month at most. If you believe we have breached your rights, you can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in your country.

8. Automated decisions

We do not make automated decisions with legal effects on you. The warning about off-platform payments and the order of listings are calculated automatically, but they do not block anything. Suspensions and disputes are always decided by a person.

9. Security

The connection to the site is encrypted (HTTPS), passwords are stored encrypted, and administrator access is limited by level and recorded in a log.

10. Minors

The platform is for people aged at least 18. If you find out that a minor has created an account, write to us and we will delete it.

11. Changes

If we change this policy, we update the date at the top, and we announce important changes on the site or by email.