Privacy notice

• Account: full name, email, password (stored hashed by Supabase Auth), role.
• Profile: bio, headline, avatar, cover image, portfolio pieces, rate cards. This is public. It's how clients find you.
• Contact: phone number, WhatsApp. These stay private until a job is funded, then become visible to the other party.
• ID documents: Creatives submit an ID image before payout. Stored in a private Supabase Storage bucket; only admins can see it.
• Payments: job amounts, PayChangu transaction references, payout method details (mobile money number or bank account) you save.
• Activity: jobs posted, proposals sent, messages, reviews, saves, page views on creative profiles.

• Run the marketplace (match clients with creatives, show profiles, deliver messages).
• Move money safely (escrow, payouts, dispute handling).
• Verify identity to reduce fraud and satisfy Malawian financial-services rules.
• Send you notifications about your jobs (in-app and by email).
• Fix bugs and improve the product.

• The other party on a job:once escrow is funded, both sides see each other's contact info.
• PayChangu:our payments partner. They handle collection, holding, and payout of MWK. They see the amounts and the payer/payee details needed to move the money.
• Supabase:our database and storage provider. Your data lives on their infrastructure.
• Resend:our email provider. They see the email address we send to and the message contents.
• Vercel:our hosting provider.

We don't sell your data to advertisers or data brokers, and we don't share it beyond what's needed to run the service, or when required by law.

Account and job data: for as long as your account exists, plus a reasonable period after (for records of past jobs, payouts, and disputes). ID documents: kept as long as you have an active payout history, deleted on request unless we need them for an open dispute or a legal requirement. Ask us to delete via the report form and we'll walk you through what can and can't be removed.

You can see and edit your profile and account settings any time in your dashboard. You can request a copy of your data, or ask us to delete your account, by contacting us through the report form.

Passwords are hashed by Supabase Auth (we never see your plaintext password). ID documents sit in a private storage bucket that isn't publicly reachable. Payments are handled by PayChangu. We never see your full card or bank credentials. That said, no online service is 100% secure. Use a strong, unique password.

We use a small number of cookies to keep you signed in, and Google Analytics to count how the site is used — which pages people reach, and where they stop. That sets its own cookies.

We turn off Google's advertising signals: we do not let it build an advertising profile from your visit, share your visit for ad targeting, or personalise ads to you. Your IP address is shortened before it is stored. We don't run third-party ad trackers.

If we change this policy in a material way we'll flag it in-app. The "Last updated" date at the top always reflects the current version.