Privacy Policy

1. What we collect

• Account: full name, email, password (stored hashed by Supabase Auth), role.
• Profile: bio, headline, avatar, cover image, portfolio pieces, rate cards. This is public. It's how clients find you.
• Contact: phone number, WhatsApp. These stay private until a job is funded, then become visible to the other party.
• ID documents: Creatives submit an ID image before payout. Stored in a private Supabase Storage bucket; only admins can see it.
• Payments: job amounts, PayChangu transaction references, payout method details (mobile money number or bank account) you save.
• Activity: jobs posted, proposals sent, messages, reviews, saves, page views on creative profiles.

2. Why we collect it

• Run the marketplace (match clients with creatives, show profiles, deliver messages).
• Move money safely (escrow, payouts, dispute handling).
• Verify identity to reduce fraud and satisfy Malawian financial-services rules.
• Send you notifications about your jobs (in-app and by email).
• Fix bugs and improve the product.

3. Who we share it with

• The other party on a job:once escrow is funded, both sides see each other's contact info.
• PayChangu:our payments partner. They handle collection, holding, and payout of MWK. They see the amounts and the payer/payee details needed to move the money.
• Supabase:our database and storage provider. Your data lives on their infrastructure.
• Resend:our email provider. They see the email address we send to and the message contents.
• Vercel:our hosting provider.

We don't sell your datato advertisers or data brokers, and we don't share it beyond what's needed to run the service, or when required by law.

4. How long we keep it

Account and job data: for as long as your account exists, plus a reasonable period after (for records of past jobs, payouts, and disputes). ID documents: kept as long as you have an active payout history, deleted on request unless we need them for an open dispute or a legal requirement. Ask us to delete via the report form and we'll walk you through what can and can't be removed.

5. Your rights

You can see and edit your profile and account settings any time in your dashboard. You can request a copy of your data, or ask us to delete your account, by contacting us through the report form.

6. Security

Passwords are hashed by Supabase Auth (we never see your plaintext password). ID documents sit in a private storage bucket that isn't publicly reachable. Payments are handled by PayChangu. We never see your full card or bank credentials. That said, no online service is 100% secure. Use a strong, unique password.

7. Cookies

We use a small number of cookies to keep you signed in. We don't run third-party ad trackers.

8. Changes

If we change this policy in a material way we'll flag it in-app. The "Last updated" date at the top always reflects the current version.