Privacy Policy

Data you provide yourself:

• account data: name, e-mail address, password (stored only as a cryptographic hash), role (client/contractor), city, phone, profile photo, interface language;
• contractor profile: company name, type (company/individual), description, services and keywords, work cities, contact details (phone, WhatsApp, Telegram), portfolio photos;
• verification data: company registration document or licence, name and registration number;
• operational data: requests, responses, estimates, reviews (rating, text, photos), favourites, payment history, notifications;
• messages: enquiries via the contact form and correspondence with support.

Data collected automatically:

• server logs: IP address, date and time of the request, browser and device type, requested pages - for security and diagnostics;
• browser localStorage data (see section 9).

Data from third parties: for online payments, the payment provider sends us the payment status. Full card details are not passed to us and are not stored by us.

• Providing the Platform's services - account, catalogue, requests and responses, paid features, payment history. Basis: performance of a contract (Art. 6(1)(b) GDPR).
• Semantic search - contractor profile texts are converted into vector representations to match the meaning of a query. Basis: performance of a contract and legitimate interest (Art. 6(1)(b), (f)).
• Service notifications - e-mail confirmation, password reset, notifications about responses and orders. Basis: performance of a contract.
• Browser push notifications - only after your explicit consent; you can withdraw it in your browser settings at any time. Basis: consent (Art. 6(1)(a)).
• Security and abuse prevention - logs, restriction of suspicious activity. Basis: legitimate interest (Art. 6(1)(f)).
• Tax and accounting records of payments. Basis: legal obligation (Art. 6(1)(c)).
• Improving the Platform based on aggregated, de-identified statistics. Basis: legitimate interest.

• A contractor's profile (name, photo, description, services, cities, rating, reviews, portfolio, badges) is visible to all visitors - without direct contact details.
• A contractor's contact details are shown to a client after paid unlocking, and to the profile owner.
• A client's request (title, description, city, budget) is visible in the jobs feed; the client's contact details are shared only with the contractor whose response is accepted.
• Reviews are published together with the author's name.

Please do not place data you do not want to make public in open text fields (descriptions, requests, reviews).

We engage service providers that process data on our behalf under a contract:

• hosting provider (server infrastructure);
• e-mail delivery service (service e-mails);
• browser push services (Google, Mozilla, Apple) - to deliver notifications you subscribed to;
• payment providers - to accept online payments;
• a text embedding provider - processes contractor profile texts (name, description, services, cities) without contact details.

We may disclose data where required by law: at the request of competent authorities, or to protect the rights of the Platform and its users. We do not sell personal data and do not share it with third parties for their own marketing.

We aim to store and process data within the European Economic Area (EEA).

If a particular provider processes data outside the EEA, the transfer is based on an adequacy decision of the European Commission or standard contractual clauses (SCCs) with additional safeguards where necessary.

• account and profile data - while the account is active; after deletion, data is erased or anonymised within 30 days, except data we must keep longer;
• payment records - for the period required by Cyprus tax and accounting legislation (generally 6 years);
• verification documents - while the badge is active, and for a reasonable period after revocation to resolve disputes;
• server logs - up to 12 months;
• backups - cyclically overwritten within a limited period.

We apply technical and organisational safeguards: encrypted connections (TLS/HTTPS), passwords stored only as hashes (bcrypt), access controls, data minimisation, infrastructure isolation and regular updates.

No method of transmission or storage is completely secure. If we become aware of an incident affecting your data, we will notify you and the supervisory authority in the cases and within the timeframes required by the GDPR.

Under the GDPR you have the right to:

• access your data and obtain a copy;
• rectify inaccurate data;
• erase data (the "right to be forgotten");
• restrict processing;
• receive your data in a structured, machine-readable format (portability);
• object to processing based on legitimate interest;
• withdraw consent at any time - without affecting the lawfulness of processing before withdrawal.

To exercise your rights, write to info@builders.cy. We will respond within one month (the period may be extended for complex requests, in which case we will inform you). We may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority - the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy) or the authority of your place of residence in the EU.

We do not use third-party advertising or analytics trackers. The site uses browser localStorage:

• buildcy_token - session token (account sign-in);
• buildcy_user - cached profile data for fast display;
• buildcy_lang - selected interface language;
• buildcy_install_dismissed - flag that the app install prompt was dismissed;
• buildcy_push_dismissed - flag that the push prompt was dismissed.

These entries are necessary for the service to work or store your preferences. You can remove them by clearing the site data in your browser; you will then need to sign in again.

The order of cards in the catalogue and search results is determined automatically - by relevance to the query, rating, badges and paid promotion (TOP cards are labelled).

We do not make decisions producing legal effects for you based solely on automated processing. Verification decisions are made by a human.

The Platform is not intended for persons under 18, and we do not knowingly collect their data. If you become aware that a child has provided us with data, write to info@builders.cy and we will delete it.

We may update this Policy. The current version with its update date is always published on this page. We will announce material changes on the site or by e-mail.

For any personal data matters: info@builders.cy. Supervisory authority: Office of the Commissioner for Personal Data Protection of the Republic of Cyprus - dataprotection.gov.cy.