Privacy Policy

Data you provide yourself:

• account data: name, e-mail address, password (stored only as a cryptographic hash), role (client/contractor), city, phone, profile photo, interface language;
• contractor profile: company name, type (company/individual), description, services and keywords, work cities, contact details (phone, WhatsApp, Telegram), portfolio photos;
• verification data: company registration document or licence, name and registration number;
• operational data: requests, responses, estimates, reviews (rating, text, photos), favourites, payment history, notifications;
• moderation data: reports you send about requests or reviews (reason, comment) and the clients you have hidden from your feed;
• messages: enquiries via the contact form and correspondence with support.

Data collected automatically:

• server logs: IP address, date and time of the request, browser and device type, requested pages - for security and diagnostics;
• in the mobile app: the notification token of your device issued by Apple or Google, the device platform (iOS or Android) and the language of notifications - only if you allow notifications (see section 2);
• localStorage data in the browser and in the app (see section 9).

Photos and documents: the app asks for access to the camera or photo library only when you choose to add a photo (profile, portfolio, review) or a verification document, and receives only the files you select.

Data from third parties: for online payments, the payment provider (Stripe) sends us the payment status. Card details are entered in the Stripe payment form on the site or in the Stripe payment window in the app (including Apple Pay and Google Pay); full card details are not passed to us and are not stored by us.

• Providing the Platform's services - account, catalogue, requests and responses, paid features, payment history. Basis: performance of a contract (Art. 6(1)(b) GDPR).
• Semantic search - contractor profile texts are converted into vector representations to match the meaning of a query. Basis: performance of a contract and legitimate interest (Art. 6(1)(b), (f)).
• Service notifications - e-mail confirmation, password reset, notifications about responses and orders. Basis: performance of a contract.
• Push notifications in the browser and in the app (new requests, replies and orders) - only after your explicit consent; you can withdraw it at any time in the browser settings or in your phone settings for the app. Basis: consent (Art. 6(1)(a)).
• Moderation of user content - automatic masking of offensive words in public texts, handling of reports and blocking of abusive users. Basis: legitimate interest in a safe Platform and performance of a contract (Art. 6(1)(f), (b)).
• Security and abuse prevention - logs, restriction of suspicious activity. Basis: legitimate interest (Art. 6(1)(f)).
• Tax and accounting records of payments. Basis: legal obligation (Art. 6(1)(c)).
• Contractor profile statistics - profile views, contact opens and clicks on the phone number and WhatsApp, to show the contractor in their account how well their profile performs. Visitors are not identified: only the profile, the type of event and the time are recorded; to avoid counting repeat visits, a hash of the IP address and User-Agent is kept only in server memory and is not written to the database. Basis: legitimate interest (Art. 6(1)(f)).
• Improving the Platform based on aggregated, de-identified statistics. Basis: legitimate interest.

• A contractor's profile (name, photo, description, services, cities, rating, reviews, portfolio, badges) is visible to all visitors - without direct contact details.
• A contractor's contact details are shown to a client after paid unlocking, and to the profile owner.
• A client's request (title, description, city, budget) is visible in the jobs feed; the client's contact details are shared only with the contractor whose response is accepted.
• Reviews are published together with the author's name.

Please do not place data you do not want to make public in open text fields (descriptions, requests, reviews).

We engage service providers that process data on our behalf under a contract:

• hosting provider (server infrastructure);
• e-mail delivery service (service e-mails);
• Apple (Apple Push Notification service), Google (Firebase Cloud Messaging) and browser push services (Google, Mozilla, Apple) - to deliver notifications you have allowed; they receive the device token and the text of the notification;
• Stripe Payments Europe Ltd (Ireland) - to accept online payments on the site and in the app, including Apple Pay and Google Pay; Stripe receives your e-mail address and the payment details you enter;
• a text embedding provider - processes contractor profile texts (name, description, services, cities) without contact details.

The apps are distributed through the App Store (Apple) and Google Play (Google). Data about downloading and installing an app is processed by them as independent controllers under their own privacy policies.

We may disclose data where required by law: at the request of competent authorities, or to protect the rights of the Platform and its users. We do not sell personal data and do not share it with third parties for their own marketing.

We aim to store and process data within the European Economic Area (EEA).

If a particular provider processes data outside the EEA, the transfer is based on an adequacy decision of the European Commission or standard contractual clauses (SCCs) with additional safeguards where necessary.

In particular, Apple and Google (notification delivery) and Stripe (payments) may process data in the USA; such transfers rely on an adequacy decision of the European Commission or on standard contractual clauses.

• account and profile data - while the account is active; after deletion, data is erased or anonymised within 30 days, except data we must keep longer;
• payment records - for the period required by Cyprus tax and accounting legislation (generally 6 years);
• verification documents - while the badge is active, and for a reasonable period after revocation to resolve disputes;
• notification tokens - until you sign out of the app or delete the account, or until Apple or Google reports the token as invalid;
• reports and moderation decisions - up to 2 years, to deal with repeated violations;
• server logs - up to 12 months;
• backups - cyclically overwritten within a limited period.

We apply technical and organisational safeguards: encrypted connections (TLS/HTTPS), passwords stored only as hashes (bcrypt), access controls, data minimisation, infrastructure isolation and regular updates.

No method of transmission or storage is completely secure. If we become aware of an incident affecting your data, we will notify you and the supervisory authority in the cases and within the timeframes required by the GDPR.

Under the GDPR you have the right to:

• access your data and obtain a copy;
• rectify inaccurate data;
• erase data (the "right to be forgotten");
• restrict processing;
• receive your data in a structured, machine-readable format (portability);
• object to processing based on legitimate interest;
• withdraw consent at any time - without affecting the lawfulness of processing before withdrawal.

You can delete your account yourself at any time: in the app or on the site, Settings, the "Delete account" button. If you cannot sign in, follow the instructions at builders.cy/delete-account.

To exercise your rights, write to info@builders.cy. We will respond within one month (the period may be extended for complex requests, in which case we will inform you). We may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority - the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy) or the authority of your place of residence in the EU.

Analytics and advertising - only on the builders.cy website and only with your consent. The site uses Google Tag Manager, Google Analytics 4 and Meta Pixel (Meta Pixel is loaded through Google Tag Manager):

• purpose - visit statistics and measuring the performance of our advertising on Google and Meta;
• these services are off by default (Google Consent Mode v2) and are switched on only if you click "Accept" in the cookie banner; if you click "Decline" or make no choice, no analytics or advertising cookies are set;
• cookies: _ga and _ga_* (Google Analytics), _fbp and _fbc (Meta);
• data in Google Analytics is retained for 14 months;
• your name, phone number and e-mail address are not sent to these services; events contain only technical data, such as a builder profile ID or the city and category of a request;
• recipients: Google Ireland Ltd and Meta Platforms Ireland Ltd; data may be transferred to the USA under the EU-US Data Privacy Framework (an adequacy decision of the European Commission);
• basis: consent (Art. 6(1)(a) GDPR); you can withdraw it at any time via the "Cookie settings" link in the site footer - without affecting the lawfulness of processing before withdrawal;
• the BuildersCY mobile apps do not use analytics or advertising trackers.

Necessary entries. The site and the app use browser localStorage:

• buildcy_token - session token (account sign-in);
• buildcy_user - cached profile data for fast display;
• buildcy_cache:… - saved copies of the screens you have opened (for example, your orders with client contact details), so that they open instantly; removed when you sign out;
• buildcy_install_dismissed - flag that the app install prompt was dismissed;
• buildcy_push_dismissed - flag that the push prompt was dismissed;
• cookie_consent - your choice in the cookie banner (consent to analytics and advertising, or refusal);
• in the app: buildcy_app (the page is open in the app), buildcy_push_asked (we have already asked about notifications) and buildcy_push_device (the notification token of this phone, to unlink it when you sign out).

The selected interface language is stored in the buildcy_lang cookie.

These entries are necessary for the service to work or store your preferences. You can remove them by clearing the site data in your browser; you will then need to sign in again.

The order of cards in the catalogue and search results is determined automatically - by relevance to the query, rating, badges and paid promotion (TOP cards are labelled).

Texts that other users see (requests, reviews, responses, estimates, profile texts and names) are automatically checked against a list of offensive words, and such words are masked with asterisks. This does not prevent publication.

We do not make decisions producing legal effects for you based solely on automated processing. Verification decisions are made by a human.

The Platform is not intended for persons under 18, and we do not knowingly collect their data. If you become aware that a child has provided us with data, write to info@builders.cy and we will delete it.

We may update this Policy. The current version with its update date is always published on this page. We will announce material changes on the site or by e-mail.

For any personal data matters: info@builders.cy. Supervisory authority: Office of the Commissioner for Personal Data Protection of the Republic of Cyprus - dataprotection.gov.cy.