Privacy Policy
Version 2.2 · Last updated: 12 September 2026 · Applies to get-handyman.com, the HandyMan Android app (package com.gethandyman.app) and the HandyMan iOS app (App Store id 6796590581).
We collect personal data from users of HandyMan. This page says exactly what we collect, why, who receives it, how long we keep it, and how you can access, correct, export or delete it.
We do not sell your personal data, do not use it for targeted advertising, and do not show third-party ads.
You can delete your account in any HandyMan app or on the website (Settings → Delete account), or by email. See Account and data deletion.
1. Who is responsible for your data
HandyMan is operated by Procode FZ-LLC, a Free Zone Limited Liability Company registered in the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates ("HandyMan", "we", "us"). Registered address: Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. We are the data controller for the personal data described in this policy.
Privacy contact: feedback@get-handyman.com. We answer privacy requests within 30 days.
2. What this policy covers
This policy covers the website get-handyman.com, the HandyMan Android and iOS apps, e-mail and push notifications we send, and support conversations with us (together, the "Service"). HandyMan is a marketplace: clients post jobs, independent professionals ("pros") make offers, and the two sides agree the work between themselves. Our Terms of Service govern the use of the Service.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, e-mail address, phone number, password (stored as a hash), role (client or pro), interface language, referral code, country and city chosen at sign-up, the fact and time you accepted the Terms and this policy. | You |
| Sign-in providers | If you sign in with Google or Apple: your name, e-mail address and an account identifier from that provider. Apple may give us a private relay e-mail instead of your real one. | Google, Apple |
| Phone verification | Your phone number and a one-time SMS code, processed by Firebase Authentication (Google) to confirm the number belongs to you. | You, Google |
| Pro profile (public) | Display name, photo, specialty, services and prices, bio, years of experience, city, working hours, portfolio photos, rating and reviews, and the work location you set on the map (latitude and longitude). Pro profiles are visible to anyone, including visitors who are not signed in. | You |
| Pro verification (optional) | Identity-document photo, selfie, certificates, verification status and reviewer notes. These are stored in a private storage area, are never public, and are seen only by our verification staff. | You |
| Jobs and service content | Job title, description, category, budget, preferred date, the job address and its coordinates, photos (up to 10) and videos (up to 3) you attach, offers from pros (price, arrival time, message), job status history, cancellation reasons, no-show reports. | You, the other party |
| Chat | Messages and photos exchanged with the other party of a job. When a pro is hired, the Service posts both parties' phone numbers into that job's chat so you can call each other. | You, the other party |
| Reviews and reports | Ratings, tags and comments after a job; reports you file about a user or content; users you block. | You |
| Location | Your device location, only when you tap a feature that needs it (centre the map, use my location for a job address, set my work location). We never collect your location silently or for advertising. The one continuous case is the live location a pro chooses to share while on the way to a job, and it is described in Section 7. The address you type is converted to coordinates (and back) by a geocoding service (see Providers). | Your device, with your permission |
| Live location (pros, during a job) | If you are a pro and switch on live location, your device's coordinates while you are on your way to a job you have taken — sent about every ten seconds, from the moment the client accepts your offer until the work begins, and to that one client only. It is off until you turn it on; we ask the first time you accept a job, and you can turn it off at any time. | Your device, with your consent |
| Notifications | A push-notification token for each device where you enabled notifications, the platform (web, Android, iOS) and your notification preference. | Your device |
| Diagnostics and usage (apps only) | Crash reports (device model, OS version, app version, the state of the app when it crashed) and usage events (which screens were opened, sign-up completed, job created, offer sent, pro hired), each tied to your HandyMan user ID. Collected by Firebase Crashlytics and Firebase Analytics in the Android and iOS apps. Not collected in the website. | Your device |
| Technical and security data | IP address, browser or app version, request time and outcome, in the logs of our hosting and infrastructure providers; a hashed IP and browser string with feedback form submissions; captcha signals from hCaptcha on sign-in and sign-up. | Your device |
| Country of your connection | The two-letter country your internet connection appears to come from, worked out by Cloudflare from your IP address. We use it to decide whether you can create an account and whether the Service is available where you are (see Section 6). The country you signed up from is kept on your account; the IP address itself is not stored. We do not use either to place you on a map or to target anything at you. | Cloudflare, from your IP address |
| Payments (pros, optional) | If a paid feature is offered and you buy it: the amount, date, the Stripe checkout session identifier and, if you connect a Stripe account for payouts, your Stripe account identifier and payout status. We never see or store card numbers; Stripe processes them. | You, Stripe |
| Support and feedback | Your e-mail address and the text of messages you send through the feedback form or by e-mail. | You |
| Guest jobs | If you post a job before signing up, we create a temporary guest account and store the job under it. Guest jobs are linked to your account when you sign up, or removed when they expire. | You |
We do not collect: contacts, calendar, microphone or audio, health data, precise background location, advertising identifiers (we remove the Android Advertising ID permission and do not use Apple's IDFA), or any data for behavioural advertising.
4. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis (UAE PDPL / GDPR-style) |
|---|---|---|
| Create and secure your account, sign you in, verify your phone | Account data, sign-in providers, phone verification, technical data | Performance of our contract with you (Terms); legal obligation (fraud prevention) |
| Run the marketplace: publish jobs to nearby pros, show pro profiles, deliver offers, chat, calls, reviews, no-show and cancellation handling | Jobs, pro profile, chat, reviews, location | Performance of our contract with you |
| Rank and match jobs and pros by distance, category and rating | Coordinates of jobs and pro work locations, rating | Performance of our contract; our legitimate interest in a useful marketplace |
| Send you notifications about jobs, offers, messages and reviews | Notification token, preferences, job data | Performance of our contract; you can turn push off at any time |
| Show you text in your language (machine translation, see Section 5) | Text of jobs, chat messages, reviews you ask to translate | Your request (consent) each time you tap "Translate" |
| Verify pros who ask for the Verified badge | Verification documents | Your explicit consent; you may withdraw it by withdrawing the request or deleting the documents through us |
| Keep the Service safe: detect bots, abuse, fake accounts and fake reviews; handle reports and blocks; enforce the Terms | Technical and security data, reports, chat, reviews, strikes | Our legitimate interest in protecting users; legal obligation |
| Fix crashes and understand how the apps are used | Diagnostics and usage | Our legitimate interest in a working product; you can opt out (Section 11) |
| Process optional paid features and payouts | Payment data | Performance of our contract; legal obligation (accounting) |
| Answer your questions and requests | Support and feedback | Your request; legal obligation (privacy rights) |
| Tell you about important changes to the Service or this policy | E-mail address | Legal obligation; legitimate interest |
| Decide whether you can create an account; whether the Service is available where you are connecting from; and, when a job's address cannot be located, whether the job may be posted | Country of your connection, kept on your account from sign-up | Our legitimate interest in operating only where we choose to; legal obligation where a restriction is required of us |
| Comply with law, respond to lawful requests, establish or defend legal claims | Any of the above, as required | Legal obligation; legitimate interest |
We do not use your data for marketing to third parties, for selling, or for building advertising profiles. We send marketing e-mail only if you subscribed and you can unsubscribe with one click in every such e-mail.
5. Automated processing, machine translation and AI
- Machine translation. When you tap "Translate" on a job, a chat message or a review, the text is sent to Google Cloud Translation, translated, and the result is cached by us to avoid re-translating the same text. Nothing is translated without your tap. Translation is automated and may be inaccurate; do not rely on it for safety-critical details.
- Notification wording is produced from fixed templates in your chosen language, not by AI.
- Ranking. The order of jobs shown to pros and of pros shown to clients is computed from distance, category, rating and recency. This does not produce legal or similarly significant effects on you, and a human (you) decides whom to hire.
- No AI chatbots. Chat on HandyMan is only between people. We do not operate an AI assistant, companion or support bot, and we do not use your content to train AI models. If we ever add an AI feature, we will say so clearly in the product and in this policy before it processes your data.
- No solely automated decisions that produce legal or similarly significant effects are made about you. Verification, reports and strikes are reviewed by a person before an account is restricted.
6. Where the Service is available
HandyMan operates in the United Arab Emirates and the United States. Three different things are checked against a country, and they do not use the same country.
Creating an account is checked against the country your internet connection appears to come from, when we can tell. The check has a couple of seconds to get an answer from our network provider. If none arrives, we fall back to the country of the city you entered — professionals are asked for one when they sign up. If neither is known, the sign-up is allowed. A VPN, a proxy or roaming can therefore refuse someone who is really in a country we serve, and can admit someone who is not.
Posting a job is checked against where the work is, not where you are. We take the country from the location of the address you give for the job; if there is none, from the country recorded on your account. Your connection plays no part in it, so you can post a job at your home address while travelling.
Offering to do work is checked against the country recorded for the professional, which also decides whether they appear in search results.
We keep the country your connection came from when you signed up. It is stored on your account, and afterwards it serves only as a fallback: when a job's address cannot be located on the map, the country on your account is used instead. We do not store your IP address itself. The one exception is the feedback form, where we keep a salted, irreversible fingerprint of the IP address to stop the form being flooded, and delete it after 24 months. Our hosting and network providers keep their own server logs, which do contain IP addresses, for their own retention periods: the database and its functions run on Supabase in Frankfurt, Germany, which keeps its server logs for 7 days, and the website is served through Cloudflare, which keeps its own logs for its own period.
A connection or an address can be attributed to the wrong country. If that happens to you, write to us and we will look at it.
We may also restrict a country outright, in which case the Service is unavailable from that country on the website and in the apps alike: the website answers with a notice instead, and requests from the apps are refused. Restricting a country restricts access; by itself it does not delete anyone's account or data, and the rights described in this policy — including asking for a copy of your data or asking us to delete it — are not affected by it.
7. Who else on HandyMan sees your data
- Pro profiles are public. Everything in the "Pro profile (public)" row above, including your rating, reviews and the work location you set, can be seen by anyone on the website and in the apps, and may appear in search engines. Set your work location to a district or street, not your home, if you prefer.
- Clients' jobs are shown to pros. While a job is open, signed-in pros can see its title, description, photos, address, coordinates, budget and your first name and photo. After you hire a pro, only that pro sees the job details and the chat.
- Reviews are public. Your display name, rating, tags and comment are shown on the profile of the person you reviewed.
- Phone numbers are shared only between the client and the hired pro of a specific job, inside that job's chat.
- Verification documents, chat and job videos are never public.
A pro's live location during a job
A pro can let the client watch them approach. This is off by default. The first time a pro accepts a job the app asks, and the pro can switch it on or off at any time afterwards in the settings.
When it is on, the pro's coordinates are sent about every ten seconds, but only in a narrow window: after the client has accepted the pro's offer and until the work begins. They are shown on a map to that one client, so they can see the pro on the way, and to no one else. The points are kept no longer than 24 hours and are then deleted automatically.
Before a pro is hired, a client searching for help sees up to ten of the nearest pros as dots at the work location set in each pro's profile — the same location shown in search — not their live position. Live location is never shared during search, and a pro who has switched it off is only ever shown at the work location from their profile.
8. Providers and other recipients of your data
We share personal data only with the providers below, who process it on our instructions under contracts that bind them to protect it at least as well as this policy does, and with authorities where the law requires. We do not sell or rent personal data to anyone.
| Recipient | What it does for us | Data it receives | Where |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, realtime chat, server functions, logs | All data in Section 3 | Frankfurt, Germany (EU) |
| Google LLC — Firebase Cloud Messaging | Delivers push notifications to Android, iOS and web | Notification token, notification title and text (which can contain a job title and a user's first name), app and device metadata | USA / global |
| Google LLC — Firebase Authentication | Sends the SMS code that verifies your phone number | Phone number, device signals used to block abuse | USA / global |
| Google LLC — Firebase Crashlytics and Firebase Analytics (apps only) | Crash reports and usage statistics | Diagnostics and usage data, your HandyMan user ID, device and OS model, app version, a Firebase installation ID. No advertising ID. | USA / global |
| Google LLC — Google Maps (website and Android), Google Sign-In | Shows maps; optional sign-in | Map interactions, IP address, device metadata; for sign-in: your Google account name and e-mail | USA / global |
| Google LLC — Cloud Translation | Machine translation on request | The text you asked to translate and the target language. No user identifier. | USA / global |
| Apple Inc. (iOS app) | Sign in with Apple, Apple Maps and geocoding, App Store, push delivery (APNs) | For sign-in: name and e-mail (or relay address); for maps: coordinates and addresses you look up; for push: device token | USA / global |
| Komoot GmbH — Photon (website) | Address suggestions and reverse geocoding on OpenStreetMap data | The address text you type or the coordinates you selected, your IP address | Germany (EU) |
| Intuition Machines, Inc. — hCaptcha | Blocks bots on sign-in, sign-up and forms | IP address, browser and device characteristics, interaction signals | USA / global |
| Stripe, Inc. | Payment for optional paid features; payouts to pros who connect a Stripe account | Amount, e-mail address, Stripe identifiers; card data goes directly to Stripe | USA / EU |
| Cloudflare, Inc. | Hosts and protects the website | IP address, request logs | Global edge network |
| Resend, Inc. | Sends our e-mails (feedback, account e-mails) | E-mail address, message content | USA |
| Telegram Messenger Inc. | Delivers internal operational alerts to our own team (new sign-ups, new jobs and offers) so we can react to problems quickly | Event type, time, first name, country, job title, category, budget and the city of the job. These alerts carry no e-mail address and no street address, and are visible only to HandyMan staff. | Global |
| Unsplash, Inc. | Hosts illustration photos on the home page | Your IP address, as any image host does | USA |
| Professional advisers, successors | Lawyers, accountants; a buyer if HandyMan is sold or merged | Only what is necessary, under confidentiality | — |
| Authorities | Courts, regulators, law enforcement, when legally required or to protect someone's safety | Only what is required | — |
Location data in the Service is built on GeoNames data, licensed under CC BY 4.0. Map data on the website comes from OpenStreetMap contributors and Google.
9. International transfers
Your data is stored in the European Union (Germany) and is processed by the providers above in the United States and other countries. Those countries may not have data-protection laws equivalent to those of your country. We protect transfers with contractual safeguards (the providers' data-processing agreements, including standard contractual clauses where the provider offers them), encryption in transit and at rest, and access controls.
If you are in the United Arab Emirates: under Federal Decree-Law No. 45 of 2021 we inform you that your data is transferred outside the UAE to the recipients and countries listed above, protected by the safeguards described here. Where the law requires it, we rely on your explicit consent given at sign-up, which you may withdraw by deleting your account.
10. How long we keep your data
| Data | Kept for |
|---|---|
| Account, profile, jobs, offers, chat, photos, videos, reviews, notification tokens | While your account exists. Deleted from active systems when you delete your account (see Section 12). Encrypted backups are overwritten within 30 days. |
| Notifications in your list | 12 months, then deleted automatically. |
| Verification documents and selfies | 12 months after the verification decision, then the files are deleted automatically and only the decision itself is kept. Sooner if you delete your account or ask us to remove them. A request still awaiting a decision keeps its documents until it is decided. |
| Guest jobs | Until claimed by an account, or 30 days after creation. |
| Reports, blocks, strikes and related evidence | 24 months after the event, then deleted. If you delete your account first, the identifiers pointing at you are removed at once. |
| Live location points (during a job) | Kept no longer than 24 hours, then deleted automatically. |
| Record of which pros a job was shown to | 90 days. |
| Payment records | As long as accounting and tax law requires (up to 5 years in the UAE, 7 years where US law applies). |
| Support and feedback messages | 24 months after the last message; e-mail address removed when you delete your account. |
| Crash and usage data (Firebase) | Crash data up to 90 days; usage data up to 14 months (Google's retention settings). |
| Server, security and delivery logs | Supabase (our database) keeps them for 7 days; other providers up to 90 days. |
| Translation cache | Stores only the translated text, with no user identifier. An entry unused for 12 months is removed. |
Where we say we de-identify data, we remove names, contact details and identifiers so the record can no longer reasonably be linked to you.
11. Your choices
- Push notifications: turn off in the app (Profile → Notifications), in the website settings, or in your device settings.
- Location: deny or revoke the location permission in your device settings; you can still type addresses by hand.
- Crash and usage analytics (apps): turn off in Profile → Privacy → "Share diagnostics and usage data". While the toggle is not yet available in your app version, e-mail us and we will disable it for your account. Diagnostics are never collected in the website.
- Public work location (pros): set it to a district or street rather than your home.
- Live location (pros): switch it on or off at any time in the app settings. It stays off until you turn it on. With it off, a client sees only the work location from your profile, never your live position.
- Marketing e-mail: unsubscribe link in every e-mail.
- Browser storage (website): clear site data for get-handyman.com in your browser; this signs you out and resets your language.
12. Account and data deletion
You can delete your account yourself at any time:
- Android app: Profile → Delete account → confirm.
- iOS app: Profile → Delete account → confirm.
- Website: sign in → Settings → Delete account → confirm.
- By e-mail: write to feedback@get-handyman.com from the e-mail address of your account, or from any address with enough detail for us to verify you. We confirm and complete the deletion within 30 days.
Deletion immediately and permanently removes your sign-in account, profile, pro profile and portfolio, verification documents, jobs, offers, chat messages, photos, videos, reviews you wrote, favourites, addresses, notification tokens and notifications from our active systems. Reviews you received are removed with your profile. Any Stripe account you connected is disconnected from HandyMan; Stripe keeps its own records under its policy.
We keep, in de-identified form or as required by law: reports and strikes involving you (to protect other users), payment records (accounting law), and records of your deletion request. Encrypted backups containing your data are overwritten within 30 days.
Content you posted may remain visible to the other party of a completed job in their own history (for example, a job description), without your name or contact details.
13. Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data (most profile fields you can edit yourself);
- Delete your data (Section 12);
- Export your data in a structured, machine-readable format (portability);
- Restrict or object to processing based on our legitimate interests, including analytics;
- Withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal;
- Not be subject to solely automated decisions with legal or similarly significant effects (we make none);
- Complain to a supervisory authority and to appeal our decision on your request by replying to it.
You can export your own data yourself, without asking us: in Settings, choose "Download my data" and we build a JSON file of what your account holds — your profile, the jobs you posted or worked on, the offers you sent or received, reviews you wrote, the messages you sent, your notifications, favourites, the devices you turned notifications on for, your subscription and payment records, your verification status, and your support messages.
Some things are left out on purpose, because they are not yours alone to take: the other person's messages in a conversation, and anything about someone who blocked or reported you — their photo, their location, the job it concerned. Two technical values are excluded because they identify a device rather than describe you: the push tokens for your devices, and the salted hash of an IP address stored with feedback-form submissions. Your files — photos, and any verification documents — are referenced in the export and provided by link or on request, rather than packed into the JSON.
If you are a professional, the export includes the jobs you accepted, with the client's address and job description — the same details the platform shows you once a job is yours, and no more.
You can export once an hour.
You can access and export your data yourself, as described above; for the other rights, e-mail feedback@get-handyman.com with the request and the e-mail address of your account. We verify requests proportionately (usually by replying to the account e-mail) and respond within 30 days; we may extend once by a further 30 days for complex requests and will tell you if so. Requests are free unless manifestly unfounded or excessive. An authorised agent may act for you if they show your written permission and we can verify your identity. We will never discriminate against you for exercising a right.
United Arab Emirates
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) gives you the rights above, including the right to receive information about the purposes of processing, the recipients inside and outside the UAE, the protection measures for cross-border processing, retention periods, and how to correct or erase your data and how we handle breaches (Sections 4, 8, 9, 10, 12, 14). Complaints may be made to the UAE Data Office. We report personal-data breaches to the Data Office and, where the breach is likely to harm you, to you, as the PDPL and its executive regulations require.
United States (California and other states)
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or another state with a comprehensive privacy law, you have the rights above to the extent the law applies to HandyMan. The categories of personal information we collect, the sources, purposes and recipients are described in Sections 3, 4 and 8. In the last 12 months we have not sold personal information, have not shared it for cross-context behavioural advertising, and have not used or disclosed sensitive personal information (precise location, identity documents) for any purpose other than providing the Service you asked for, so no "Do Not Sell or Share" or "Limit the Use of My Sensitive Personal Information" opt-out is needed; we honour Global Privacy Control signals as an opt-out of any future sale or sharing. We do not knowingly sell or share the personal information of anyone under 16. Requests may be made by e-mail to feedback@get-handyman.com; we respond within 45 days where state law provides that period.
European Economic Area and United Kingdom
HandyMan is not directed at the EEA or UK, but our data is stored there. If GDPR or UK GDPR applies to you, the legal bases in Section 4 and the rights above apply, and you may complain to your local supervisory authority.
14. Security
We protect data with encryption in transit (TLS) and at rest, row-level access rules in the database so each user can read only what this policy says they can, private storage for verification documents, chat and videos with short-lived signed links, encrypted session storage in the apps, captcha and rate limits against abuse, and access to production systems restricted to the operator. No system is completely secure. If a breach affects your data we will notify you and the competent authority as the law requires.
15. Children
HandyMan is for adults aged 18 and over. You confirm you are 18 or older when you sign up. We do not knowingly collect data from anyone under 18; if you believe a minor has an account, e-mail us and we will delete it.
16. Cookies and what we store on your device
Website. We set no advertising or analytics cookies and use no third-party analytics scripts on our pages. The site uses browser local storage for: sb-…-auth-token (your session), hm_lang (language), hm_role and hm_active_mode (client or pro mode), hm_push_token (only if you enable push), and short-lived flags for guest jobs and referral links. Third parties loaded on specific pages (hCaptcha on sign-in forms, Google Maps where a map is shown, Firebase if you enable push) may store their own data under their domains and policies.
Apps. The apps store your session (encrypted), language, role, notification token and cached content on the device. Firebase stores an installation identifier for push delivery and, in release builds, for crash and usage reporting.
17. Reviews and ratings
A review can be written only by the client or the pro of a job that was actually completed, once per side, and the author's name is taken from their account. We do not write, buy, or fabricate reviews, do not pay for or condition reviews on their content, and do not remove or hide a review because it is negative. Reviews that break the Terms (abuse, personal data of others, spam) may be removed and the removal is recorded. If you believe a review is fake, report it in the app.
18. Paid features, subscriptions and refunds
HandyMan is currently free for clients and pros. Payment for the work itself is arranged directly between client and pro. We may offer pros optional one-time packs of job responses, shown with the price before purchase, paid through Stripe Checkout. We do not sell auto-renewing subscriptions. If we ever introduce a recurring plan, we will show the renewal price and period before you subscribe, send a reminder before each renewal, and let you cancel in one step in the same place where you subscribed, in line with the laws that apply to you. Refund terms are in the Terms of Service.
19. Changes to this policy
We will change this policy when the Service or the law changes. The version and date at the top will be updated. For material changes, such as new categories of data, new recipients, or new purposes, we will notify you by e-mail or in the apps at least 14 days before they take effect, and where the law requires it we will ask for your consent again. Earlier versions are available on request.
20. Contact
Procode FZ-LLC, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates · feedback@get-handyman.com
The Terms of Service govern your use of HandyMan; this Privacy Policy describes our data practices. The English version prevails in case of any difference between language versions.