Privacy Policy

Account data: your name, email address, phone number, role (client or provider), and password (stored only as a secure hash).

Provider verification data: for providers we collect identity details including your Georgian ID number, business-registration details where applicable, and bank or IBAN details needed to pay you out. Sensitive identifiers such as your ID number and bank details are encrypted at rest.

Marketplace data: job briefs, offers, orders, milestones, deliverables, reviews, portfolio content, and the messages you exchange on the platform.

Payment data: records of charges, escrow holds, releases, refunds, and payouts. Card details are handled by our payment processor; we do not store full card numbers.

Technical data: device and log information needed to operate and secure the service.

We use your data to provide the marketplace — to create your account, verify providers, match jobs and offers, run the milestone escrow, process payments and payouts, and mediate disputes (performance of our contract with you). We also use it to comply with legal, accounting, tax, and anti-fraud obligations (legal obligation), to keep the platform secure and prevent abuse (legitimate interests), and, where you have opted in, to send marketing updates (consent, which you can withdraw at any time).

We keep personal data only as long as we need it for the purposes above. Account data is kept while your account is open and for a limited review period after closure; financial and payment records are kept for the period required by Georgian accounting and anti-fraud law; verification documents and identity data are retained under our KYC retention rules; drafts and transient data expire on shorter schedules. The full retention schedule by data category is published as part of our data-protection documentation and is summarised here for transparency.

We share data with service providers who help us run Homecraft — our payment processor, email and notification providers, file-storage and hosting providers — strictly to deliver the service. Providers and clients see each other's relevant marketplace information needed to transact (for example, a provider's public profile, or a client's brief). We do not sell your personal data. We may disclose data where required by law or to protect against fraud and abuse.

Some of our infrastructure providers store and process data outside Georgia. Our database (Neon), application hosting (Vercel), and file uploads (UploadThing), among other processors, may host data in the European Union or other regions. Where data is transferred outside Georgia we rely on appropriate safeguards and process it under this Policy. By using Homecraft you acknowledge this cross-border hosting.

We use technical and organisational measures to protect personal data, including encryption in transit, encryption at rest for sensitive identifiers (such as ID numbers and bank details), access controls that limit who can view sensitive data, and audit logging of privileged access. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

Subject to Georgian data-protection law, you have the right to access the personal data we hold about you, to ask us to correct inaccurate data, to ask us to delete data where we are not required to keep it, to object to or restrict certain processing, and to withdraw consent for marketing at any time. You can manage marketing preferences and close your account from account settings, or contact us to exercise any other right.

Homecraft is not intended for anyone under 18. We do not knowingly collect personal data from people under 18, and we close accounts found to belong to minors.

We may update this Policy; the version and date are shown at the top of this page. For any privacy question, or to exercise your rights, contact us using the details on our Contact page. If you are not satisfied with our response you may have the right to complain to the relevant Georgian data-protection authority.