Privacy Policy

Last updated 08 August 2026 · Chidera Onyebu is the data controller

This policy explains what ToolBelt collects, why, who it is shared with, and what you can do about it. It is written to describe what the product actually does rather than to cover every theoretical possibility.

1. What we collect

Data	Why we hold it
Name	So the other party knows who is coming or who booked.
Email address	Account identity, sign-in, transactional notifications.
Phone number	SMS verification and job-critical contact. Verified by one-time code.
Password	Stored only as a cryptographic hash. We cannot read your password.
Job address & coordinates	To match jobs to nearby workers and let the assigned worker find the property.
Job details & photos	So workers can quote accurately.
Messages	In-app messages between customer and worker, retained as a record for disputes.
Ratings & reviews	Reputation, visible to other users.
Payment tokens	Stripe references for your customer, payment method, charge, and payout account.
Worker vetting status	Whether a worker has passed review and may take jobs.
Account timestamps	Security, fraud prevention, and support.

2. What we do not collect

• Card numbers, CVVs, or bank account numbers. These go directly to Stripe.
• Continuous or background location. We store the location of a posted job, not a trail of where you are.
• Contacts, photo library, or microphone access beyond photos you attach to a job.
• Data purchased from brokers, and we do not build advertising profiles.

3. Location, specifically

A job's address and coordinates are necessary for the service to function — matching depends on distance, and the worker must be able to reach the property.

Precise address is shown only to the worker whose offer you accept. Workers browsing open jobs see approximate location for distance and area, not your exact address, until you have chosen them.

4. Messages between users

In-app messages are stored and tied to the job. They exist so a dispute can be resolved from a record rather than from memory, and so contact details need not be exchanged before booking. Authorized staff may review messages when investigating a dispute, a safety report, or suspected fraud. We do not read messages routinely and do not use their contents for marketing.

5. How we use your information

• To operate the marketplace — posting jobs, matching, offers, messaging, ratings.
• To process payments, fees, payouts, and refunds through Stripe.
• To verify identity and phone numbers, and to vet workers.
• To detect and prevent fraud, abuse, and unsafe behavior.
• To provide support and resolve disputes.
• To send transactional messages about your jobs. Marketing email, if any, is separate and you can opt out at any time.
• To meet legal, tax, and accounting obligations.

Where the GDPR or UK GDPR applies to you, our lawful bases are performance of a contract (operating the service), legitimate interests (fraud prevention, safety, service improvement), consent (marketing), and legal obligation (tax and accounting records).

6. Who we share it with

Recipient	What they receive, and why
The other party to a job	Your name, rating, messages, and — once you accept an offer — the job address.
Stripe	Payment and payout processing, and identity verification for workers.
SMS provider	Your phone number, to deliver verification codes.
Infrastructure providers	Hosting and database services holding data on our behalf under contract.
Legal & safety	Disclosure where required by law, or where necessary to address fraud or a credible safety risk.

7. How we protect it

• Passwords stored as salted cryptographic hashes, never in plain text.
• Phone verification codes stored hashed, with expiry and attempt limits.
• Access controls enforced per user on every endpoint — you can only read your own data.
• Payment credentials held by Stripe, not by us.
• Encrypted connections in transit and encryption at rest for personal data.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as required by law.

8. How long we keep it

• Account data — while your account is active.
• Job, payment, and ledger records — retained after account closure for the period required by tax, accounting, and anti-fraud obligations, typically 7 years.
• Messages — retained for the dispute window, then 24 months.
• Verification codes — minutes; discarded once used or expired.

When you delete your account we remove or anonymize personal data except where we are legally required to keep it. Ratings may remain in anonymized form so the other party's reputation record stays intact.

9. Your rights

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, port it elsewhere, and withdraw consent. If you are in California, you may request disclosure of the categories collected and request deletion; we do not sell personal information, and we will not discriminate against you for exercising these rights.

Exercise any of these by emailing support@toolbelt.biz. We respond within 30 days and may need to verify your identity first. You also have the right to complain to your local data protection authority.

10. Children

ToolBelt is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

11. International transfers

We operate from the United States, and our providers may process data in other countries. Where data leaves your region we rely on appropriate safeguards such as standard contractual clauses.

12. Changes to this policy

We will update this policy as the product changes. Material changes will be notified by email or in-app before taking effect, and the "last updated" date above always reflects the current version.

13. Contact

Chidera Onyebu
support@toolbelt.biz