1. What data we collect
When you register: your name, email address, and mobile phone number. If you choose to verify your identity: a photo of your driving licence which is deleted after admin review. We retain only a one-way hash of your licence number. ID verification is optional. When you use the platform: job records, reviews you submit, reviews submitted about you, search lookups you perform, and notification activity. When you subscribe: your Stripe customer ID and subscription status. We do not store card details. Device and connection data: IP address and user agent, used for fraud detection.
2. Legal basis for processing
Contract: to provide the WorkedWith service. Legitimate interest: to detect fraud, prevent fake reviews, and maintain platform integrity. Legal obligation: to comply with applicable law.
3. How we use your data
To operate your account and provide the platform. To verify your identity. To facilitate job logging and review submission. To send transactional emails. To detect and prevent fake reviews and abuse. To comply with our legal obligations.
4. Identity hashes and account closure
When an account is closed, we retain a one-way hash of your verified phone number and driving licence number if provided. These hashes are retained indefinitely under legitimate interest to prevent banned users from creating new accounts. Raw numbers and licence images are not retained after closure.
5. Reviews and reputation data
Reviews submitted about you are retained even if your account is closed, as they form part of another user's verified history. Your name on those reviews is anonymised to Verified Tradesperson or Verified Client on closure.
6. Who we share data with
Supabase: database and authentication. Resend: transactional email. Twilio: SMS verification. Stripe: subscription billing. AWS Rekognition: automated image moderation for featured job images. Companies House API: business verification. We do not sell your data. We do not use your data for advertising.
7. Data retention
Active account data: retained for the duration of your account. Review data: retained indefinitely, anonymised on account closure. Identity hashes: retained indefinitely for fraud prevention. Licence images: deleted after admin review. Search audit logs: retained for 12 months.
8. Your rights
Under UK GDPR you have the right to access, correct, or delete your personal data, object to processing, and data portability. Contact hello@workedwith.co.uk. We will respond within 30 days.
9. Cookies
We use only essential session cookies required to operate the platform. We do not use tracking or advertising cookies.
10. Security
We use encrypted connections, row-level security on all database tables, and access controls. Sensitive identifiers are stored as one-way hashes where possible.
11. Contact and complaints
Data controller: WorkedWith, hello@workedwith.co.uk. You have the right to complain to the Information Commissioner's Office at ico.org.uk.