Privacy Policy

This Privacy Policy explains how H2H (“we”, “us”, or “our”) collects, uses, stores, and shares personal information through the H2H mobile app, website, and home-services marketplace. This policy applies to customers, home-service professionals, and visitors to our website.

The information we receive depends on how you use H2H. It can include:

• Account and sign-in information: name, phone number, email address, password credentials (stored as a password hash), verification status, profile photo, language and notification preferences, and identifiers or profile details received from Google, Apple, or Telegram when you choose one of those sign-in methods.
• Professional profile and verification information: biography, services offered, service areas, availability, profile and portfolio images, ratings and reviews, and documents submitted for professional review. Document types supported in the app include national identity cards, passports, licenses, certifications, business registration, and insurance documents.
• Location and service address: saved address labels, street address, house or unit details, floor, notes, photos, and precise latitude/longitude. If you choose to use your device’s location, H2H uses GPS coordinates to suggest an address and help you find or book services. A booking may include the service address and coordinates.
• Booking and marketplace activity: selected service, schedule, address, booking notes, service options, quoted and paid amounts, payment status, cancellations, refunds, disputes, promo-code use, favorites, and booking history.
• Communications and user content: messages, support or dispute messages, reviews, ratings, reports, and photos. H2H chat also supports voice notes and shared location. Content you submit may include personal information you choose to provide.
• Payment and payout information: wallet balances and transactions, payment and refund records, gateway transaction references, payout history, and payout details such as bank or e-wallet provider, account holder name, and account or wallet number. Where a payment method is supported, records may include a gateway token and limited card descriptors such as brand, last four digits, or expiry date. [CONFIRM WHETHER H2H OR ITS PAYMENT PROVIDER RECEIVES OR STORES ANY OTHER CARD OR BANK DETAILS].
• Device, session, and technical information: device model and identifier, operating system, app version, IP address, user-agent information, session timestamps and status, push-notification token, and service/security logs. These help operate accounts, deliver notifications, troubleshoot issues, and protect the service.

You can enter a service address manually or choose to use device location for nearby service discovery and address selection. If you grant location permission, the app reads precise GPS coordinates for the feature you use and may send them to OpenStreetMap’s Nominatim service to turn coordinates into a readable address. Map screens also request map tiles from OpenStreetMap.

During a booking, a professional can share their current position with the customer after marking that they are on the way. The app stores and shares the latest reported position, including available accuracy, heading, speed, and timestamp, for that booking. The server accepts these updates only between the professional starting travel and marking arrival; it replaces the prior position rather than keeping a route history. Device location permission can be changed in your operating-system settings.

H2H uses information to:

• create and secure accounts, verify sign-in methods, and maintain sessions;
• show service listings and professional profiles, match services to selected locations, and support bookings and scheduling;
• share necessary booking, address, and contact details between the customer and professional assigned to a booking;
• review professional applications and verification documents;
• enable in-app messages, photos, voice notes, reviews, support, reports, and dispute handling;
• record payments, wallet activity, refunds, and professional payouts;
• send booking, account, payment, and other requested push notifications;
• prevent fraud and abuse, enforce marketplace rules, troubleshoot the app, and maintain service security; and
• meet accounting, legal, and regulatory obligations.

Where a law such as the GDPR requires a legal basis, the expected basis depends on the activity: account setup, bookings, payments, and payouts are needed to provide the service you request; tax, accounting, and legally required identity checks may be needed to comply with law; fraud prevention, service security, and dispute handling may rely on legitimate interests where permitted; and optional device permissions or communications may rely on your consent. [HAVE COUNSEL CONFIRM THESE BASES AND MAP THEM TO H2H’S ACTUAL OPERATING COUNTRIES].

We share information only as needed to operate H2H, complete a user-requested service, or comply with law:

• Customers and professionals: when a booking is made, the assigned parties receive the profile, contact, service, schedule, and address details needed to arrange and complete the job. Professional travel location is shared with the customer for the active booking as described above. Professional identity and verification files are submitted for review and are available to the submitting professional and authorized H2H administrators, not as public profile content.
• Hosting, storage, and infrastructure: the system is built to use Neon/PostgreSQL for application data, Cloudflare for website delivery and R2 file storage, and Firebase Cloud Messaging for push notifications. Confirm the providers and regions used by the production service before publication.
• Sign-in and account providers: Google, Apple, and Telegram support sign-in or account verification. H2H receives provider identifiers and the profile information returned by the sign-in flow. Phone one-time codes may be delivered through Telegram services.
• Payments: the codebase supports ABA PayWay KHQR payments. Payment providers receive the transaction information needed to create, verify, and process a payment. H2H receives transaction status and records needed for receipts, wallets, refunds, and payouts. [CONFIRM THE LIVE PAYMENT PROVIDERS AND EXACT PAYMENT DATA FLOW].
• Maps and address lookup: OpenStreetMap receives map-tile requests; its Nominatim service receives coordinates when the app requests reverse address lookup. These requests may also disclose network information such as your IP address to those services.
• Diagnostics: the app can send crash and performance diagnostics to Sentry when a Sentry production configuration is enabled. [CONFIRM WHETHER SENTRY IS ENABLED IN RELEASE BUILDS, WHAT IT CAPTURES, AND ITS RETENTION SETTINGS].
• Safety, legal, and business purposes: we may disclose information to authorized support or safety personnel, payment or professional service providers, regulators, law enforcement, or other parties when necessary to resolve a dispute, protect users, meet legal obligations, or complete a business transfer.

Professional profile information, service listings, ratings, and reviews may be visible to other H2H users as part of the marketplace. Booking details and messages are shared with the people involved in that booking or conversation. [CONFIRM WHETHER H2H SELLS OR SHARES PERSONAL INFORMATION FOR CROSS-CONTEXT OR TARGETED ADVERTISING].

If you allow notifications, H2H and Firebase Cloud Messaging use a device push token to deliver booking, message, account, and payment updates. You can disable push notifications in your device settings; some service messages may still appear in the app.

The mobile app’s current dependency and configuration files do not show an advertising SDK. Sentry performance/error reporting is conditional on a production configuration, as described above. [CONFIRM WHETHER ANY ANALYTICS, ADVERTISING, OR OTHER TRACKING TOOLS ARE USED IN PRODUCTION].

We keep information for as long as needed to provide H2H, maintain account and marketplace records, resolve disputes, prevent fraud, and meet legal, tax, and accounting requirements. Our systems contain account, booking, payment, communication, and professional verification records; the retention periods have not been confirmed for this policy.

• Account and session information: [APPROVED RETENTION PERIOD OR DELETION RULE].
• Booking, payment, wallet, refund, and payout records: [APPROVED FINANCIAL/LEGAL RETENTION PERIOD].
• Chat, support, review, and dispute content: [APPROVED CONTENT RETENTION PERIOD].
• Professional identity and verification documents: [APPROVED DOCUMENT RETENTION PERIOD].
• Crash, security, and server logs: [APPROVED LOG RETENTION PERIOD].

When information is no longer needed, it should be deleted or de-identified under H2H’s retention and deletion procedures, subject to legal obligations, accounting records, safety reviews, and unresolved disputes.

You can update some profile details and notification preferences in the app, manage device permissions in your operating-system settings, and revoke active sessions from account security settings. Depending on where you live, you may also have rights to request access to, correction of, deletion of, or a portable copy of your personal information, or to object to or restrict certain processing. Where we rely on consent, you may be able to withdraw it.

To make a privacy request, contact info@h2h.work. We may ask for information to verify your identity and will respond as required by applicable law. Rights and exceptions differ by location.

The current mobile app does not provide a self-service account deletion control. To request account closure or deletion, contact info@h2h.work and include the phone number or email address associated with your account. We will verify the request and explain what can be deleted and what records must be retained for legal, payment, security, or dispute purposes. [CONFIRM THE PRODUCTION ACCOUNT-DELETION PROCESS AND EXPECTED TIMELINE].

H2H and its service providers may process information in countries other than the country where you use the service. The production hosting regions, provider locations, and transfer safeguards have not been confirmed for this policy. [IDENTIFY DATA-HOSTING COUNTRIES AND APPLICABLE INTERNATIONAL-TRANSFER SAFEGUARDS].

The H2H marketing website is a static website hosted through Cloudflare. The current website code does not include an analytics or advertising-cookie integration. Cloudflare may process technical request information to deliver and protect the site. [CONFIRM PRODUCTION CLOUDFLARE LOGGING, COOKIES, AND ANY CONSENT REQUIREMENTS]. The mobile app may use local storage needed for sign-in, preferences, and core app operation.

H2H is not designed for children. You must be at least [MINIMUM USER AGE] to create an account or use the marketplace. If you believe a child has provided personal information, contact [PRIVACY CONTACT EMAIL] so we can review the request.

We use technical and organizational safeguards intended to protect information. No internet service can guarantee absolute security. We may update this policy when our practices or legal requirements change. We will post the revised version here and update its version and date, and provide additional notice when required.

For privacy questions or requests, contact info@h2h.work. The service is operated under the name H2H.