Privacy Policy

• Email address, first name, last name;
• Profile photo (optional — base64 in PostgreSQL);
• Bio, catchphrase, language preference, spoken languages;
• Account type and business data (business helpers: CBE, VAT, name, address, billing email);
• Timestamp and version of the Terms you last accepted;
• Account status information (suspension reason, scheduled deletion date).

• Password (hashed — never readable);
• Google or Apple account ID (social login).

• Transaction amounts and Stripe PaymentIntent IDs (no card data);
• Payout transfer IDs.

• Help requests, helper responses, reviews, tips, badges, session quality surveys;
• Support tickets and replies (message body, author, timestamps);
• Blocks and abuse reports you submit or that are submitted against you (user IDs, timestamp, category, optional reason);
• Your helper skills (category, subcategory, self-declared skill level).

• FCM device token (push notifications — no location data, no tracking);
• Notification preferences.

For helpers, additional data is collected and processed to comply with EU/Belgian tax-reporting obligations (notably DAC7 — Council Directive 2021/514 transposed in Belgium by the Law of 21 December 2022). Where you are not a helper, none of these fields apply.

• Date of birth (private helpers — for DAC7 identity verification);
• Tax Identification Number ("TIN") and the country that issued it;
• Country of tax residence (ISO-3166-1 alpha-2);
• Home address (private helpers): line 1, line 2, postal code, city, country;
• Structured registered/legal address of the business entity (business helpers);
• VAT number, country of VAT registration, and VAT-classification status (business helpers);
• VIES validation evidence — the date the VAT number was last cross-checked against the European Commission VIES registry, the registered name and address as returned by VIES, and the raw VIES response (kept for audit and dispute-resolution purposes);
• KYC ("Know Your Customer") status and the timestamp of its last change — a platform-level state machine independent of Stripe Connect's own checks.

Legal basis: legal obligation (Art. 6.1.c GDPR) — DAC7 transposition and Belgian VAT law.

When a helper accepts a tax-related statement at onboarding (e.g. acknowledgement of personal tax responsibility, or VAT classification confirmation), an append-only audit row is recorded:

• The exact statement and its version that was accepted;
• Timestamp (UTC);
• IP address used at the moment of acceptance;
• User-Agent string used at the moment of acceptance;
• The helper's country of residence at the moment of acceptance.

This audit is necessary to evidence the validity of the helper's declarations to the Belgian tax authority (FOD Financien) under DAC7. Material changes to the helper profile (e.g. account-type flip, change of residence) cause the statement-version to bump and require renewed acceptance — earlier rows are never modified, only superseded. Legal basis: legal obligation (Art. 6.1.c GDPR).

When the platform sends a helper an email reminder for missing tax-compliance data (e.g. missing TIN, missing date of birth, pending VIES validation), the following is recorded:

• The recipient (user ID), the template key, the locale and the subject line of the email sent;
• The timestamp (UTC).

The body of the email is templated and reproducible from the template key plus the locale; the rendered body text is not separately stored. This log enforces the per-template cooldown so helpers are not over-mailed, and supports dispute resolution if a helper claims they were never reminded. Legal basis: legitimate interest (Art. 6.1.f GDPR) — operational coordination of statutory reminders.

• Stripe, Inc. (US) — payments and Stripe Connect. Transfer on the basis of SCCs and EU-US Data Privacy Framework (DPF). Stripe DPA applies;
• Google LLC / Firebase (US) — FCM push notifications only. Transfer on the basis of SCCs and DPF. Google DPA applies;
• Agora, Inc. — video calling via server-side tokens; no PII transferred;
• AWS SES (eu-west-1) — transactional emails. Processing in EU. AWS DPA + SCCs;
• OpenObserve Cloud (eu1-api.openobserve.ai, EU region per our deployment configuration) — operational log aggregation. Logs contain user IDs and IP addresses, no email addresses or names;
• Amazon Web Services, Inc. (eu-west-1) — encrypted database backups (PITR) and help-request photo storage via S3. Data stays within the EU region. AWS DPA applies.

HelpingHands uses no analytics SDKs, tracking pixels or advertising networks.

Only to processors that comply with: an adequacy decision, SCCs, or the EU-US Data Privacy Framework (DPF).

Once per calendar year, on the schedule set by the Belgian tax authority, we transmit a DAC7/DPI XML report to the Federal Public Service Finance (FOD Financien / SPF Finances). The report contains, per reportable helper, identification data (name, TIN, address, date of birth where applicable, VAT number) and the aggregated transaction totals attributable to that helper for the reporting year. Helpers receive a copy of their annual statement. This disclosure is a legal obligation (Art. 6.1.c GDPR; Council Directive 2021/514 as transposed in Belgium) and is not based on a processor relationship — FOD Financien acts as an independent controller of the data once received.

When a business helper enters a VAT number, we perform a synchronous lookup against the European Commission VIES service (https://ec.europa.eu/taxation_customs/vies/) to verify validity. The query contains only the VAT number and country code; no other personal data is sent. We store the result (validity flag, registered name, registered address, raw response payload, timestamp) as set out in Art. 3.6. The European Commission may itself log such queries; we have no influence on that retention.