Privacy notice
What Chalkline collects about you, why, who can see it, and the choices you have.
Working draft — not yet legally reviewed
Who is responsible for your data
The data controller is [legal name and address of the operator; ICO registration number if applicable — to be confirmed]. Contact: [privacy contact email — to be confirmed].
What we collect and why
Everyone with an account
- Name, email address and, if you add it, phone number — to run your account and let you use the service.
- Records of what you do on Chalkline: jobs, messages, quotes, reviews, reports — to provide the service and keep it safe.
- Records of the choices you make about sharing, with the wording you agreed to and the time.
Customers
- Your job description, photos, timing, budget, and your town and postcode district.
- Your address and access notes, if you add them. These are stored separately and kept private.
Businesses
- The profile you publish: business name, description, trades, service area, photographs and any public contact details you choose to enter.
- Documents you submit for checks, such as an insurance certificate. These are stored privately and seen only by the staff who check them.
Who sees what
- The public sees published business profiles and published reviews (with the reviewer’s first name).
- Shortlisted businesses — up to five per job — see your job description, photos if you allow it, timing, budget and postcode district. They do not see your name, phone number, email or address.
- A business you choose to share with sees your name, phone number, address and access notes. You make that choice for one business at a time.
- Each conversation is visible only to the customer and the one business in it.
- Chalkline staff see what they need to run and moderate the service. Reading a private conversation or a verification document is exceptional, needs a reason, and is logged.
Photos you upload have location data and other embedded metadata removed before they are stored. Full postcodes are reduced to the postcode district for matching.
We do not sell personal data, and we do not use it for advertising.
Our lawful bases
[lawful basis for each purpose, to be confirmed with legal advice. In outline: performance of our agreement with you to provide the service; consent for sharing job details with businesses and for optional marketing email; legitimate interests in keeping the service safe and preventing fake reviews; legal obligation where applicable — to be confirmed]
Organisations that process data for us
- Supabase — database, sign-in and file storage, hosted in London (UK).
- Vercel — hosting of the website.
- Resend — sending notification emails. Emails say only that something has happened and link back to your account; they do not contain messages, quotes or addresses.
- postcodes.io — looking up UK place names and postcode districts. Only the text you type in a location box is sent.
[international transfer safeguards for each processor — to be confirmed]
How long we keep it
[retention periods, to be set with legal advice — to be confirmed]. In outline: account data while your account is open; drafts you abandon are removed; records of completed jobs, sent quotes, published reviews and moderation decisions are kept after an account is deleted, without your name, because the other party and the reviews rules rely on them.
Your rights
You can see, correct, download and delete your data, object to how it is used, and withdraw consent. In your account settings you can download everything we hold about you and request deletion. You can also contact us. You have the right to complain to the Information Commissioner’s Office (ico.org.uk).
Cookies
See the cookies page.