Privacy Policy
This policy explains what personal data OnCall collects, why, who we share it with, how long we keep it and your rights under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
1. Who is responsible for your data
The data controller is [your full legal name], a sole trader trading as OnCall, [business postal address], Ireland. Contact for anything about your data: hello@oncallapp.ie.
2. What we collect
- Account: email address and password (stored only in scrambled, "hashed" form by our hosting provider), the date you agreed to our terms.
- Profile: name, what you're good at, experience, job types, travel distance, rating, whether you have Premium.
- Jobs and bids: job title, category, description, budget, area/location you type in, photos or videos you add, bids, prices and notes, and the "job done" photo.
- Location: the approximate location of each job you post, and the centre and distance of the area you search in, both saved only to about 1 km (2 decimal places), plus the area name you choose. If you tap "Use my current location", your device shares its location with the app once to centre the map; we only keep the rounded result.
- ID and age check result: whether you passed our identity check, whether you are 18 or over, the date, and Stripe's reference for the check (see section 3a). We do not store your date of birth, ID number or any images.
- Messages you send to other users through OnCall.
- Ratings and reviews, reports of problems or illegal content, and dispute notes.
- Payments: amounts, fees, payment status and references from Stripe. We do not receive or store full card numbers.
- Workers' payout details: to pay you, Stripe collects your name, date of birth, address, ID and bank account. We receive your Stripe account reference and whether it's ready for payouts. Where tax law (DAC7) requires, we also collect your tax identification number and keep records of what you earned.
- Technical data: your IP address, browser and device type and request times, recorded by our hosting providers when you use the app; and a login token stored on your device so you stay logged in.
Please don't include sensitive information (such as health details) or other people's faces or documents in job posts, photos or messages.
3. Why we use it, and our legal basis
| What we do | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; show your jobs, bids and profile to other users; deliver messages; process payments, holds, approvals and payouts; send emails that are part of the service (e.g. "approve within 4 hours" reminders) | Performing our contract with you (6(1)(b)) |
| Premium and Boost | Performing our contract with you (6(1)(b)) |
| Keeping accounting and tax records; reporting Workers' earnings to Revenue under DAC7; responding to lawful requests from authorities; handling reports of illegal content | Legal obligation (6(1)(c)) |
| Keeping OnCall safe and secure, preventing fraud and misuse, resolving disputes, enforcing our terms, defending legal claims, and improving the service | Our legitimate interests (6(1)(f)) — running a safe, working marketplace. You can object (see section 7). |
We don't send marketing emails, sell your data or use it for advertising.
3a. ID and age verification
Everyone must verify their identity and age (18+) before posting a job or bidding. We use Stripe Identity, provided by Stripe Payments Europe, Limited, to do this. When you verify, Stripe collects a photo of your ID document (passport, driving licence or national ID card) and the information on it (such as name, date of birth, document number and expiry), and checks that the document is genuine. We don't ask for a selfie and no face matching (biometric processing) takes place.
- Why: to keep users safe (people let Workers into their homes) and to make sure everyone is an adult.
- Legal basis: performing our contract with you and our legitimate interest in a safe marketplace (Art. 6(1)(b) and (f)). If you can't use the online check, email us and we'll offer another way to verify, reviewed by a person.
- What we receive and keep: only whether you passed, whether you're 18+, the date, and the check's reference. We look at your date of birth once, at the moment of the check, to work out whether you're 18+, and don't store it.
- Automated decision: the check is automated. If it fails or says you're under 18, you can't post or bid until it's resolved. You can ask for a person at OnCall to review the decision, explain your point of view, and contest it.
- Stripe's role: Stripe keeps the images and data under its privacy policy and may, if you agree in its flow, use your data to improve its verification technology. If you ask us to delete your data, we ask Stripe to delete ("redact") your verification; you can also contact Stripe support directly.
Apart from the ID check above, we don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
4. Who we share it with
- Other users: your name, profile, rating, area name and job posts (with their approximate location and distance) are visible to signed-in users; your bids are visible to the Poster; messages go to the person you send them to.
- Supabase — hosts our database, logins, files and server code. Your data is stored in the EU (Ireland region). Processor.
- Stripe Payments Europe, Limited (Dublin) — payments, subscriptions, Worker payouts and ID/age verification (Stripe Identity). For its own identity checks and legal duties Stripe acts as a separate controller under its privacy policy.
- Resend — sends our emails. Processor; may process data in the United States.
- OpenStreetMap Foundation (UK) — provides the map and place search. When you open the map or search for a place, your IP address, the place you type and the map area you view are sent to OpenStreetMap's servers. The UK has an EU adequacy decision.
- GitHub (hosts the app's web page) and jsDelivr (delivers a code library the app uses) — receive your IP address and browser details when the app loads. May process data in the United States.
- Authorities such as the Revenue Commissioners or An Garda Síochána, when the law requires it.
- Professional advisers (e.g. accountants, solicitors, insurers) where needed, under confidentiality.
5. Transfers outside the EU
Where a provider processes data outside the European Economic Area (for example in the US), we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. How long we keep it
- Account, profile, jobs, bids, messages, photos and the list of people you've blocked: while your account is open. When you close your account we delete or anonymise them within 30 days, except as below.
- Payment, fee and payout records: 6 years from the end of the tax year they relate to (Irish tax law), or longer where DAC7 reporting rules require.
- Information about disputes, reports and safety incidents (including related messages and photos): up to 6 years after the matter is closed, in case of legal claims.
- Technical logs: normally deleted automatically within a few weeks.
7. Your rights
You can ask us to: access your data and get a copy; correct it; delete it; restrict how we use it; give it to you in a portable format (portability); and you can object to uses based on our legitimate interests. You can delete your account yourself in the app (Profile → Delete my account); this removes your login and personal data straight away, apart from the records we must keep (section 6). For anything else, email hello@oncallapp.ie from your account email address. We'll reply within one month (we may extend this by two months for complex requests and will tell you if so). Some data we must keep by law (see section 6).
You can also complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — www.dataprotection.ie — or to the data protection authority where you live or work in the EU.
8. Security
Data is sent over encrypted connections. Our database only lets each user see and change what they're allowed to, and money and job-status changes can only be made by our server. No system is perfectly secure; if a breach is likely to put you at high risk we will tell you without undue delay.
9. Cookies and your device
OnCall doesn't use advertising or analytics cookies. The app stores a login token in your browser's local storage so you stay logged in — this is strictly necessary to provide the service you ask for, so it doesn't need consent. Stripe's payment pages may set their own cookies, which are needed for payment security.
10. Age
OnCall is only for people aged 18 or over. We don't knowingly collect data about children.
11. Changes to this policy
If we make important changes we'll tell you in the app or by email before they take effect.
See also our Terms of Service.