Privacy Policy

Live selfies and face recovery

When face verification is enabled, we ask for your explicit consent before processing a live selfie with Amazon Web Services in Tokyo, Japan. After the live check passes, we store an encrypted reference face photo privately, linked to your account and separate from your public profile photo. We record when you gave consent and the version of the notice.

For selfie recovery, we process a fresh live selfie and compare it with your saved registration photo. A match can send a password reset link to your registered email; you still need access to that email. We do not use your face photo to identify strangers or to discover personal information about you.

We keep the registration reference photo until account deletion or an earlier removal request to support. Recovery selfies are not saved by our application. AWS liveness session results expire after three minutes. Account deletion removes your stored face reference and verification session records before the deletion is reported complete. Ordinary email recovery remains available.

What we collect

Account details (name, email, mobile number, address), profile details, booking details and messages, payment records (we do not store card numbers; our payment partners handle them), photos you upload, and for providers, identity or business documents and tax details.

We also collect technical data such as IP address and device type to keep the platform secure. If you turn on browser alerts, we store the technical address your browser gives us for delivering them; turning alerts off or signing out removes it.

After a job, the provider can rate you privately from 1 to 5. Other providers see only your average, and only once you have at least three ratings; nobody sees individual scores or notes.

Why we use it

To provide the service (matching, booking, payments, refunds, disputes), to verify providers, to prevent fraud, to meet legal obligations such as financial record keeping, and, only if you agree, to send marketing messages. You can switch marketing off at any time.

We email you about important steps in your bookings, such as a confirmation, a price to approve, a payment receipt or a dispute update. You can turn these emails off in your profile settings; you will still see them in the app.

Who sees it

The other party in a booking sees the details needed to do the job (for example your name, address and contact number). Our payment partners and service providers process data for us under contract. We do not sell personal data. We share data with authorities when the law requires it.

Your rights

You have the right to be informed, to access and download your data, to correct it, to object to or withdraw consent for processing that depends on consent, to request deletion, and to file a complaint with the National Privacy Commission. Use Privacy and data in your account to download your data, manage consent and request deletion.

How long we keep data

When you close your account we remove your profile, contact details, identity documents, sign-in, notifications, browser alert subscriptions, payout account details, private notes other people wrote about you, and the text and photos of reviews you wrote (the star rating stays, unnamed, so providers’ scores remain fair). Bookings, payments, tips, refunds and dispute records are kept, with your contact details removed, for financial and tax record keeping. We currently keep them for up to 10 years. Consent records are kept as proof of what you agreed to.

Messages in booking chats are stored by our chat provider. When you close your account we remove your name and membership from those chats on NO-DIY and ask the provider to erase your messages; we record when they confirm it.

Security and incidents

We use access controls, encryption in transit and audit logging. Identity documents and dispute evidence are stored privately and opened only through links that expire within minutes. Tax identification numbers and payout account numbers are encrypted in our database. Passwords are never stored, only a one-way hash.

If a personal data breach occurs that requires it, we notify the National Privacy Commission and affected people within the time the law requires.