Privacy Policy

Who We Are

AccessHands is operated by Palmer Initiatives Ltd (trading as AccessHands), a company registered in England & Wales under company number 13795320. Palmer Initiatives Ltd is the data controller responsible for your personal data. For any data-protection query, contact us at [email protected]. You also have the right to lodge a complaint with the ICO (ico.org.uk).

1. Information We Collect

• Account information: Name, email address, phone number, company name, and role.
• Profile and organisation data: Bio, skills, certifications, hourly rates, service areas, availability, company details, team membership, and public marketplace profile information.
• Verification and compliance data: Identity/KYC status, right-to-work records, certification documents, insurance or qualification evidence, provider session IDs, review decisions, and audit history.
• Job and evidence data: Job descriptions, bids, assignments, access notes, guidance files, evidence photos, uploaded documents, GPS check-in or verification coordinates, job logs, messages, disputes, reviews, and notifications.
• Payment and billing data: Stripe customer IDs, Connect account IDs, Checkout sessions, PaymentIntents, transfers, refunds, invoice records, platform fees, payout status, and limited card metadata provided by Stripe. We do not store full card numbers.
• Technical, security, and usage data: IP address, device/browser details, timestamps, pages or routes accessed, rate-limit events, authentication events, security logs, crash reports, performance data, and support interactions.

2. How We Use Your Data

• To provide and operate the AccessHands platform.
• To process payments, payment holds, refunds, and technician payouts.
• To send notifications about job updates, messages, and account activity.
• To verify technician identity, right-to-work status, certifications, insurance, account readiness, and marketplace eligibility.
• To store private uploads, job evidence, messages, logs, and dispute records for delivery, quality assurance, support, and legal compliance.
• To detect fraud, abuse, unauthorised access, duplicate payments, unsafe conduct, and security incidents.
• To improve the platform, measure reliability, run operational analytics, provide customer support, and meet legal obligations.

3. Data Sharing

We do not sell your personal data. We share data only with:

• Other users: Profile information is visible to the extent needed for job matching. Anonymous job posters have their identity hidden until a bid is accepted.
• Payment providers: Stripe processes customer billing, authorisations, Checkout sessions, subscriptions, Connect onboarding, transfers, refunds, invoices, and payment webhooks.
• Identity and compliance providers: Didit or other configured verification providers process identity, KYC, liveness, document, right-to-work, or similar checks.
• Infrastructure and communications providers: Cloudflare R2 stores private and public uploads; Resend sends transactional email; hosting, database, logging, monitoring, error reporting, analytics, and support providers process data needed to run the Platform.
• Observability and product tools if enabled: Sentry, PostHog, or similar tools may process technical logs, error reports, or product analytics according to configuration and user consent where required.
• Legal authorities: When required by law or to protect our rights.

4. Private Uploads and Evidence

Sensitive documents, certification records, job guidance files, job evidence, and direct-message attachments are intended to be stored in private object storage and served through authenticated AccessHands routes. Public assets, such as avatars or public brand images, may be stored separately. Access to private files is limited by role, job participation, ownership, support need, and administrative permissions.

5. Data Retention

We keep account data while your account is active and for a reasonable period after closure where needed for security, dispute, tax, accounting, regulatory, fraud prevention, or legal reasons. Job records, payment records, invoices, support records, verification decisions, and dispute evidence may be retained for up to 7 years or longer where required by law, ongoing disputes, safety incidents, payment network rules, or regulatory obligations. Some operational logs are retained for shorter periods unless needed for investigation.

6. Your Rights (UK GDPR and GDPR)

If you are located in the UK or EU, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure of your data.
• Object to or restrict processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise these rights, email [email protected].

7. Cookies and Similar Technologies

We use essential cookies for authentication, session management, security, fraud prevention, and remembering account settings. If analytics, support chat, or product measurement tools are enabled, we will use consent controls where required by law.

8. International Transfers

AccessHands and its providers may process data in the UK, EEA, United States, or other countries where infrastructure or provider services operate. Where required, we rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, provider data processing terms, and security controls.

9. Security

We use security measures including TLS, hashed passwords, role-based access controls, private upload routes, rate limits, audit-oriented logging, secret redaction, backup and restore checks, and provider webhook signature validation. No system is completely secure, and users must keep account credentials, site access details, and customer information protected.

10. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email.

11. Contact

For privacy-related questions, contact [email protected].