Privacy Policy

1. Who we are

Contracty (the 'Service') is operated from Zagreb, Croatia. For the purposes of the General Data Protection Regulation (GDPR), Contracty is the controller of the personal data processed via the Service.

2. What data we collect

Account information: name, email, profile image, password hash (if you sign up with email) or Google account identifier (if you use Google sign-in), and your role (homeowner or contractor).

Contractor profile information: trade, bio, phone, service area, certifications, price range and portfolio media you choose to upload.

Activity data: inquiries, reviews, bookmarks, search filters and basic usage events such as profile views.

Technical data: IP address (for rate limiting and security), browser type and approximate location derived from the IP.

3. Why we use your data

To create and operate your account, including authentication and role-based access.

To match homeowners and contractors and to display profiles, reviews and portfolios.

To send transactional emails such as verification codes, inquiry notifications and account-related messages.

To prevent abuse, fraud and spam, and to keep the Service secure.

To improve the Service through aggregate, non-identifying analytics.

4. Legal basis (GDPR)

Contract: processing necessary to provide the Service you signed up for.

Legitimate interests: keeping the Service secure, preventing fraud, and improving features.

Consent: where we ask for it explicitly — for example, marketing emails (if introduced) or optional analytics cookies.

Legal obligation: where we must retain data to comply with applicable laws.

5. Sharing with third parties

We do not sell your personal data. We share it only with service providers who help us run the Service, under appropriate data-processing terms:

MongoDB Atlas — database hosting.

Google — OAuth sign-in (if you choose that method).

Cloudinary — storage and delivery of uploaded images.

Email and SMS providers — delivery of transactional messages.

We may also disclose data when required by law or to protect the rights, property or safety of Contracty or others.

6. Cookies and similar technologies

We use a small number of cookies that are strictly necessary to keep you signed in and to protect the Service from abuse. We do not currently use advertising cookies.

7. Data retention

We keep your account data for as long as your account is active. If you delete your account, we remove or anonymise personal data within a reasonable timeframe, except where we are required by law to retain certain information.

8. Your rights under GDPR

You have the right to access, correct, delete or export your personal data, and to restrict or object to certain processing. To exercise any of these rights, email privacy@contracty.app — we'll respond within one month.

You also have the right to lodge a complaint with your local data protection authority. In Croatia, that is the Croatian Personal Data Protection Agency (AZOP).

9. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords and access controls. No method of transmission or storage is 100% secure, but we work hard to minimise risk.

10. International transfers

Some of our service providers may process data outside the European Economic Area. Where that happens, we rely on adequacy decisions or Standard Contractual Clauses to ensure your data is protected to GDPR standards.

11. Children

Contracty is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this policy

We may update this policy as the Service evolves. The 'Last updated' date below will always reflect the latest revision. Material changes will be communicated through the Service.

13. Contact

Privacy questions or requests? Email privacy@contracty.app or use our contact page.