Privacy Policy

We collect only what the service needs to work:

• Account data — name, email, hashed password (clients and contractors), company name for clients.
• Client content — job posts, contact details on posts, and applications you receive.
• Contractor content — profile details (role, skills, rates, timezone, bio), vetting scores, stage history, avatar photos you upload, and reviews clients leave about you.
• Usage data — page views (with a truncated hash of your IP), and your IP address used only for rate limiting.

We do not sell personal data, and we do not use third-party advertising trackers.

• To operate the marketplace: profiles, job posts, applications, matching, and the review system.
• To run the vetting pipeline and communicate status changes by email.
• To protect the service (rate limiting, abuse prevention).
• To understand aggregate site usage via our cookieless pageview counter.

Data is stored on our own server (a DigitalOcean virtual machine in the New York City region) in a local database. Backups are kept on the same machine for up to 14 days. When transactional email is enabled, emails are sent through a third-party email provider (Resend) solely for delivery.

We set a single strictly necessary session cookie (“autostaff_session”) so you stay signed in. We do not use tracking, analytics, or advertising cookies. See our Cookie Policy.

Public directory data (name, role, scores, reviews, rates, photo) is visible to site visitors — that is the point of the marketplace. Job posts you submit are visible to approved contractors once published. We share data only with:

• the email delivery provider, for sending the emails you expect,
• service providers who host the site, and
• authorities, when required by law.

Accounts and associated content are kept while your account is active. You may request deletion by emailing us; we will delete your account and personal data within 30 days, except where we must keep records for legal or tax purposes. IP-address hashes in our pageview counter are truncated and cannot identify you.

You may access, correct, export, or delete your data by contacting us. If you are in the EEA or UK, you have rights under the GDPR/UK GDPR including access, rectification, erasure, and objection to processing. Email [email protected] to exercise them.

The service is not directed at children under 16, and we do not knowingly collect their data.

We may update this policy as the product changes. Material changes will be announced on the site; the “last updated” date above reflects the current version.

Privacy questions: [email protected]