Privacy policy

This Privacy Policy applies to the Onelacks website, accounts, marketplace, support, and related communications operated by [TODO-LLC: legal company name]. It applies to customers, independent providers, applicants, visitors, and people who contact us.

It does not replace the privacy notice of a provider, Stripe, Google, or another service that handles information for its own purposes. Their policies apply to their independent processing.

Account and profile information

We collect information you provide when you register or update a profile, such as your name, email, phone number, date of birth, address, service area, profile photo, languages, account type, and consent records. Provider applications may include experience, services, qualifications, licenses, tax details, payout readiness, identity verification status, and screening status when those features are active.

Tasks, bookings, and communications

We collect service requests, addresses, schedules, budgets, booking details, completion notes, uploaded photos, reviews, support messages, safety reports, disputes, blocks, and messages sent through the platform. A coordination phone number is optional at signup but may be required before a booking is confirmed.

Payments

Stripe handles payment cards and provider payout accounts. Onelacks does not receive or store complete card numbers or bank credentials. We receive processor references and transaction details such as a Stripe customer identifier, payment status, amount, fees, taxes, refunds, payout status, and limited card details such as brand and last four digits.

Device, log, and cookie information

When you use Onelacks, our systems may collect IP address, browser and device type, operating system, page requests, dates and times, referral source, session activity, security events, approximate location derived from network information, and error or performance data. We use cookies and similar storage as described in the Cookie Policy.

If you sign in with Google, Google provides the account identifier, verified email, name, and other fields shown on the consent screen. We do not receive your Google password.

We use personal information to:

• Create, authenticate, secure, and support accounts.
• Match service requests with providers and operate tasks, bookings, messages, reviews, and calendars.
• Authorize and capture payments, calculate fees and taxes, issue refunds, and support provider payouts.
• Verify eligibility, review provider applications, and enable screening when configured.
• Send verification, security, booking, payment, policy, and support communications.
• Prevent fraud, enforce marketplace rules, investigate disputes, and protect users and the platform.
• Debug, measure, maintain, and improve reliability, accessibility, and user experience.
• Meet tax, accounting, legal, regulatory, audit, and recordkeeping duties.

Where applicable law requires a legal basis, we process information to perform a contract, comply with law, protect legitimate interests such as safety and fraud prevention, or act on consent. You may withdraw consent for future optional processing without affecting earlier lawful processing.

Customers and providers

Before booking, users may see public profile, service, price, availability, rating, and review information. After a booking is confirmed, the assigned customer and provider may see each other's first name, coordination phone number, service address, schedule, and booking details as needed to perform the work. We do not make those private coordination details public.

Processors and infrastructure

We use service providers that process information for defined operational purposes:

• Stripe for card payments, payment authorizations, refunds, tax tools, and provider payouts.
• Resend for transactional email delivery.
• AWS S3 for configured file storage.
• Google for optional sign in, and for maps, address lookup, and geocoding: pages with an address field load the Google Maps JavaScript API in your browser, so Google receives the address text you type and your IP address under its own terms.
• Render for the application programming interface, workers, databases, and cache services.
• Vercel for the public web application and delivery network.
• Sentry for error and performance monitoring, when a deployment configures it. Reports pass through a filter that removes user identity, request data, cookies, and headers and redacts most messages before they are sent; the filter reduces, but cannot guarantee the absence of, personal information in a report.
• Plausible or Google Analytics 4 for page-view analytics, only in a deployment where that integration is configured; neither is used for advertising.

These providers may process information only as permitted by their agreements with us, their own independent legal duties, and applicable law.

Legal, safety, and business events

We may disclose information when reasonably necessary to comply with legal process, enforce agreements, collect amounts owed, investigate fraud or abuse, respond to an emergency, or protect rights, property, and safety. We may also transfer information in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice where required.

We keep personal information only as long as reasonably needed for the purposes described in this policy, including providing the account, completing transactions, resolving disputes, maintaining security, and meeting legal, tax, accounting, and audit duties. Retention periods vary by record type and legal requirement.

Self service account deletion immediately deactivates sign in and removes the public profile from normal marketplace use. Saved payment methods and the Stripe customer are removed through that flow. A deleted account can be restored by signing in within 30 days; after that window the account record is anonymized. Booking, payment, dispute, fraud prevention, tax, and audit records may be retained in minimized or anonymized form for legal and financial reasons. Full erasure may be requested using the process below. Backup copies may remain for a limited period until securely overwritten.

Onelacks extends the following privacy request options nationwide as a company policy, even when a state law does not require every option:

• Ask whether we process your personal information.
• Request a portable copy of personal information associated with your account.
• Ask us to correct inaccurate account information.
• Request deletion or erasure, subject to lawful retention needs.
• Opt out of optional marketing communications.
• Appeal a denied privacy request by replying to the decision.

Email support@onelacks.com from the address on your account. We will verify the request by asking you to reply from that email and confirm a recent account detail. Do not send a password, full card number, government identifier, or authentication code. We aim to complete a verified request within 45 calendar days and will explain any lawful exception.

You may use an authorized agent where law permits. We may require proof of authority and direct identity confirmation. We will not discriminate against you for exercising a privacy right.

You can update profile details and communication preferences in your account. You may block another user, report a safety concern, withdraw optional consent, or manage cookies through browser controls. Some information is required to provide a requested service. Disabling essential cookies may prevent sign in, payment, or booking functions.

If text messaging is activated, SMS consent and opt out instructions will be shown where the number is collected. Text messaging is not used while the feature is disabled.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including encrypted transport, access controls, staff authentication, rate limits, security logging, environment separated secrets, payment processing through Stripe, and error monitoring that filters personal information out of reports. No system can promise absolute security.

Protect your credentials, use available multifactor authentication, and contact support immediately if you suspect account misuse. Google sign in inherits the security controls, including any two factor authentication, on your Google account.

Onelacks is for people age 18 and older. We do not knowingly collect personal information from children. If you believe a child submitted information, contact support so we can investigate and remove it where appropriate.

We may update this policy as the platform, vendors, or law changes. A new version is posted on this page with its version and effective date from our published record, and it is not in effect before that date. We will request consent if a new use requires it.

Privacy questions and verified requests may be sent to support@onelacks.com.

[TODO-LLC: legal company name, privacy contact, mailing address, and telephone number]