Legal

Privacy policy

Last updated: 8 August 2026

What we collect

  • Account details — name, email, phone, postcode, and either a password (stored as a secure hash) or a Google account identifier if you sign in with Google.
  • Provider profile details — bio, area, services, hourly rate, years of experience, photos you upload, contact email and phone, availability, blocked dates, and insurance details (insurer, policy number, expiry).
  • Customer requests and bookings — dates, times, postcodes, addresses, requested areas, notes, messages, favourites and reviews.
  • Payment data — our service charge is processed by Stripe. We never see or store full card details.

How we use it

  • To run the notice board: profiles, matching, bookings, calendars, notifications, messaging and reviews.
  • To send transactional emails (confirmations, reminders, changes, password resets). We don't send marketing without consent.
  • To calculate gradings from review data.
  • Automated (AI-assisted) checks may review booking details to flag errors or misuse; anything flagged is reviewed by a human.

Who sees what

  • Public: a provider's display name (first name and initial), bio, area, services, photos, hourly rate and combined total, grading, review scores and review text, and whether insurance details are on file — never the policy number itself.
  • Providers with a booking: see the customer's name, address, requested areas and messages. Open notice-board requests show only the postcode, never the full address.
  • Customers with a confirmed booking: see the provider's payment details and direct contact details.
  • Reviewers are shown as first name and initial.

Where it lives

Data is stored with Supabase in the UK/EU region (London). The site is served by Netlify with Cloudflare DNS. Emails are sent via Resend. Payments are processed by Stripe. Google sign-in is provided by Google.

Your rights

Under UK GDPR you can request access to, correction of, or deletion of your personal data at any time. Email hello@canyoudo.uk and we'll act within 30 days. Deleting your account removes your profile and photos; booking records needed for legal or accounting purposes are kept only as long as required.

Cookies

We use only the strictly necessary session storage needed to keep you signed in. No advertising trackers.