Privacy Policy

1. Who We Are

You2Pro is an online marketplace based in the United Kingdom that connects customers with local service professionals (“Pros”). You2Pro is operated by YOU2PRO HOLDINGS LTD, company number 17319327, whose registered address is 124-128 City Road, London, EC1V 2NX, United Kingdom. References to “You2Pro”, “we”, “us”, or “our” in this policy refer to YOU2PRO HOLDINGS LTD.

This policy covers the You2Pro website (www.you2pro.io), the You2Pro customer app and the You2Pro Pro app. YOU2PRO HOLDINGS LTD is the data controller for the personal information described in this policy, and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us using the details in Section 15.

2. What You2Pro Does

You2Pro provides an online platform that enables customers to discover, request, and book local services from independent professionals. Services include — but are not limited to — home maintenance, cleaning, tutoring, beauty and wellness, and other local trades.

You2Pro acts as a marketplace intermediary. Services are provided directly by the independent Pros, not by You2Pro. You2Pro is not the employer of any professional using the platform.

3. Information We Collect

3.1 Information You Provide to Us

Customers

• Name and email address when you register. If you choose to sign in to the customer app with Google or Apple, we receive your name and email address from that provider
• Profile information (optional: photo and contact number)
• Saved addresses and the service address for each booking
• Service requests, booking details and any notes you add to a booking
• Payment information. Card details are entered into Stripe's payment form and processed by Stripe; You2Pro does not receive or store your full card number
• Messages you exchange with Pros through the app, and communications with You2Pro
• Reviews and ratings you submit after a booking

Professionals (Pros)

• Name, email address and phone number. Pros sign in to the Pro app with an email address and password
• Professional profile information (photo, bio, tagline, years of experience, services offered, pricing, service area, availability, and portfolio images and captions you upload)
• Identity verification information — see Section 3.2
• Compliance documents and references: proof of address, DBS certificates and details of community referees — see Section 3.3
• Your location — see Section 3.4
• Payout details. Bank account and identity details needed to receive payouts are provided directly to Stripe through Stripe's onboarding; we hold your Stripe account reference and the status of your payouts
• Booking, earnings and payout records
• Reviews and ratings you receive
• Support requests you send us from the app (subject, category and message)

Waitlist sign-ups

• Name, email address, location (such as city or postcode), and user type (customer or Pro)
• Optional phone number and service interest

Contact form submissions

• Name, email address, enquiry type and message
• Your consent confirmation and your browser's user-agent string

3.2 Identity Verification for Pros

Before a Pro's profile can be shown to customers, the Pro must complete an identity check. We use a specialist identity-verification provider, Shufti Pro, to carry out this check. During the check, Shufti Pro:

• captures an image of an identity document you choose (passport, driving licence or national identity card) and reads the information printed on it;
• captures a selfie and compares your face with the photo on the document, including a liveness check to confirm that a real person is present; and
• collects technical information about the device and connection used for the check, such as IP address, approximate IP-based location and browser details.

To help Shufti Pro match the document to you, we send it your name, email address and preferred language, and your date of birth if we hold it. Shufti Pro returns the outcome of the check to us. We store that outcome together with the information Shufti Pro extracts from the document (for example your name, date of birth, document type, document number, issuing country, issue and expiry dates, and the address shown on the document, where there is one), the face-match result and the technical information described above. The document images and selfie themselves are held by Shufti Pro and are not stored in You2Pro's database.

The result of the check, together with our other trust checks, determines whether a Pro's profile can be shown to customers. Our team can review a verification result manually. If you have questions about a verification decision, contact us using the details in Section 15.

3.3 Compliance Documents and References for Pros

Some services on You2Pro require extra checks before a Pro can accept bookings for them. Through the Compliance section of the Pro app you may be asked to provide:

• Proof of address — a photo or scan of a recent utility bill or bank statement showing your name and home address. These documents can also show other information printed on them, such as account details.
• DBS certificate — a photo or scan of your enhanced Disclosure and Barring Service (DBS) certificate, where a service you offer requires one (for example, some services involving children). A DBS certificate contains criminal-record information about you.
• Community references — the details of someone who can vouch for you: their full name, phone number, and optionally their email address, their relationship to you, their organisation and a short note about how they know you. This is personal information about another person, which you provide to us. Please let your referee know that you are sharing their details with us.

We use these documents and details to check that a Pro meets the requirements of the services they offer and to help keep the marketplace safe. Documents you upload are kept in private storage that only you and authorised members of our team can access; they are not shown to customers. A referee's contact details are not shown to customers or other Pros; our team uses them to check the reference. We record the result of each check.

Your documents and referee details are kept while your account exists. When you delete your account, the uploaded documents and your referees' details are deleted; a record that a check took place and its outcome is kept, without the link to your identity (see Sections 8 and 9).

3.4 Location Information

Pros

The Pro app asks for permission to use your device's location. Android lets you choose precise or approximate location; the app works with either, as long as the reading is accurate to within about 5 km. The app reads your location only while you are using it — when you complete onboarding, when you sign in, when you switch your availability on, and when you return to the app — and only records a new position if you have moved or your previous one is out of date. The app does not track your location in the background, and it stops updating your location while you are unavailable.

We store the location your device reports as your operating base and use it to work out which customers and bookings fall within your service area. We do not show that location to customers. On the customer map, your pin is placed at a fixed, privacy-offset point, typically 300–500 metres away from your stored location, and customers see distance as an approximate range rather than an exact figure. Your precise device location is not intentionally displayed to other users.

When you open the Pro dashboard, the app also sends your current location to our servers so we can tell which of our service areas you are in. We use that reading to choose the service area and do not store your precise reading.

Customers

The customer app asks for permission to use your device's location so it can centre the map on you, show Pros near you, and — if you choose — fill in your address automatically. You can decline and search or type an address instead. When you use your current location to fill in an address, your device's built-in geocoding service (provided by Google on Android and by Apple on iOS) converts the position into an address. We use the location sent with a search to find nearby Pros; we keep only a coarse area reference (roughly 10 km across) for 30 days, to detect misuse such as automated scraping of Pro locations.

For bookings, your service address is shared with the Pro in stages. A Pro cannot see a booking at all until your payment has been authorised. Before the Pro accepts, they see only the general area (such as the town and the first part of the postcode). Your full address, phone number and booking notes are released to the Pro once they accept the booking.

Job requests work differently. If you post a job request, Pros who are matched to it can see your name, the job details and the job address you entered — together with the job's map position — before they accept it. If you used your current location to fill in the job address, that address and map position come from your device's location and can be precise.

3.5 Information Collected Automatically

Website

• Log data (IP address, browser type, pages visited, timestamps) recorded by our hosting provider
• Session information (via authentication cookies, used for signed-in areas of the website)
• Your language and cookie preferences

The website does not currently use analytics or marketing cookies. See our Cookie Policy for details.

Apps

• Account and session information needed to keep you signed in
• A push-notification token for your device, if you allow notifications
• Crash and diagnostic information, described below

Crash reporting and diagnostics

Release versions of the You2Pro customer app and the You2Pro Pro app use Firebase Crashlytics, a service provided by Google, to report crashes and errors so that we can find and fix problems. A crash or error report contains technical information such as the error and where in the app it happened, your device model, operating-system version, app version, the time of the event and an identifier for the app installation. Crashlytics also records basic app-session information (Firebase Sessions) so that crashes can be related to the session in which they happened. Where it helps us diagnose an error, a report can include an internal reference number, such as a booking ID. We do not attach your name, email address or phone number to these reports. This is crash and diagnostic reporting, not advertising or marketing analytics.

App usage measurement (customer app)

The You2Pro customer app includes Google Analytics for Firebase, which records basic app-usage events — for example that the app was opened or updated, and session information — together with device and app information and an identifier for the app instance. We use this information to understand how the app is used and to improve it. The Pro app does not include Google Analytics for Firebase.

You2Pro does not show advertising in its apps or on its website, neither app contains an advertising SDK, and we do not use your information for behavioural advertising.

Marketing messages

We do not currently send marketing emails or marketing push notifications. The messages we send are about your account, bookings, payouts and security. The waitlist form includes an optional box to receive updates from us, and the Pro app's notification settings include marketing options, which are off unless you turn them on; we record these choices, and you can change the app settings at any time.

4. How We Use Your Information

We use personal information to:

• Provide, operate, and improve the You2Pro platform
• Show customers Pros who serve their area, and match bookings to Pros
• Process bookings and facilitate services between customers and Pros
• Process payments, refunds and Pro payouts via Stripe
• Send booking, account and security messages by email and push notification
• Respond to enquiries submitted through our contact form
• Notify waitlist members when early access becomes available in their area
• Verify the identity of Pros and decide whether a Pro's profile can be shown to customers
• Check Pros' proof of address, DBS certificates and community references where the services they offer require them
• Respond to support requests
• Detect, prevent, and address fraud, abuse, and safety issues
• Diagnose crashes and errors in our apps
• Comply with our legal and regulatory obligations

5. Legal Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract:Processing necessary to fulfil our agreement with you when you register, make or accept a booking, or receive payouts.
• Legitimate interests:Operating and improving the platform, diagnosing app errors, fraud prevention, and ensuring marketplace safety.
• Consent:Where you have given specific consent, such as when submitting a contact form or joining our waitlist.
• Legal obligation:Where processing is required to comply with applicable law, such as keeping accounting records.

Some of the information described in this policy is given additional protection under UK data protection law: the facial comparison carried out during identity verification (Section 3.2) and the criminal-record information contained in DBS certificates (Section 3.3). We process this information only for the purposes described in those sections. If you have questions about how we handle it, contact us using the details in Section 15.

6. How We Share Your Information

We do not sell your personal data. We may share information in the following circumstances:

6.1 Between Customers and Pros

Customers can see a Pro's public profile — name, photo, services, prices, ratings and reviews — and an approximate map position (see Section 3.4). When a booking is made, the Pro receives the customer's name and booking details, with the service address released in stages as described in Section 3.4. For job requests, matched Pros can see the customer's name and the job address before accepting, as described in Section 3.4. Messages you send through the app are visible to the other person in the conversation. You should only share information with others on the platform that is necessary for the service being arranged.

6.2 Service Providers and Other Third Parties

We use the following service providers and third parties to run the platform. Each receives the information needed for the purpose described:

• Supabase — database, file storage, user authentication and server functions. Our main database is hosted in the European Union (Ireland)
• Stripe — customer payments and refunds, and Stripe Connect for Pro onboarding and payouts. Stripe also processes the information it collects under its own privacy policy
• Shufti Pro — identity-document and face verification for Pros (Section 3.2). Shufti Pro also processes the information it collects under its own terms
• Google Firebase — push notifications (Firebase Cloud Messaging), crash reporting (Firebase Crashlytics and Firebase Sessions) and, in the customer app, app-usage measurement (Google Analytics for Firebase)
• Google Maps Platform — displaying the map in the customer app
• Mapbox — address search and converting addresses to map coordinates in the customer app. Address searches are sent to Mapbox from our servers, not from your device
• Resend — sending account and transactional emails
• Vercel — hosting the You2Pro website
• Hostinger — hosting our email mailboxes, which receive the emails you send to our you2pro.io addresses

We may engage additional providers as the platform develops, and will update this policy when we do.

6.3 Legal Requirements

We may disclose personal data to comply with a legal obligation, court order, or to protect the rights, property, or safety of You2Pro, our users, or others.

7. International Data Transfers

Our main database is hosted in the European Union (Ireland). Some of the service providers and third parties listed in Section 6.2 — including Stripe, Google, Shufti Pro, Mapbox, Resend, Vercel and Hostinger — may process personal data in other countries, including the United States. UK data protection law requires personal data transferred outside the UK to be protected, for example by adequacy regulations or the UK International Data Transfer Agreement or Addendum. You can contact us using the details in Section 15 for more information about international transfers.

8. Data Retention

We keep personal data only for as long as we need it for the purposes described in this policy:

• Account and profile data: for as long as your account exists. It is removed when you delete your account (Section 9)
• Identity verification data received from Shufti Pro: for as long as your account exists, and deleted when you delete it. A record of the verification outcome is kept as a compliance record, without the link to your identity. Shufti Pro keeps the document images and selfie it captures under its own retention terms
• Pro compliance documents (proof of address and DBS certificates) and community referees' details: for as long as your account exists, and deleted when you delete it. A record that each check took place and its outcome is kept, without the link to your identity
• Support requests: for as long as your account exists, and deleted when you delete it
• Payment, payout, wallet and refund records, dispute records, fraud-prevention and risk records, and administrative audit records: kept after account deletion for as long as needed to meet our legal, accounting and tax obligations, to handle chargebacks and disputes, and to prevent fraud — with the link to your identity removed, as described in Section 9
• Job requests posted by customers: kept after account deletion, with the link to your account removed. The job details, including the job address, remain in the record
• Search-area records used to detect misuse of the map: deleted after 30 days
• Contact form submissions: kept until your enquiry is resolved and for a reasonable period afterwards
• Waitlist data: kept until early access is offered in your area or the waitlist closes, or until you ask us to remove it
• Crash reports: kept by Firebase Crashlytics for a limited period under Google's retention settings

9. Deleting Your Account

You can delete your account yourself at any time in the You2Pro customer app or the You2Pro Pro app: go to Profile, tap Delete account, read the summary and confirm. If you cannot access the app, see our account deletion page for how to ask us to delete it instead.

Deletion is immediate and permanent; a deleted account cannot be restored. When your account is deleted, we remove your sign-in, your profile (including your name, contact details and photo), your saved addresses, your push-notification tokens, your support requests and, for Pros, your listings, availability, location, portfolio images, uploaded compliance documents, your referees' details and the identity verification data we received from Shufti Pro. Reviews written about you are deleted, and the content of emails we sent you is erased from our records.

Some records must be kept after deletion — payment, payout and wallet ledger records, refund and dispute records, fraud-prevention and risk records, verification and compliance-check outcomes, and administrative audit records — for legal, accounting, tax and fraud-prevention purposes. Bookings and messages are also kept where they form part of the other person's history, with any notes you added to a booking removed. Job requests you posted as a customer are kept, including the job details and job address. In these records, the link to your account is removed, so they show only that a deleted user was involved.

We cannot delete an account while something is still outstanding: a booking in progress or scheduled for the future, a payment or refund still being processed, money in your wallet, a payout that is on its way or still being resolved, or an open dispute or chargeback. If deletion is refused, nothing is changed; the app tells you which of these applies, and you can delete your account once it is resolved.

10. Cookies

We use cookies and similar technologies to operate our website. For full details of the cookies we use, please read our Cookie Policy.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted connections, database access controls that limit each user to the data they are entitled to see, the privacy offset applied to Pro map locations, staged release of customer addresses, and secure payment handling via Stripe. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

12. Your Rights

Under UK GDPR, you have the following rights:

• Access:Request a copy of the personal data we hold about you.
• Rectification:Ask us to correct inaccurate or incomplete data.
• Erasure:Request deletion of your personal data, subject to legal obligations. You can delete your account yourself in the app at any time — see Section 9.
• Restriction:Ask us to restrict processing of your data in certain circumstances.
• Portability:Receive your data in a structured, commonly used format.
• Objection:Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent:Where processing is based on consent, you may withdraw it at any time. You can also turn off location or notification access in your device settings at any time.

To exercise any of these rights, please contact us using the details in Section 15. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

13. Children

You2Pro is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will indicate the “Last updated” date at the top of this page. For significant changes, we may notify registered users by email or through the platform.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: