Privacy Policy

1. Data controller

YaFandem. Data-related contact: ya.fandem.eg@gmail.com.

No postal address is published during the pilot phase; it will be once the legal entity exists.

2. Data we collect

Account: email address, password (stored as a scrypt hash — never in clear text), first and last name, language, profile photo, and phone number if you provide one (optional).

Professionals: bio, trades and prices, service areas, spoken languages, availability, work photos, years of experience, and — if you request verification — ID document and face photo.

Activity: service requests (description, photos, district, budget), bookings, messages, reviews, reports and blocks.

Technical: IP address (login rate limiting and abuse prevention), error logs, approximate location of the district you select. We use no advertising cookies or third-party trackers.

3. Why we use it

Running the service: creating your account, displaying profiles, enabling matching, bookings and messaging.

Safety and trust: automatically masking contact details before a confirmed booking, limiting login attempts, verifying identities, handling reports and disputes.

Improvement: aggregated usage metrics (jobs completed, reorder rate) — no advertising profiling.

Legal obligations: retaining what is necessary in case of a claim or a request from a competent authority.

4. Who sees what

Public: your display name, your photo, and for professionals: trades, prices, districts, languages, availability, work photos, rating and reviews received. Reviews show the author's first name and last-name initial.

Never public: your email, password, phone number, ID documents, private messages, acceptance rate and revenue figures.

Our moderation team can access ID documents and, when a dispute is reported, strictly the elements needed to handle it.

5. Processors and transfers

Hosting: a dedicated server located in Europe, operated by YaFandem. The database and the files (photos, ID documents) are stored there — no third-party storage service is involved.

ID documents are kept in a private area of the server, never publicly served, and reachable only through signed temporary links that expire after one hour.

Resend: transactional emails (password reset, address confirmation). Only your email address is shared.

Remote video lessons: when a private lesson takes place remotely, the room is provided by the public meet.jit.si instance, operated by 8x8, Inc. Audio, video and anything shared on screen pass through that service and not through our servers: we have no access to them and record nothing.

The room name is generated by the Platform and is not guessable; the link is revealed to the two participants only on an accepted booking, ten minutes before the scheduled time. The room is not password-protected, however: anyone who knew its name could join. Do not share the link with anyone, and if a lesson involves a minor, stay present.

That service applies its own privacy policy and may process data outside Egypt. To avoid any third party, agree on an on-site lesson.

Machine translation service: when instant translation is active, the public text to translate (bio, listing description, review) is sent to the translation provider. Never write sensitive information in those fields. Private messages are never sent to that service.

6. Retention

Account and profile: while the account is active, then up to 12 months after closure.

Messages, bookings and reviews: kept for transaction traceability and dispute handling, then anonymised.

ID documents: kept in the private area of the server after review, so that a verification decision can be justified in case of a challenge or an authority request. They are not deleted automatically: you may request deletion by email and we do it manually.

Technical logs and anti-abuse counters: days to a few weeks.

7. Your rights

You may request access to your data, its correction, erasure, restriction of processing, or object to certain processing. You may also request a copy of your data.

Some of this is available directly from your profile (edit your details, delete a photo). For the rest, write to ya.fandem.eg@gmail.com — we respond within 30 days.

You may refer the matter to the Egyptian Personal Data Protection Centre if you believe your rights are not respected.

8. Security

Encrypted transport (HTTPS), passwords protected by scrypt hashing, session signed in a cookie inaccessible to scripts, login rate limiting, strict security headers, ID documents in private storage.

No system is infallible: in case of a breach likely to harm you, we will inform you and notify the competent authority.

9. Minors

The Platform is not intended for people under 18. We delete accounts we learn belong to a minor.