Privacy Policy

Khedmati operates a freelance services marketplace for Lebanon, connecting clients with independent sellers. For the personal data described in this policy, Khedmati acts as the data controller: we decide how and why that data is processed when you use the Khedmati website, applications, and related services (the "Platform").

For any privacy question or request, contact us at privacy@khedmati.me or through the Contact page. We aim to answer privacy inquiries within 30 days.

• Account data: Your name, email address, password (stored only as a secure hash), phone number, and whether you act as a client, a seller, or both.
• Profile data: Display name, photo, headline, bio, skills, languages, location, education, certifications, and portfolio items you choose to publish.
• Payout details: To process withdrawals we collect the details for your chosen method: a Whish Money wallet number, an OMT recipient name and phone number, or bank account details. We may ask you to confirm these details before a payout as a light identity check.
• Orders and transactions: Services and packages bought or sold, order statuses, amounts, escrow movements, balances, withdrawals, and refunds.
• Messages and order content: Conversations between clients and sellers, order requirements, delivered files, revision requests, reviews, and dispute evidence.
• Usage data: Pages visited, searches, clicks, and feature usage, collected as analytics to understand how the Platform is used.
• Device data: IP address, browser type, operating system, and screen size, used for security and compatibility.
• Support data: Support requests, reports you submit about content or users, and our correspondence with you.

• Provide the service: Operate accounts, listings, jobs, orders, messaging, reviews, and seller analytics.
• Process payments: Collect order payments, hold funds in escrow, credit seller balances, and process withdrawals through our payment partners.
• Keep the Platform safe: Detect and prevent fraud, payment circumvention, spam, and abuse; enforce our Terms of Service; and secure accounts.
• Transactional notifications: Send order updates, delivery and revision alerts, dispute notices, withdrawal confirmations, and security alerts. These messages are part of the service and are sent to all users.
• Marketing: We send promotional emails only if you have opted in through your notification preferences, and you can opt out again at any time.
• Improve the Platform: Analyze aggregated usage to improve search, categories, and features.
• Meet legal obligations: Keep required financial records and respond to lawful requests from authorities.

• Performance of a contract: Most of our processing is necessary to provide the marketplace you signed up for: accounts, orders, escrow, messaging, and payouts.
• Legitimate interests: Fraud prevention, Platform security, and service improvement, always balanced against your rights and reasonable expectations.
• Consent: Marketing communications and any optional features that explicitly ask for your permission. You can withdraw consent at any time without affecting the rest of the service.
• Legal obligation: Retaining financial and transaction records and cooperating with lawful requests from competent authorities.

• With other users: Your public profile, listings, portfolio, and reviews are visible to visitors of the Platform. When you enter an order, the other party sees the information needed to complete it, such as your display name, requirements, messages, and deliveries.
• Payment providers: Whish Money receives the data needed to collect payments and pay withdrawals. OMT or your bank receives your payout details when you choose those withdrawal methods.
• Service providers: We use Supabase for hosting, database, authentication, and file storage, and an email delivery provider for transactional notifications. These providers act under contract and process data only on our instructions.
• Legal reasons: We may disclose data when required by law, court order, or governmental authority, or to protect the rights, property, or safety of Khedmati, our users, or the public.
• Business transfers: If Khedmati is involved in a merger, acquisition, or asset sale, user data may be transferred as part of that transaction under protections equivalent to this policy.

We never sell your personal data to anyone.

• Account and profile data are kept for as long as your account is active.
• Financial and transaction records (orders, escrow movements, withdrawals, and invoices) are retained after account closure for as long as Lebanese commercial, tax, and anti-fraud rules require.
• When you delete your account, your profile data is deleted or anonymized within 30 days. Messages and order records that involve another user may be retained in anonymized form so the other party keeps an accurate history.
• Backup copies are purged on a rolling schedule following deletion.

You can exercise the following rights at any time, through your account settings where available or by contacting privacy@khedmati.me:

• Access: Ask for a copy of the personal data we hold about you.
• Correction: Update inaccurate or incomplete data. Most profile and account data can be edited directly in your settings.
• Deletion: Request deletion of your account and personal data, subject to the retention requirements described above.
• Objection and restriction: Object to processing based on legitimate interests, or ask us to restrict processing while a request is being reviewed.
• Export: Receive the data you provided to us in a structured, commonly used, machine-readable format.

We may need to verify your identity before acting on a request, and we respond within 30 days.

We keep browser storage light and functional:

• Session: Secure tokens in your browser keep you signed in between visits.
• Preferences: Your theme choice (light or dark) and similar interface preferences are stored locally on your device.
• Analytics: Basic usage measurements help us understand which features matter; wherever possible these are aggregated rather than tied to you personally.

We do not use third-party advertising cookies. You can clear stored data through your browser settings at any time; doing so signs you out and resets your preferences.

• All traffic between your device and the Platform is encrypted in transit using TLS.
• Database access is governed by row-level security policies, so each account can only read and change the records it is permitted to.
• Passwords are stored as salted hashes and are never visible to staff.
• Two-factor authentication (2FA) is available in your security settings and recommended for every account.
• Internal access to production data is limited to what staff need in order to operate the service.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as required by applicable law.

The Platform is intended for users aged 18 and over, and we do not knowingly collect personal data from anyone under 18. If we learn that a minor has created an account, we will close it and delete the associated data. If you believe a minor is using the Platform, please contact us at privacy@khedmati.me.

Khedmati serves users in Lebanon while our infrastructure, including the Supabase database and file storage, is hosted in the European Union. Your data is therefore transferred from Lebanon to EU-based servers, where it benefits from EU data protection standards. Where any of our providers process data elsewhere, we require contractual safeguards consistent with this policy.

We may update this policy as the Platform, our providers, or the law change. The "Last updated" date at the top of this page always reflects the current version. For material changes, we will notify you by email or by an in-app notice before the change takes effect. Continued use of the Platform after that date means the updated policy applies to you.

For privacy questions, requests, or complaints, write to privacy@khedmati.me or use the Contact page. If you are not satisfied with our response, you may also have the right to lodge a complaint with a competent data protection authority.