Privacy Policy for Bountee.io

1. Who We Are

Bountee.io (the "Platform") is a bounty-based task marketplace operated by CelestiaLabs Ltd ("CelestiaLabs", "we", "us", or "our"), a company incorporated in England and Wales with its registered office at 124 City Road, London, EC1V 2NX, United Kingdom. CelestiaLabs Ltd is the data controller for the personal data described in this Policy.

This Policy explains what personal data we collect, why we collect it, the legal basis on which we rely, who we share it with, how long we keep it, and what rights you have. It applies to visitors, registered users, Posters, Applicants, and Claimers. Terms capitalised but not defined here have the meaning given in our Terms and Conditions.

For any privacy question, or to exercise any of the rights in Section 8, contact us at contact@bountee.io.

The Platform is not intended for children. You must be at least 18 years old to register, as set out in Section 3 of the Terms and Conditions. We do not knowingly collect personal data from anyone under 18; if you believe we have, please contact us and we will delete it.

2. Data We Collect

2.1 Data You Provide

• Account details: first name, last name, email address, and a password (stored only as a secure hash, never in readable form).
• Optional profile details: telephone number, date of birth, profile picture, preferred currency, and your privacy settings.
• Addresses and locations: addresses you save, and the locations attached to Bountees you post.
• Content: Bountee descriptions, application messages, in-Platform messages, reviews and ratings, uploaded images, and anything else you submit to the Platform.
• Payout details: the bank account details you provide in order to receive payouts.
• Correspondence: contact form submissions, feedback, and support messages.

2.2 Data From Google Sign-In

If you register or sign in using Google, Google shares your email address, your Google account identifier, and, where available, your first and last name with us. We store the Google account identifier so we can recognise you on future sign-ins. We do not receive your Google password, and we request no access to your Google data beyond your basic profile and email address.

2.3 Data Collected Automatically

• Audience measurement: for each page you view we record the page path, the referring page, your browser's user-agent string, a truncated IP address, whether a signed-in session was present, and a random visitor identifier. See Section 5.
• Session records: when you sign in we record your browser's user-agent string, your IP address, and the session's expiry, so that you can review and revoke your active sessions.
• Consent records: the version of the Terms and Privacy Policy you accepted, when you accepted them, and the IP address from which you did so.
• Operational logs: technical logs generated in the course of running the Platform, used for security, debugging, and abuse prevention.

2.4 Payment Data

Card payments are processed by Revolut. We never receive or store your full card number, expiry date, or security code. We retain only the transaction records needed to operate the marketplace and meet our legal obligations: amounts, currency, status, timestamps, and the payment references issued by our payment provider.

3. Why We Use Your Data, and Our Legal Basis

Under the UK GDPR we must have a lawful basis for each purpose for which we use your personal data. Those bases are set out below.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and rights. You may object to such processing at any time, as described in Section 8.

4. What Other Users Can See

Bountee.io is a marketplace, so some of your data is shown to other users by design. Your display name, profile picture, rating, reviews you have given and received, and the Bountees you have posted or claimed may be visible to others. Reviews are published publicly and attributed to the reviewer.

You control much of this through the privacy settings in your account, which let you choose, field by field, whether a detail is visible to everyone, to registered users, to your connections, or to nobody but you. Some settings, such as how much of your last name is shown, offer a partial-disclosure option. Your date of birth is never shown to other users under any setting; where you choose to display your age, only the derived age is shown.

Users may follow one another. Follower lists are publicly visible by default and can be restricted through your privacy settings.

5. Cookies and Audience Measurement

5.1 Cookies We Use

• token — your sign-in session. Strictly necessary; set only when you sign in, and cleared when you sign out. Discarded when you close your browser, or after seven (7) days if you chose “remember me”.
• vid — a random visitor identifier, containing no personal detail, used for audience measurement and to record which version of our terms and privacy policy you accepted. Expires after one (1) year.

These cookies are first-party and set as HTTP-only, meaning they cannot be read by scripts running in your browser. We do not use advertising cookies, and we allow no third-party advertising or tracking on the Platform. The one third party involved at all is Google, whose sign-in script loads on our sign-in page and may set its own cookies — see our Cookie Policy for the detail.

5.2 Audience Measurement

We record pageviews in order to understand, in aggregate, how the Platform is used. This measurement is deliberately built so that it cannot identify you: the records are never linked to your account, IP addresses are truncated to network level before being stored, and whether you were signed in is recorded only as a yes/no flag, never as an identity. We use this data only in aggregate. On this basis it operates as first-party audience measurement and does not require your consent, in line with regulatory guidance on the equivalent exemption.

5.3 Your Choices

The cookies described above are strictly necessary, so there is no cookie setting to change: they cannot be switched off without stopping the Platform working, and we do not set any others. If we ever introduce a cookie that is not strictly necessary, we will ask for your consent before setting it. You can block or delete cookies at any time in your browser settings, though parts of the Platform will then stop working.

Marketing email is a separate consent, and one you can withdraw at any time — through the unsubscribe link in any marketing message we send, or in your account settings. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

6. Who We Share Your Data With

We do not sell your personal data. We share it only as set out below.

6.1 Service Providers

We use a small number of providers who process personal data on our instructions and under contract:

Content moderation is performed by our own systems on our own infrastructure; uploaded images are not sent to a third-party moderation service.

6.2 Other Users

As described in Section 4, and subject to your privacy settings.

6.3 Legal and Business Transfers

We may disclose personal data where required by law, court order, or a properly made request from a public authority, or where necessary to establish, exercise, or defend legal claims or protect the rights and safety of our users. If our business is merged, acquired, or its assets sold, personal data may be transferred as part of that transaction; we will notify you if this materially affects your data.

7. Automated Processing

Images you upload are automatically scanned before publication to detect prohibited material, including sexually explicit content. Where an image is flagged, the upload is refused and you are shown an error. This is an automated check applied to Content rather than a decision about you, and it does not by itself restrict your account. If you believe an image was refused in error, contact us and a person will review it.

We do not carry out automated decision-making that produces legal effects concerning you, or similarly significantly affects you, within the meaning of Article 22 of the UK GDPR. Decisions to suspend or terminate an account are taken by a person, and may be appealed under Section 13 of the Terms and Conditions.

8. Your Rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Access — obtain confirmation that we process your data, and a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed. Most details can be corrected directly in your account settings.
• Erasure — have your data deleted where we no longer have grounds to keep it. You can delete your account at any time from your account settings; see Section 9 for what is erased and what we must retain.
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Objection — object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.
• Portability — receive the data you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another controller.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email contact@bountee.io. We will respond within one month, and will tell you if we need longer because the request is complex. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, you may complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to address your concerns first.

9. How Long We Keep Your Data

• Account data: for as long as your account is open. When you delete your account, your name, email address, telephone number, date of birth, password, profile picture, privacy settings, active sessions, and linked sign-in providers are erased or irreversibly anonymised immediately.
• Public Content: Bountees and reviews may remain visible after account deletion, but are no longer attributed to an identifiable person.
• Financial and tax records: seven (7) years, as required by UK law. These are retained even after account deletion.
• Consent records: retained for as long as needed to evidence the consent given, and for a reasonable period afterwards.
• Audience measurement and operational logs: retained for a bounded period and then deleted or aggregated.

10. Where Your Data Is Held

We host the Platform within the United Kingdom or the European Economic Area. Some of our service providers may process personal data outside the UK. Where that happens, we rely on an adequacy decision covering the destination country, or on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. You may request details of the safeguards applied by contacting us.

11. Security

We use technical and organisational measures to protect your data, including encryption of traffic in transit, one-way hashing of passwords, HTTP-only session cookies, sessions you can review and revoke, and access controls limiting who can reach personal data. No system is completely secure, and we cannot guarantee absolute security; if a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, you, in accordance with UK data protection law.

12. Changes to This Privacy Policy

We may update this Policy from time to time. The date at the top of this page always shows when it was last revised. Where a change is material, we will give notice in the manner set out in Section 19 of the Terms and Conditions before it takes effect.

13. Contact Us

For any question about this Policy or about how we handle your personal data:

Email: contact@bountee.io

Address: CelestiaLabs Ltd, 124-128 City Road, London, England, EC1V 2NX