Privacy Policy

The controller is STORESWIKI LLC, Lewes, Delaware, United States of America. For privacy questions, requests or complaints, contact [email protected] or open a ticket in the in-product Support & tickets area. Using the ticket system gives us the context to verify and answer your request properly.

We operate with joint-venture partners who act as our service providers and may access personal data to deliver and support the Platform in their regions:

• •QURB LLC FZ — United Arab Emirates — regional delivery, operations and support for the Middle East. Access is limited to what that role requires.
• •AGILE CONSULTANCY SERVICES AB — Sweden — engineering, delivery and operations support for Europe. Access is limited to what that role requires.

We have not appointed an EU or UK representative or a statutory data protection officer. If you are in the EEA or UK and believe that affects your ability to reach us, contact us and we will deal with your request directly.

You give us

• •Account data: name, email address, password (stored only as a salted hash), language and display-currency preference, and your two-factor settings.
• •Profile data: for Experts, the application content — job title, years of experience, professional summary, education, skills, tools and platforms, portfolio items and links, and motivation statement. Some of this is public on your profile.
• •Engagement content: Jobs, Proposals, Services, Custom Offers, requirements, milestones, deliverables and uploaded files, time logs, reviews, private notes, and messages between users.
• •Support content: tickets, and anything you send us about a dispute, including evidence you choose to attach.
• •Tax and payout information you provide where required for payment.

We generate

• •Derived metrics: ratings, success score, on-time rate, completion rate, and counts of completed engagements.
• •Transaction records: amounts, currency, platform fee, tax applied, escrow state, release and refund history, receipts.
• •Moderation results: whether a listing, Job or upload was flagged, the reasons, and any decision an administrator made.
• •Audit records of administrative actions taken on an account, which we keep for accountability.

We collect automatically

• •Technical data: IP address, browser and device characteristics, pages requested, timestamps, and error diagnostics.
• •Cookies and similar technologies, described in our Cookie Policy.

We receive from others

• •From our payment processor: the RESULT of identity verification (verified, pending, failed), payout account status, payment and refund outcomes, and chargeback notices. We do not receive your document images or full card number.
• •From an identity provider if you sign in with one, the basic profile information you authorise it to share.

Where the GDPR or a comparable law applies, we rely on the following legal bases. "Contract" means processing necessary to provide the Platform you asked for; "legitimate interests" means our interest, balanced against yours.

Providing the Platform — contract

Creating your account, matching Clients and Experts, running engagements, hosting deliverables and messages, showing your public profile.

Payments, escrow and payouts — contract and legal obligation

Taking payment, holding funded amounts, releasing funds, paying Experts, issuing receipts, and keeping the accounting records we are required to keep.

Identity verification and anti-fraud — legal obligation and legitimate interests

Verifying Experts before they handle paid work, preventing fraud, money laundering, sanctions breaches and chargeback abuse, and protecting other users.

Moderation and platform safety — legitimate interests

Screening listings, Jobs and uploads, including automatically, and reviewing them where a screen flags something.

Disputes — contract and legitimate interests

Reviewing the engagement record and evidence in order to decide what happens to funds we hold.

Support — contract and legitimate interests

Answering tickets and diagnosing problems you report.

Service messages — contract

Notifying you about your account, an engagement, a payment or a dispute. You cannot switch these off while you have an active account, because they are part of the service.

Marketing email — consent, or legitimate interests where permitted

Product announcements. Every marketing message has an unsubscribe link and unsubscribing does not affect service messages.

Improving the Platform — legitimate interests

Aggregated and de-identified analysis of how features are used, and diagnosing performance problems.

Legal claims and compliance — legal obligation and legitimate interests

Complying with law, responding to lawful requests, and establishing or defending legal claims.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not make decisions producing legal effects about you by automated means alone: an automated moderation flag can hide content pending review, but a person makes the decision, and you may ask us to review it.

Experts must verify their identity before taking paid work. Verification is performed by Stripe Identity, operated by Stripe, Inc., not by us. Naming it matters: Stripe, not STORESWIKI LLC, is the company that receives and holds your identity document.

• •You submit a government-issued document and a selfie directly to Stripe. Those images are collected and held by Stripe under its own privacy policy, and are never transmitted to or stored by us.
• •We receive the outcome — verified, pending or failed — an identifier for the verification session, and the expiry. We use it only to decide whether you may take paid work.
• •Card details are entered on the processor's hosted checkout. We never see or store the card number, and no publishable key or card field exists in our own pages.
• •For payouts, the processor collects the account and tax information it needs and tells us only whether the account can receive money.

• •Public: your display name and avatar, and for approved Experts your professional profile — headline, summary, approved skills, platforms, portfolio, badges, published Services, ratings, reviews and derived metrics.
• •Visible to a counterparty in an engagement: your name, the engagement content, messages, requirements, milestones, deliverables and time logs.
• •Visible to a Client reviewing applicants: your Proposal, its price, delivery time and revision count, and your profile.
• •Never shown to other users: your email address, your password, your identity-verification data, your payout or tax details, your private notes, and your support tickets.

A review you write, and an Expert's response to a review, are public and remain visible after an engagement ends. Do not put anything in a listing, message or review that you would not want a counterparty — or in some cases the public — to read.

We share personal data only as described here.

• •Payments, escrow, identity verification and payouts: Stripe, Inc. and its affiliates.
• •Hosting, storage and transactional email: Amazon Web Services, Inc.
• •In-product support messaging and help content: Intercom, Inc.
• •AI drafting and automated moderation: OpenAI, OpenRouter and comparable model providers — see section 8.
• •Push notification delivery for our mobile app, where you enable it: Expo and the platform push services of Apple and Google.
• •Our joint-venture partners, as service providers, for regional delivery and support.
• •Professional advisers, auditors and insurers, under confidentiality, where necessary.
• •Authorities, where we are legally required, and parties to a legal claim where necessary to establish or defend it.
• •An acquirer or successor, if we are involved in a merger, reorganisation or sale of assets; we will tell you if that changes who controls your data.

Service providers act on our instructions under contract, may use the data only to provide their service to us, and must protect it. A current sub-processor list is maintained in our Data Processing Addendum.

Two features involve AI, and both send text to a third-party model provider.

AutoGiny drafting

When you ask AutoGiny to draft a Proposal cover letter, we send the model provider the relevant parts of your own approved Expert profile — headline, years of experience, professional summary, skills and platforms, and portfolio titles — together with the public content of the Job you are applying to. We do not send your email address, payment details, identity data, private messages or support tickets.

Automated moderation

Listing, Job and upload content may be screened for policy breaches. Where a model is used, the content being screened is sent for that purpose.

• •Output is a draft. It is placed in an editable field and nothing is sent to anyone until you choose to send it.
• •We do not use your content to train third-party foundation models, and we instruct providers not to. Providers may retain content briefly for abuse monitoring under their own terms.
• •If you would rather not use AI drafting, do not use the feature; it is optional and the rest of the Platform works without it.

We are a US company operating in United States of America and, with our partners, in Europe, the Middle East and Asia. Personal data is therefore transferred across borders — including to the United States, and to our partners in the United Arab Emirates and Sweden.

Where we transfer personal data out of the EEA or the UK to a country without an adequacy decision, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses (with the UK Addendum or IDTA where relevant), together with technical and organisational measures such as encryption in transit and access control. You may ask us for information about the safeguards applied to a particular transfer.

We keep personal data only as long as we need it, then delete or anonymise it. In practice:

Account and profile

While your account is open. After closure we delete or anonymise it, except where a category below requires retention.

Transaction and tax records

Retained for the period required by accounting and tax law in the relevant jurisdiction, which is commonly seven years, and is not shortened by closing your account.

Engagement records and deliverables

While the engagement is live and for a period afterwards so a later dispute, chargeback or claim can be dealt with fairly.

Dispute and moderation records

Retained after resolution, so a decision can be explained and a pattern of abuse detected.

Identity verification result

Retained while you are an approved Expert and for a period afterwards to meet anti-fraud and legal obligations. The document images are held by the processor, not us.

Support tickets

Retained so we have the history of your issue.

Technical logs

Retained for a short period for security and diagnostics.

Marketing consent and unsubscribe records

Retained so we can prove we honoured your choice.

Depending on where you live, you may have the following rights. We apply them to everyone where we reasonably can, not only where the law compels it.

• •Access — a copy of the personal data we hold about you.
• •Rectification — correction of data that is wrong or incomplete.
• •Erasure — deletion, where we no longer have a lawful reason to keep it. Records we must retain for tax, accounting, dispute or fraud-prevention reasons are the usual exception.
• •Restriction and objection — including objecting to processing based on legitimate interests.
• •Portability — a machine-readable copy of data you gave us.
• •Withdraw consent — at any time, where consent was the basis. This does not undo processing already carried out.
• •Opt out of marketing — through the unsubscribe link or your notification preferences.
• •Not be discriminated against for exercising a right. If you are in California, we do not sell or share your personal data as those terms are defined there.
• •Complain to your data protection authority. We would rather you came to us first, but you do not have to.

To exercise a right, contact [email protected] or open a ticket. We will verify that the request comes from you — a request affecting an account or its money cannot be honoured on an unverified email alone — and respond within the period the applicable law allows, normally one month.

• •Encryption in transit, with HTTP Strict Transport Security enforced.
• •Passwords stored only as salted hashes; we cannot read your password.
• •Optional two-factor authentication, including authenticator apps and backup codes.
• •Card details and identity documents kept out of our systems entirely, by design.
• •Access controls and role-based administration, with an audit trail of administrative actions.
• •Rate limiting, input validation and automated screening of uploads.
• •Least-privilege access for staff and partners, granted only for the role performed.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data and the law requires it, we will notify you and the relevant authority within the required timeframe. Report a suspected vulnerability or account compromise to [email protected].

For your account, profile, payments and the operation of the marketplace, we are the controller. But when a business Client uses the Platform to run its own projects, the content it puts into those projects — its requirements, its files, its own customers' details if it chooses to include them — is data for which that business is the controller and we act as its processor.

For that processing, our Data Processing Addendum applies. It sets out our obligations, the sub-processors we use, and the security measures we maintain. If you are a business Client who needs a signed DPA, contact us.

We use cookies and similar technologies for sign-in, security, preferences such as language and display currency, and to understand how the Platform is used. Our Cookie Policy explains each category and how to control them.

We will update this policy as the Platform and the law change. The effective date at the top shows the current version. Where a change materially affects how we use your personal data, we will give notice in the Platform or by email before it takes effect.

STORESWIKI LLC, Lewes, Delaware, United States of America, trading as AutoGineer at autogineer.com, part of the StoresWiki group (storeswiki.com).

Privacy requests and questions: [email protected], or a ticket in the in-product Support & tickets area.