Privacy policy

What we collect, and when

• Quote request: your name, email, phone number (optional), the service, your location (country, city, optionally postal code) and your description of the job. We also note the page and campaign tags (utm) it came from, your language and the site you used.
• Account: your email, name (optional), language and a role (client, provider or admin). Your password is stored only as a one-way hash. If you sign in with Google, Google gives us your email and name. Sign-in links sent by email are single-use and stored only as hashes.
• Listing and claim requests from businesses: name, email, phone, a message, an optional link as proof of ownership and the languages you speak.
• Reviews: your name, rating and text, published on the business's page.
• Apprenticeship alerts and waiting lists: your email, country, trade and the page you signed up on.
• Businesses in the directory: business name, area, phone, website, email and languages, from the business itself or from public sources such as its own website. For sole traders this is personal data.
• Search: what you type in search and the location filter is logged without your name, email or IP address, so we can see what is missing.
• Location: if you let your browser share your location, it is used to pick the nearest city; approximate coordinates are sent to our server to do that and are not stored.
• Email: a log of the messages we send (recipient, subject, time, type) and delivery events from our email provider (delivered, bounced, complaint, opened, clicked, unsubscribed), and a list of addresses we must never email again.
• Payments (businesses only): paying the one-time contact unlock goes through Stripe. We receive the payment confirmation and a Stripe customer ID, never your card number.
• On your device: a sign-in cookie while you are signed in, a small cookie (hl_ui, 30 days) that remembers you are signed in so the page header can show it, a language cookie (NEXT_LOCALE) on the home page, and local storage for your chosen region, your seasonal-checklist ticks and your light/dark preference. Local storage never leaves your browser.
• Visit statistics, with cookies (Google Analytics 4): the pages you open, how you arrived, rough location, device and browser type, and events such as sending a quote request. It receives your IP address.
• Session recordings and heatmaps, with cookies (Microsoft Clarity): where you click and scroll and how the page looks while you use it. Clarity masks what you type into form fields.
• Page-view counter (Marketinque): which pages are viewed and where visitors came from (the page you arrived from and any campaign tags in the link), without cookies and without storing anything on your device. It makes a one-way daily code from your IP address and browser to count a visit once; the IP address and browser string are not stored, the code's key is deleted at the end of each day, and page views are kept for 30 days. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. This counter runs on hirelocal.services only.
• Abuse protection and server logs: to stop form spam, your IP address is held briefly in the server's memory to limit how often you can submit; it is not saved to our database. The host keeps standard server logs.

Why, and on what basis

• To answer your quote request, run your account and handle your listing or claim: it is needed to provide what you asked for (GDPR Art. 6(1)(b)).
• To publish your review or send you alerts you signed up for: your consent, given when you submit the form and withdrawable at any time (Art. 6(1)(a)).
• To run a directory of local businesses, invite listed businesses to claim their page, keep our email sending safe and stop abuse: our legitimate interest (Art. 6(1)(f)). A listed business can object and be removed at any time.
• To understand how the site is used and improve it: statistics, recordings and the page-view counter are our legitimate interest, together with the consent rules for cookies and similar technologies.
• To keep payment records the law requires: legal obligation (Art. 6(1)(c)).

We do not sell personal data and do not use it for advertising.

Who else gets it

• Local businesses: your quote request (name, email, phone if given, location and description) is emailed to matching businesses so they can answer you.
• Brevo (sends our transactional and invitation emails and reports delivery events).
• Zoho (the mailbox we use to send invitations to listed businesses and to receive replies).
• Stripe (payments by businesses).
• Google (Analytics 4 and sign-in with Google) and Microsoft (Clarity).
• Marketinque (the page-view counter).
• DigitalOcean (hosts the site, its database and backups).

Some of these providers process data outside the EU/EEA, under the standard contractual clauses or other transfer mechanisms they publish.

How long we keep it

• Marketinque page views: 30 days.
• Google Analytics: the retention period set in the property, at most 14 months. Microsoft Clarity: at most 13 months; recordings are shorter-lived by default.
• Quote requests, accounts, claim requests, reviews and alerts: while they are needed for the purpose above and until you ask us to delete them or close your account. There is no automatic deletion schedule yet, so if you want something gone, write to us.
• The list of addresses we must not email and the email log: kept so that we never email an address that opted out.
• Sign-in cookie: up to 30 days. Sign-in links: short-lived and single-use.
• Search log: kept without any identifier.
• Payment records: as long as tax and accounting law requires.

Your rights

You can ask for a copy of your data, a correction, deletion, restriction of its use or a portable copy, object to how it is used and withdraw consent, by emailing [email protected]. We answer within 30 days. If your business is listed and you did not add it yourself, you can ask us to correct or remove it, or reply to any invitation email, or use its unsubscribe link. Signed-in users can edit their name and language in the account page. You can also block cookies or the analytics tags in your browser, or turn on Do Not Track or Global Privacy Control. You have the right to complain to the Polish data protection authority (UODO, uodo.gov.pl) or to the authority in your own country.