1. Who is responsible
Ask Favr Ltd, CRO 796548, is the controller of personal information used to operate AskFavr. Our address is 6–9 Trinity Street, Dublin 2, Ireland. For privacy questions or rights requests, email contact@favr.online.
2. Information we use and where it comes from
You provide account details, profile information, skills, requests, locations, messages, preferences and any information sent to support. We also use booking and payment records, identity or payment verification status, account and device identifiers, sign-in and security records, and notification delivery information.
Other members may provide information about you in a conversation, booking, review or report. Payment and authentication providers supply information needed to confirm sign-in, payment eligibility and transaction outcomes. We receive technical information when you connect, including network and device information needed to provide and protect the service.
Booking evidence may include a snapshot of task details, the location supplied for the task, the parties, the agreed price and payment breakdown, the payment reference, and the policy version and acceptance recorded for the booking. This is kept to administer the agreement, investigate discrepancies and meet applicable obligations.
Card details are entered through the payment provider. We receive payment references, status and associated transaction details. Avoid putting identity documents, banking credentials, health information or other unnecessary sensitive information into public requests or conversations.
Optional Google sign-in: where this option is enabled, Google provides a verified account identifier, email address and name to authenticate you or start a new AskFavr account. We request only basic sign-in information, not access to your Gmail, contacts or files. Google receives the information needed to process your sign-in under its own privacy terms. We keep a protected identifier linking your Google identity to your AskFavr account; signing in does not publicly disclose your email. An existing AskFavr account is linked only after you sign in to that account and choose to link Google. You can continue using email instead. Google sign-in is not an identity background check. Closing your AskFavr account removes this link; you can also remove AskFavr access in your Google Account settings.
Social sign-in attempts expire after at most ten minutes. Their temporary verification information is removed on completion or by cleanup within five minutes after expiry while the service is running. We do not keep Google access or refresh tokens for later access to Google services.
Following and official updates: we store the people you choose to follow, your per-person alert choices and which FAVR updates you have read, to provide those features and keep unread counts consistent across your devices. Follow relationships and read receipts are not displayed publicly. Following someone does not give access to private conversations, exact locations or bookings. You can unfollow at any time. Official stories remain available in Messages; their unread counter can be muted separately from optional push notifications. Editorial and followed-person push alerts require your choice and device notification permission.
3. Why we use information
To provide the service you request: we use account, profile, task, location, conversation and transaction information to create your account, find relevant tasks or helpers, arrange bookings and payments, and respond to related support requests. The legal basis is performance of our agreement with you or steps you request before making an agreement.
To protect and improve the service: we use relevant account activity, reports, messages, transaction records and technical information for security, fraud prevention, proportionate moderation, resolving disputes and understanding use of our service. We rely on legitimate interests in protecting members, maintaining a reliable marketplace and establishing or defending claims, balanced against your rights. You may object to processing based on legitimate interests.
With your consent: optional device location, discovery alerts and city launch updates use the information you choose to provide for that purpose. You can withdraw these choices through the relevant app or device settings or by contacting us. Withdrawal does not affect earlier lawful processing. You may optionally tell us how you heard about AskFavr to help us understand how members find the service; that answer is not required to register.
To meet legal duties: we retain and disclose records where applicable accounting, tax, payment, court or regulatory obligations require it. We assess the scope of a request before disclosing information.
4. What other people can see
Your public profile and published requests are visible to other people using those features. Share only the information needed for the task. Public request locations are presented approximately; we may hold a more precise location that you supplied to arrange the task. You can select an area manually instead of enabling device location. AskFavr does not continuously track your movements.
Messages are available to the participants. Authorised staff may access relevant conversations and records to investigate reports, provide support or resolve a dispute. A report may require us to describe the concern to the other party so they can respond; we limit disclosure to what is necessary and consider the reporter's safety. Payment and account administration records are not public.
Within a booking or payment review, each participant's statements, evidence notes and uploaded photos are visible to that participant and authorised reviewers. The other participant sees the case status and final decision. We remove embedded image metadata when processing review photo uploads. Do not upload unrelated people, documents or sensitive details; include only what is needed to explain the issue.
5. Service providers and other recipients
With your consent, the public website uses Google Analytics for page visits and clicks to open the app or App Store. It receives technical connection information but is not connected to your ASK FAVR account or payment records. You can withdraw consent through “Cookie choices” in the website footer. Our Cookies notice explains the data, storage and controls.
We use providers for hosting and file storage (AWS), database and authentication services (Supabase), payments and helper verification (Stripe), maps and address lookup (Mapbox), and notifications (OneSignal), together with email delivery and technical support services. Where automated content moderation is used, relevant submitted text may be sent to OpenAI for assessment. Only information relevant to the service or check should be shared with the provider.
Some providers act on our instructions; others, including payment providers for their own regulatory purposes, have independent responsibilities and privacy notices. We may share necessary records with professional advisers, competent authorities or a party to a dispute where legally required or otherwise justified. We do not sell your personal information.
Password safety: when you create or replace an email password, our server checks the Pwned Passwords service operated by Have I Been Pwned. It sends only the first five characters of a SHA-1 digest, with response padding, and compares the returned suffixes locally. It does not send your password, complete digest, email, account identifier or device IP address to that service. The service receives our server connection information. This security check supports our legitimate interest in protecting accounts. It does not replace the bcrypt password hash used for account authentication. If the safety check is unavailable, creation or replacement of an email password must be retried; existing sign-in remains available.
6. International processing
The current application server is in AWS Frankfurt. The production Supabase database is in Ireland and the separate beta database is in Frankfurt. These locations do not mean that every provider operation, support access or transfer stays within the European Economic Area. Our service providers may process information outside the European Economic Area. International transfers require an applicable legal safeguard, such as an adequacy decision or approved contractual safeguards, together with any necessary additional protection. You can request details of the countries, recipients and safeguards relevant to your information, and a copy of applicable safeguards, at contact@favr.online.
7. Automated checks and recommendations
Search and suggestions use information such as the area, categories, skills, availability and preferences associated with a request or profile. You can change the available filters and preferences. Automated checks can flag or prevent content that appears to breach our rules, including unsafe content or inappropriate sharing of contact details. Checks can be wrong. Contact support to ask for human review of a restriction or rejected content.
8. How long information is kept
Account and profile information is used while you maintain the account. Some records must remain after closure to finish payments, resolve disputes, meet legal obligations or handle safety and legal claims. We assess necessity using the purpose, type of record, applicable legal period and whether an issue remains outstanding. Your Data and Account Deletion explains these criteria and how to request deletion. Information kept for those reasons has restricted access.
Review photos are available in the active service for up to 30 days from upload, or until the case closes if sooner. Access ends at expiry or closure. An automatic cleanup runs at startup and hourly while the service is running to remove expired photos and photos for closed cases. A service outage can delay physical cleanup; access checks still apply when the service resumes. This specific rule concerns uploaded review photos, not all booking, payment or written case records. Restricted backups and independent providers are addressed in Your Data and Account Deletion.
Following choices and official-update read receipts are removed when the account is closed. Unfollowing removes that relationship and its alert-delivery records. We retain recent followed-person alert-delivery records for up to 30 days, with hourly cleanup while the service is running, to prevent repeats and enforce alert limits. An outage can delay that cleanup.
9. Your choices and rights
You may request access, correction, erasure, restriction, portability and information about our processing, and object where the law provides that right. Withdraw consent for optional uses at any time. You can close your account in Settings or ask us for help. We may ask for proportionate information to verify the request and protect another person's data.
We respond without undue delay and normally within one month. If a permitted extension is necessary because of the complexity or number of requests, we explain it within that first month; the extension may be up to two further months. We explain any refusal and the available remedies. Requests are normally free of charge, subject only to exceptions allowed by law.
You may complain to the Irish Data Protection Commission at https://www.dataprotection.ie or another competent supervisory authority, including where you live, work or believe an infringement occurred. You also retain the right to a judicial remedy.
10. Required information and changes
Account credentials and the details needed for a task or payment are necessary for those features. Without them, we may be unable to create an account or complete a booking. Additional profile details, optional alerts and device location are your choice. AskFavr is for people aged 18 or over; contact us if you believe a child has supplied personal information.
We update this notice when our processing changes and bring material changes to your attention. Acknowledging this notice does not give consent to every optional use of your information.