1. Introduction

Survd ("we", "us", "our") operates the Survd web application (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform, whether as a customer booking services or as a vendor offering services.

By using Survd, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

Name (first and last)
Email address
Phone number
Date of birth
Gender (optional)
Profile image (optional)
Authentication credentials (password or third-party OAuth tokens)

2.2 Vendor Information

If you register as a vendor, we additionally collect:

Business name and username
Business address and geographic coordinates
Service categories, specialties, and years of experience
Business images, portfolio photos, and cover images
Payment and banking details (account holder name, account number, sort code) for payouts
Staff member details (name, role, contact information)
Business policies (cancellation fees, late fees, no-show fees)
Social media handles (e.g. Instagram)

2.3 Address Information

We collect home and/or work addresses you provide for location-based services, including street address, city, postcode, and country.

2.4 Payment Information

Payment processing is handled by Stripe. We store only limited card details (card brand, last 4 digits, expiry date, and billing address). Full card numbers are never stored on our servers; they are processed and secured entirely by Stripe in accordance with PCI-DSS standards.

2.5 Booking & Transaction Data

When you make or receive a booking, we collect:

Booking reference, date, time, and service details
Payment status, amounts, and refund information
Cancellation, late, and no-show records

2.6 Guest Booking Data

If you book as a guest without an account, we collect your name, email, phone number, and generate a device identifier stored in your browser's local storage to associate your bookings and reviews.

2.7 Location Data

With your permission, we access your device's geolocation to show nearby vendors and calculate distances. You can deny or revoke location permission at any time through your browser settings. We also use Google Places API to provide address search and autocomplete functionality.

2.8 Messages & Communications

Messages exchanged between customers and vendors through our in-app messaging system are stored on our servers, including text content, image attachments, and read status.

2.9 Reviews & Ratings

Reviews, ratings, comments, and optional tips you leave for vendors are stored and publicly displayed on vendor profiles.

3. How We Use Your Information

We use the information we collect to:

Create and manage your account
Facilitate bookings between customers and vendors
Process payments, refunds, and vendor payouts
Show you relevant nearby vendors based on your location
Enable in-app messaging between customers and vendors
Send booking confirmations, reminders, and status updates via email and in-app notifications
Verify your identity and prevent fraud
Enforce our Terms of Service and business policies
Improve and maintain the Platform

4. Third-Party Services

We share data with the following third-party providers who process it on our behalf:

Firebase (Google) — Authentication, database storage (Firestore), file storage (Firebase Storage), Cloud Functions, and App Check (reCAPTCHA v3) for security.
Stripe — Payment processing, card storage, refund handling, and vendor payouts via Stripe Connect.
Google Maps Platform — Address autocomplete, place details, and reverse geocoding for location-based features.
Brevo (formerly Sendinblue) — Transactional emails such as booking confirmations and account notifications.
Upstash — Rate limiting to protect the Platform from abuse.
ZeroBounce — Email address validation.

Each of these providers has their own privacy policy governing how they handle your data. We encourage you to review their respective policies.

5. Cookies and Similar Technologies

The Platform stores a small amount of information on your device using cookies and similar technologies (browser local storage, session storage and IndexedDB). Some of this is set by us and some by the third-party services we rely on to run the Platform. The table below lists what is stored, who sets it, why, and for how long.

What	Set by	Purpose	Duration
Sign-in session (IndexedDB)	Firebase (Google)	Keeps you signed in to your account	Until you sign out
Data cache (IndexedDB)	Firebase (Google)	Stores copies of data you have viewed so the Platform loads reliably and quickly	Until cleared by your browser
App Check token (IndexedDB) and reCAPTCHA cookie (`_GRECAPTCHA`)	Firebase App Check / Google reCAPTCHA	Security: verifies requests come from the genuine Platform and protects against bots, fraud and abuse	Token: about 1 hour, renewed automatically. Cookie: up to 6 months
Payment cookies (`__stripe_mid`, `__stripe_sid`)	Stripe	Fraud prevention and secure processing when you add a card or pay. Only set on payment pages	`__stripe_mid`: 1 year. `__stripe_sid`: 30 minutes
Map cookies	Google Maps	Display maps showing vendor locations. Google may set its own cookies when a map loads	Set by Google (see Google's cookie policy)
Guest device identifier (local storage)	Survd	Links bookings you make as a guest to your device so you can view and manage them	Until cleared by your browser
Preferences (local storage)	Survd	Remembers choices you make: customer/vendor mode, search filters, location, saved home/work addresses, unfinished vendor registration, and whether you dismissed the app banner	Until cleared by your browser or reset by you
Booking progress (session storage)	Survd	Keeps track of a booking or checkout in progress, including across sign-in, and of notices you have dismissed	Until you close the browser tab

Why we don't ask for consent: under the Privacy and Electronic Communications Regulations (PECR) and equivalent EU rules, consent is not required for storage that is strictly necessary to provide a service you have requested, including keeping you signed in, completing bookings and payments, keeping the Platform secure, and remembering choices you have made. Everything listed above falls into these categories, so we do not show a cookie consent banner.

We do not use analytics, advertising or tracking cookies, or advertising pixels. If we ever introduce them, we will ask for your consent first and update this policy.

You can delete or block cookies and stored data at any time through your browser settings. If you do, parts of the Platform (such as staying signed in, booking or payment) may not work correctly.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encrypted data transmission via HTTPS/TLS
Firebase security rules restricting database access
PCI-DSS compliant payment processing through Stripe
reCAPTCHA v3 protection against automated abuse
Rate limiting on API endpoints

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. Booking and transaction records are retained for accounting and legal compliance purposes. If you wish to have your data deleted, please contact us (see Section 10).

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your personal data (subject to legal obligations)
Restrict or object to certain processing of your data
Data portability — receive your data in a structured, machine-readable format
Withdraw consent for location access or marketing communications at any time

To exercise any of these rights, please contact us at the details provided below.

9. Children's Privacy

Survd is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will take steps to delete that information.

10. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a concern, please contact us at:

Email: support@survd.app

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.