Privacy Policy

Hoomanz (“Hoomanz,” “we,” “us,” “our”) operates the marketplace at hoomanz.co where independent people (“Hoomans”) offer services, digital goods, physical items, jobs, and rentals to one another. This Privacy Policy explains what we collect, how we use it, who we share it with, how we secure it, and the rights you have.

By using Hoomanz you agree to the practices described here. If you do not agree, please do not use the service.

Information you give us

• Account & profile: name, email, password (hashed with bcrypt — we never store it in plain text), profile photo, bio, location, languages, categories/professions, headline, links, verification status.
• Listings & content: services, products, jobs, for-sale items, rentals, posts, photos, videos, reviews, replies, messages.
• Bookings & orders: dates, durations, addresses, delivery preferences, applicant messages, rental check-in/out info.
• Payout details: bank account, Stripe Connect onboarding identifiers, PayPal/Venmo/Cash App handles, Wise emails. Sensitive payout fields are encrypted at rest with a server-side key and never shown back in plaintext after entry.
• Communications with us: support requests, dispute notes, feedback.

Information we collect automatically

• Device & log data: IP address, browser type, operating system, referring/exit URLs, pages viewed, clicks, timestamps, error logs.
• Cookies & local storage: a session token (JWT) so you stay signed in, a language preference, and a few UI flags. We do not use third-party advertising cookies.
• Stripe payment metadata: when you pay or get paid, Stripe returns a session ID, payment intent ID, and status code — we store those for receipt and reconciliation purposes.

Information from third parties

• Google Sign-In: if you choose Google login, we receive your name, email, and a Google account identifier.
• Stripe: after a successful checkout we receive payment status, last-4 of the card, country, and the platform fee Stripe collected on our behalf.

• To create and maintain your account, profile, and identities.
• To match customers and Hoomans — show your listings on Discover, Jobs, Market, Rentals, and the Shop.
• To process bookings, accept payments through Stripe Connect (a 2 % Hoomanz Tip added on top of each transaction), and pay out 100 % of the seller's price to the Hooman who earned it.
• To generate the secure Jitsi video room for online consultation bookings.
• To send transactional emails (booking confirmations, payout updates, dispute notices) and in-app notifications. We do not send marketing emails without your separate, explicit opt-in.
• To prevent fraud, detect abusive behaviour, and enforce our Community Guidelines.
• To translate listings and reviews into the viewer's language using Anthropic Claude (only the public text content is sent; no account identifiers).
• To improve the product — anonymous, aggregated analytics about which surfaces are used.
• To comply with legal obligations (tax reporting, lawful requests from authorities, anti-money-laundering checks performed by Stripe).

We share the minimum amount of data needed, only with the parties below, and never sell or rent personal information to advertisers or data brokers.

Other Hoomans on the platform

• Your public profile (name, photo, bio, categories, location city, listings, reviews, follow counts) is visible to anyone who visits your profile page.
• Your contact details and full address are not publicly visible — they are only shared with the counterpart of a confirmed booking, order, or rental.
• When you book or buy, the seller sees your display name, profile photo, and the message you sent — never your password, payout details, or full email unless you put it in a message.

Service providers (data processors)

• Stripe, Inc. — payment processing and Connect payouts. Stripe collects card numbers and bank details directly; Hoomanz never sees or stores raw card numbers.
• Anthropic (Claude) — translation of listing/review text. Only the public text is sent. Anthropic Privacy.
• Google Cloud / Google Sign-In — optional federated login. Google Privacy.
• Jitsi (8x8, Inc.) — peer-to-peer encrypted video rooms for online consultations. No recording is stored by Hoomanz.
• SendGrid (Twilio, Inc.) — transactional email delivery (receipts, password resets, dispute notices).
• MongoDB Atlas / Emergent cloud infrastructure — hosts the application database and servers in encrypted form.

Legal & safety

• We will share information when compelled by valid legal process (subpoena, court order, lawful government request) or when necessary to protect the safety, rights, or property of Hoomanz, our users, or the public.
• In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred — we'll notify you in advance and you'll have the chance to delete your account first.

How disclosure happens (method)

All transfers to service providers happen over TLS 1.2+ encrypted HTTPS API calls. We use the minimum-permissions API tokens provided by each vendor and rotate them on schedule. Disclosures in response to legal process are reviewed by a human first; we challenge over-broad requests where the law permits.

• Encryption in transit: the entire site, every API call, and every third-party integration runs over HTTPS / TLS 1.2+.
• Encryption at rest: the database is encrypted at the disk level; sensitive payout fields (bank account, IBAN, etc.) are additionally encrypted with an application-layer key tied to your Hoomanz user.
• Passwords: hashed with bcrypt (cost factor 12). We literally cannot read your password — even we don't know what it is.
• Authentication: JWT session tokens with short expiry; step-up re-authentication is required to view or change payout details.
• Payments: credit card numbers are entered directly into a Stripe-hosted checkout page and never touch our servers. Hoomanz is therefore in scope only for SAQ-A of PCI-DSS.
• Least privilege access: production database access is restricted to a small group of engineers, audited, and gated behind 2FA.
• Brute-force protection: repeated failed login attempts are rate-limited.
• Continuous monitoring: error logs and abnormal request patterns trigger alerts.
• Backup & recovery: the database is backed up daily and restorable to a point in time.

No system is 100% secure. If we ever detect a breach affecting your data, we will notify you and the relevant authorities within 72 hours of discovery, as required by GDPR Art. 33 and applicable U.S. state laws.

Hoomanz uses only the cookies and local-storage entries strictly needed to run the site:

• Session token (HttpOnly when possible) — keeps you signed in.
• Language preference — remembers your chosen interface language.
• UI flags — remember whether you've dismissed certain onboarding hints.

We do not use third-party advertising or analytics cookies. You can clear them at any time from your browser settings.

• Active account data is retained while your account exists.
• If you delete your account, profile, posts, listings and personal data are removed within 30 days, except for: (a) transaction records we are legally required to keep for tax / accounting (7 years), and (b) anonymised analytics that no longer identify you.
• Booking and payment records are retained for the duration legally required by tax and consumer-protection law in your jurisdiction.
• Translated content cached for performance is auto-purged after 90 days of inactivity.

Depending on where you live, you may have one or more of these rights. We honor them for all users globally as a matter of policy:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete information (most fields are editable directly in your profile settings).
• Deletion — delete your account and personal data (subject to legal retention exceptions above).
• Portability — export your data in a structured, machine-readable JSON format.
• Objection / restriction — opt out of specific processing (e.g., turn off translation).
• Withdraw consent — for anything we process on consent (e.g., marketing if you ever opt in).
• Complain — to your local data protection authority (e.g., your EU DPA, the UK ICO, or your state Attorney General).

To exercise any right, email privacy@hoomanz.co. We respond within 30 days.

Hoomanz is not directed to children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided data to us, please email us and we will delete it.

Hoomanz operates globally. Your data may be processed in countries outside your own (typically the United States and the European Union). Where required, we use the appropriate transfer safeguards — Standard Contractual Clauses for EU/UK transfers and equivalent mechanisms elsewhere.

If we make material changes, we will email you and post a banner on the site at least 7 days before the new terms take effect.

Questions, requests, or concerns? Reach our privacy team directly:

privacy@hoomanz.co