Privacy notice

Who controls your data

The operator of Rekomend is the controller for account, profile, referral, and enquiry data. For questions or requests, contact support@rekomend.co. You can also submit a privacy request from your account settings.

Data we collect

• Account data: name, email address, password hash, role, email-confirmation status, and notification preferences.
• Professional profile data: the details you choose to publish, including headline, biography, skills, services, location, availability, links, portfolio, and optional avatar URL.
• Referral data: the referee's name and email, relationship, engagement description, narrative, attribution choice, consent records, and moderation status.
• Private evidence: optional files uploaded by a referee. These are stored in private object storage and are accessible only to authorised moderators.
• Buyer enquiries: name, email, company, project need, budget/timeline if provided, and consent.
• Security and operational data: hashed session tokens, hashed IP identifiers for rate limits and fraud prevention, user-agent snippets, audit events, and email-delivery records.

Why we use it

• To create and secure accounts, confirm email addresses, and prevent abuse.
• To operate invitations, referral submission, moderation, publication, and withdrawal.
• To deliver enquiries and transactional notifications you request or that are necessary for the service.
• To investigate reports, enforce our terms, and maintain audit records.
• To improve the service using aggregate, non-identifying operational data.

We do not sell personal data, use referral content for advertising, or let payment influence verification or ranking. This MVP does not run third-party analytics or advertising trackers.

Lawful bases (where applicable)

We rely on performance of a contract or steps before a contract for accounts and the core service; consent for publishing a referral and for optional product emails; legitimate interests for security, fraud prevention, moderation, and service improvement; and legal obligation where retention is required. You can withdraw consent for publication at any time by withdrawing the referral.

What is public

Published profiles and approved referrals are public. Approved referrals show only the attribution the referee selected. Referee email addresses, private evidence, moderation notes, internal reasons, enquiry details, and account data are not public. Unlisted profiles are reachable by direct link but excluded from the directory.

Processors and storage

The application uses a PostgreSQL database and private object storage (local disk in development, an S3-compatible service in production). Transactional email is sent through a configured provider such as Resend. These providers process data on our instructions. Where data leaves your region, we expect appropriate safeguards to be in place; confirm the specific provider and region before launch.

Retention

• Account and public profile data: while the account is active, then a short deletion window.
• Referral records: while published or needed for moderation, dispute resolution, and audit; withdrawn referrals remain in the professional's private dashboard history.
• Private evidence: retained for up to 12 months from upload unless deleted earlier, then scheduled for deletion. A purge script is provided for operators.
• Rate-limit and security hashes: short-lived windows, except audit events retained for accountability.
• Email-delivery metadata: retained for operational troubleshooting, then deleted or anonymised.

Cookies and sessions

We use a single first-party, HTTP-only session cookie to keep you signed in. It is not used for advertising. Browsing public profiles and submitting a referral do not require an account cookie.

Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, object to, or port your data, and to withdraw consent. Use the privacy form in account settings or contact support@rekomend.co. We may need to verify your identity. You can also complain to your local data protection authority.

Children

The service is intended for working professionals and is not directed at children. Do not create an account if you are below the age at which you can consent to data processing in your jurisdiction.

Changes

We may update this notice as the service changes. Material changes will be reflected in the date above. Read the terms of use for the rules of the service.