Privacy Notice

1. Who controls your information

ON THE DAY . CO . UK LTD, company number 16876788, is the controller of personal information used to operate On The Day. Our registered office is 1 Hirst Close, Arnold, Nottingham, England, NG5 8RL.

For privacy questions or rights requests, email support@ontheday.co.uk. We do not claim to have appointed a statutory Data Protection Officer unless and until that appointment is formally made.

2. Information we use

Account and identity

• Name, username, date of birth where required, profile photograph, email, phone number and login records.
• Trading status, legal or trading name, company number, business address and authorised representative details for contractors.
• Account status, verification state, support history, reports, appeals and security events.

Contractor profile and verification

• Trades, skills, experience, service area, availability, rates, portfolio, qualifications and reviews.
• Public-liability insurance evidence and CSCS evidence where relevant or required.
• Trade-credit evidence where a contractor wishes to apply for a project using the optional materials delivery control.
• Any other regulated or criminal-offence information is collected only where a lawful basis and appropriate condition have been documented.

Projects, contracts and communications

• Project descriptions, property details, postcode and exact address, photographs, videos, dimensions, plans and price-guide inputs.
• Applications, quote visits, quotes, milestones, variations, signed contracts, early-start requests, evidence, approvals, cancellations, reviews and disputes.
• Messages, documents, voice notes and call state. Call audio or video is not recorded unless a separate clear notice and lawful basis are provided.

Payments and tax records

• Amounts, fee calculations, payment and payout status, Stripe identifiers, refunds, release instructions and reconciliation records.
• Stripe collects sensitive bank, identity and payment details directly. On The Day should receive only the status and identifiers needed to operate the project.
• Tax-identification, company, address and financial-account information where UK digital-platform reporting law requires it.

Device, location and usage

• IP address, device and operating-system information, app version, push-notification token, security logs, crash information and feature interactions.
• Approximate or precise foreground location only when you ask to use a location feature and grant device permission. Background arrival tracking is not part of the homeowner-contractor launch.
• Analytics identifiers and events where analytics are enabled and lawfully permitted.

3. Where information comes from

Most information comes directly from you. We also receive information from other project participants, Stripe, device and app services, document-review activity, public registers where lawful, and people who submit a report or support request.

If another user uploads information about you, they must have a genuine project reason and the right to share it.

4. Why we use information

We do not make a solely automated decision that produces a legal or similarly significant effect. Matching and eligibility rules may filter or order results, but users make appointment, approval, suspension and dispute decisions. Tell support if you believe an automated rule has affected you incorrectly.

5. Who receives information

• Other users: the profile, quote, project and contact information needed for a genuine project and only at the appropriate stage.
• Stripe: payment, connected-account, identity, bank and payout information under Stripe's own privacy notice and contractual role.
• Supabase: authentication, database, file storage and related hosting services.
• Apple, Expo and notification providers: app distribution, device permissions and push notifications.
• LiveKit: call infrastructure where the optional call feature is used.
• PostHog: product analytics where enabled and permitted.
• Professional advisers and suppliers: hosting, security, legal, accounting, insurance and support providers under appropriate duties.
• Authorities: HMRC, courts, regulators, law enforcement or emergency services where disclosure is required or lawfully justified.

Some providers may process information outside the UK. We use an applicable UK adequacy decision, approved contractual safeguards or another lawful transfer mechanism and assess supplementary protections where required.

6. What other users can see

Public or searchable contractor profiles may show trading name, photograph or logo, trade, area, experience, portfolio, ratings and verification status. They must not expose private contact information, identity documents, insurance documents, tax information or bank details.

A public project may show the general area, project category, summary, target dates and non-identifying media. The exact address and direct contact details are restricted until the project workflow reaches the appropriate quote-visit or appointment stage.

Project messages, quotes, contracts, evidence and payment records are available only to the participating homeowner and contractor, authorised support or administrators who need access, and service providers processing them for us.

7. How long we keep information

We keep information only for as long as needed for the purpose collected, legal obligations and legal claims. The candidate launch schedule is:

• Active account and profile data: while the account is open.
• Signed contracts, project records, payment records, fee records, messages and evidence: normally six years after the project closes or the last relevant transaction.
• Tax and digital-platform reporting records: for the period required by HMRC and applicable law, normally at least six years.
• Verification evidence: while current and for a limited audit period after replacement, expiry or account closure; rejected or unnecessary copies should be removed sooner unless fraud or legal needs justify retention.
• Support, complaint and dispute records: while active and normally six years after final resolution where a legal claim remains possible.
• Security and diagnostic logs: normally up to 12 months unless an incident requires longer investigation.
• Marketing preferences: until consent is withdrawn, objection is made or the record is no longer needed to honour an opt-out.

Account deletion does not require us to erase records that must be kept for payments, tax, fraud, safety, contracts, disputes or legal claims. We delete or anonymise information when those reasons end.

8. Security

We use role-based access, database access rules, authenticated sessions, encryption in transit, restricted administration, audit records and specialist payment providers. No online system is risk-free. Users must use a strong unique password, protect their device and report suspicious access promptly.

Never place bank details, identity documents, passwords or unnecessary private information in a public project description or ordinary message.

9. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection. You may withdraw consent without affecting earlier lawful use and object to direct marketing at any time.

We may need to confirm identity before acting. Rights are not absolute; for example, we may retain a contract or payment record needed by law or for a legal claim. We normally respond within one month and explain any lawful extension or refusal.

10. Cookies, device storage and analytics

The website and app use strictly necessary storage for login sessions, security, saved project drafts and user choices. Blocking these may prevent core features from working.

11. Children

On The Day is an adult home-project marketplace and is not intended for anyone under 18. We do not knowingly permit children to register. Contact support if you believe a child has supplied personal information.

12. Changes to this notice

We may update this notice as the product or law changes. We identify the version and publish material changes. Where a new use requires consent, we ask before beginning that use.

13. Contact and complaints

Send privacy questions or rights requests to support@ontheday.co.uk. Please do not email identity documents unless support has given a secure upload route.

You may complain to the Information Commissioner's Office. Visit ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first, but this does not restrict your right to contact the ICO.