Privacy Policy

Your Privacy Matters

This policy explains what personal information we collect, how we use it, how long we keep it, and how we protect it. It covers both Clients (people arranging repair, maintenance, and improvement work) and Contractors (the businesses or individuals carrying it out).

Renofy Ltd ("Renofy", "we", "us", "our") is the data controller for personal data processed through the Platform. We're registered in England and Wales (Company No. 16288740).

Renofy is a digital agreement platform for the home improvement and construction market. We provide tools to create shared job agreements, track milestones, and – where you choose to use it – an escrow facility that holds a job's money securely until work is approved. We're a neutral facilitator: agreements are made directly between Clients and Contractors, and we don't supervise or guarantee the work.

Renofy never holds, receives, or controls your money. Escrow funds are held and released by our FCA-regulated payment partner, OPP (Online Payment Platform Ltd.); optional card payments are handled by Stripe. Both act as independent data controllers under their own privacy statements (see below).

What's Public, What's Private

Public Information

Your profile is public and visible to anyone:

• Your name and bio
• Your profile picture, if uploaded
• Your work history – completed jobs, descriptions, and photos
• Your business information (for Contractors)
• Your skills (for Contractors)

Job Pages

Each job has its own page covering the work – title, description, milestones, photos, and required skills. Job pages aren't indexed by search engines. While a job is in progress it's seen only by people who have its link, which is handy if you want a second opinion. Once complete, it joins each user's public work history.

These details stay private on a job page:

• The total job price and individual milestone prices
• Your exact street address (only the approximate area is shown)
• The Contractor's name while the job is in progress

Shared with the Other Party

Once you enter a job agreement, the other party can see:

• Your name and profile
• The full agreement – scope, pricing, milestones, invoices, and variations
• All messages, photos, and the timestamped audit trail within it

Private Information

This stays private unless you choose to share it, or we need it to run escrow, verification, or a dispute:

• Your full street address
• Your phone number and email address
• Your private messages (visible only to participants)
• Identity, verification, and bank details you provide for escrow

When Information is Shared

Escrow, Payments & Verification

Where you use escrow, money for a job is held and released by OPP (Online Payment Platform Ltd.), an electronic money institution authorised by the FCA. OPP – not Renofy – holds and moves the money, and processes your payment and verification data as an independent controller under its own privacy statement, which you accept when you onboard.

What OPP Collects From You

To run escrow and meet its legal duties (including identity and anti-money-laundering checks), OPP collects information directly from you – more extensively for Contractors, who onboard as business merchants, than for Clients, who simply fund the job as the payer. OPP sets and may change exactly what it needs, under its own privacy statement.

What Renofy Receives

We share limited account details (name, email) with OPP to set up your escrow account, and get back your verification status and transaction data – when a job is funded, a milestone released, or a refund made. Where possible we receive only the status of a check, not the underlying identity or verification documents you give OPP.

Optional Card Payments (Stripe)

Separately from escrow, a Contractor may offer card payments through Stripe, connecting a Stripe account and giving their details directly to Stripe. Stripe acts as an independent controller under its own policy. We share limited account information to set up the connection and receive payment status and transaction data. We never receive or store full card details.

Automated Decisions (Milestone "Deemed Approval")

One step in escrow is automated – here's how it works and the control you have. When a Contractor marks a milestone complete with the required evidence, you're notified and given a set review period to approve it or raise a change request. If you don't respond in time, the milestone is automatically treated as approved ("deemed approval") and OPP can release that payment to the Contractor. This happens by the passage of time, with no one at Renofy reviewing it.

We rely on this because it's needed to run escrow – otherwise funds could be held indefinitely. The safeguards around it:

• We tell you when a milestone enters review and that you have 7 days, and we remind you before that period ends.
• In that time you can approve it, raise a change request, or open a dispute.
• If a dispute is open, the automatic release is paused while it's resolved, subject to the maximum escrow period described in our Terms of Service.
• You can ask a person at Renofy to review a release, explain your side, and contest it.

Dispute Resolution Data

If you and the other party can't agree whether a milestone is properly complete, we help you try to reach agreement, and either side can refer the disagreement to an independent reviewer (the independent third party described in our Terms), who decides how the escrow funds for that milestone are released or refunded. You authorise us (in our Terms) to share what's needed to resolve it with the reviewer and the other party – typically the relevant agreement content: scope, milestones, pricing, photos, messages, and the audit trail. We share only what's reasonably needed, and the reviewer acts as an independent controller under their own professional obligations.

In-App Messaging

Client–Contractor communication runs through our in-app messaging: your contact details stay private until you choose to share them, messages are visible only to participants and kept as a record, and you can report anything inappropriate to us. Messaging is delivered through a third-party messaging provider (see Third-Party Services).

AI Assistant

Renofy includes an AI assistant to help you describe a job and, for Contractors, draft quotes. We store these conversations, including anything you share in them.

Your messages are sent to our AI provider (currently OpenAI) to generate replies. It processes them under a data processing agreement and doesn't use them to train its models, and we don't use them to train any third-party models.

Location Privacy

A job page shows only the approximate area, never your exact street address unless you choose to share it. For example, instead of "123 Bloodworth Street, Wigan WN1 5LN", it shows the wider area, such as "Wigan".

Information We Collect

Information You Provide

• Account details (name, email, phone number, password)
• Profile information (location, bio, picture, skills, business information)
• Job details (descriptions, photos, location)
• Agreement content (scope, pricing, milestones, invoices, variations)
• Messages and AI assistant conversations
• Insurance and qualification information (Contractors)
• Identity, verification, and bank details for escrow (most of this is collected directly by OPP)

Information We Collect Automatically

• Device and browser information
• IP address and general location
• Usage patterns and interactions
• Cookies and similar technologies
• Agreement event data (acceptances, variations, milestone completions, approvals, and deemed approvals)

Information We Receive from Third Parties

• Social sign-in (Google, Facebook, Apple): your name, email, and (where provided) your profile picture
• OPP: your onboarding and verification status, and escrow transaction data (funding, releases, refunds)
• Stripe: connected-account and onboarding status, payout and transaction data, and limited verification results

How We Use Your Information

We use your information to:

• Provide and operate the Platform, including job agreements and milestone tracking
• Maintain agreement records and audit trails as evidence of what was agreed and delivered
• Run escrow by transmitting instructions to OPP to hold, release, and refund funds
• Operate milestone approval and release, including deemed approval (see "Automated Decisions" above)
• Resolve disputes, including sharing relevant data with the reviewer and the other party
• Facilitate optional card payments through Stripe
• Send account, service, and job notifications (including by SMS)
• Display your profile, work history, and job pages
• Help prevent fraud and keep the Platform secure
• Improve the Platform and comply with our legal obligations

Lawful Basis for Processing (UK GDPR)

We process your data to provide the Platform and your account, and to run agreements and escrow – because it's necessary to deliver the service you've signed up for. We also process it to keep accurate agreement and escrow records, show public profiles and work history, help prevent fraud, and improve the Platform – our legitimate interest in running a trustworthy service, balanced against your rights. And we process it to meet legal, tax, and accounting obligations where the law requires. For "deemed approval", the processing is necessary to perform the agreement between you and the other party.

Cookies

Cookies help us keep you logged in, remember your preferences, and understand how the Platform is used.

• Essential cookies: needed for the Platform to work (authentication, sessions, security), including fraud-prevention cookies where you make a payment. These can't be disabled.
• Functional cookies: remember your preferences and settings.
• Marketing and analytics cookies: measure how visitors find and use the Platform and how our ads perform. We use Google Analytics, Google Ads, Meta (Facebook) Pixel, and Reddit Pixel, delivered via Google Tag Manager.

Marketing and analytics cookies are off by default and only set once you enable them via the cookie banner. You can change your choice any time under "Cookie preferences" in the footer, or by clearing your site data for renofy.io. Disabling essential cookies may prevent you using the Platform.

Third-Party Services

We share limited information with trusted services to run the Platform:

• Cloud hosting & database: your data is stored on secure servers within the UK/EU.
• Email & SMS provider: to send service notifications. Your phone number is shared only to deliver them.
• Error-monitoring provider: to detect and fix issues. It may receive device and technical context; we minimise the personal data in error reports.
• Escrow & payments (OPP): holds and releases escrow funds and runs the required identity and anti-money-laundering checks, as an independent controller under its own privacy statement. See "Escrow, Payments & Verification" above.
• Card payments (Stripe): processes optional card payments as an independent controller under its own policy. We don't receive or store full card details.
• Social sign-in (Google, Facebook, Apple): if you use it, we receive your name, email, and (where provided) your profile picture, stored as part of your account.
• In-app messaging provider: delivers and stores your in-app messages; your display name, profile picture, and a link to your profile are shared to provide the service.
• AI provider: processes your assistant messages to generate replies, under a data processing agreement and without training on them. See "AI Assistant" above.
• Dispute resolution (independent reviewer): receives the information needed to review a dispute. See "Dispute Resolution Data" above.
• Marketing analytics (Google, Meta, Reddit): if you accept marketing cookies, we share visit and conversion events to measure ad performance. Opt out any time via "Cookie preferences".

Where a third party is an independent controller (OPP, Stripe, or a dispute reviewer), their processing is governed by their own privacy notice. Our marketing partners (Google, Meta, Reddit) may process limited data outside the UK; where they do, we rely on UK-approved transfer mechanisms, and you can prevent it by rejecting marketing cookies. OPP and Stripe may likewise process payment data internationally under their own safeguards; this is necessary to provide the facility and can't be opted out of separately while you use it.

Data Retention

We keep your data while your account is active, and remove or anonymise it when it's no longer needed.

When you delete your account, we delete the personal information we no longer have a reason to keep. We retain the records of any jobs you were part of – the agreement, its timestamped history, and the related payment records – for at least 6 years after the job completes or ends, under the Limitation Act 1980 and our accounting and legal duties. These records may still identify you; we keep that ability only to resolve disputes, prevent fraud, meet our legal and accounting duties, or where the law otherwise requires or permits – not for ordinary use of the Platform.

Public work history may remain after account deletion where the law allows, and anonymous (logged-out) AI assistant chats aren't linked to any account. OPP, Stripe, and any dispute reviewer retain data under their own legal and regulatory obligations and privacy notices.

Your Rights and Control

Under the UK GDPR you can:

• Access: request a copy of the personal data we hold about you.
• Rectify: correct your data in your profile settings or by contacting us.
• Erase: delete your account any time from Account Settings, or ask us at [email protected]. We'll delete the personal information we no longer have a reason to keep, and retain the job records we must keep – the agreement, its history, and related payment records – for at least 6 years to resolve disputes, prevent fraud, and meet our legal and accounting duties, or where the law otherwise requires or permits. We keep the ability to identify you in those records only for those purposes. The prevention and detection of fraud, our legal and accounting obligations, and the establishment or defence of legal claims are lawful grounds on which we may retain specific records even after you ask us to erase your data. If your account is linked to active jobs or financial records we're required to keep, self-serve deletion from Account Settings may be unavailable; in that case, email us at [email protected]. We'll respond within one month; for complex or repeated requests UK GDPR lets us extend this by up to two further months, and we'll let you know if we need to.
• Restrict or object: ask us to pause or stop certain processing. We'll do so unless we have legal grounds to continue.
• Portability: request your data in a structured, commonly used format.
• Automated decisions: for an automated decision with a significant effect – such as deemed approval above – you can ask a person at Renofy to review it, explain your side, and contest it.

For data held by an independent controller (OPP, Stripe, or a dispute reviewer), you may need to contact them directly (see "Third-Party Services").

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Children

Renofy is for adults. You must be at least 18 to create an account or use the Platform, and we don't knowingly collect personal data from anyone under 18. If you believe a child has provided us with their data, please contact us at [email protected] and we'll delete it.

Changes to This Policy

We may update this policy from time to time. We'll tell you about significant changes by email or a notice on the Platform. Continuing to use Renofy after a change means you accept the updated policy.