Version: privacy-2026-09-15. Effective September 15, 2026.
1. Who is responsible and what this policy covers
Homing Work LLC is responsible for the personal information it processes to operate homingwork.com and its customer, provider, and administrative services. Contact Support@homingwork.com with the subject Privacy request. Legal-notice mailing address: 7244 Vellex Ln, Annandale, VA 22003.
The service is intended for adults in supported US service areas. This policy covers information we receive through the website and related support. It does not replace a provider business’s privacy obligations when it independently handles information to quote, contract for, or perform a job.
2. Information we collect
| Category | Examples and source |
|---|---|
| Account information | Name, email, phone if supplied, account and role identifiers, login/session events, and authentication information from you and our authentication service. |
| Customer projects | Scope, title, service choice, project address and ZIP code, timing, photos or documents, revisions, contact permission, project status, and communications you submit. |
| Provider business information | Business name, contact and address, application answers, services and markets, qualification information you provide, authorized users, approvals, waitlist and seat records. |
| Transactions and promotions | Lead purchases, contact-disclosure records, coupon grants and uses, invoice and payment references, adjustment and dispute records, authorization and policy-acceptance records. |
| Limited payment information | Stripe customer and payment-method references, card brand, last four digits, expiry where supplied, and payment status. Full card details and security codes are collected by Stripe, not stored in Homing Work’s application database. |
| Technical and support information | IP address, browser/device details, request and security logs, error information, support messages, notification preferences and delivery records, from your use of the service and our vendors. |
| Service-area interest | ZIP code and, if you choose, an email address for one service-area availability update. The separate email choice is not general marketing consent. |
Please avoid uploading unnecessary sensitive information, access codes, identity documents, payment details, or identifiable images of children. We need the project address to determine service coverage and arrange the requested introduction; we do not need continuous device-location tracking. If a photo or description includes someone else’s information, submit it only with appropriate authority.
3. Why we use information
- Create and secure accounts, verify access, recover accounts, and separate customer, provider, and staff permissions.
- Review and classify projects, assess service coverage, prepare privacy-conscious previews, match eligible businesses, and provide the customer-requested introductions.
- Evaluate provider applications, allocate seats and waitlist places, administer pauses and promotions, and prevent evasion of marketplace limits.
- Record purchases and authorizations, collect valid lead fees, handle refunds and disputes, and maintain necessary accounting records.
- Respond to support and privacy requests, send relevant account and transaction notices, and provide the one availability update you request.
- Detect fraud, investigate misuse, troubleshoot reliability, enforce appropriate terms, and comply with legal obligations.
We limit access to information needed for these purposes. We do not use project photos or private descriptions for public advertising or general-purpose AI model training without separate permission. We do not build an advertising profile from your activity across other companies’ websites.
4. Project photos, previews, and paid contact sharing
Before an unlock, eligible matched providers may see the reviewed project scope, approximate location, service, timing, nonbinding estimate, and approved photos. The preview audience may include more than three providers. We withhold your name, phone, email, full street address, original image metadata, and other direct identifiers; images must be reviewed and identifying details removed or concealed before preview access. We cannot guarantee that a distinctive property will be unrecognizable. Photos are optional.
When you give the project’s separate contact permission, you direct us to disclose your project contact details to up to three distinct provider businesses that unlock it. Providers ordinarily pay Homing Work for this access; an eligible provider may instead use a free promotional unlock. The three-business limit concerns contact disclosure over the project’s lifetime, not the number of previews.
This is a paid introduction service, and we do not describe it as an unconditional promise that personal information is never sold. Whether a particular requested disclosure is legally a sale depends on the applicable law and the facts. We limit it to the introduction you request, disclose the paid-access arrangement, and obtain the required permission. We do not sell unrelated customer lists or permit providers to resell leads.
You may withdraw permission or request that matching stop through available project controls or support. We will stop future disclosures promptly; withdrawal does not undo information already received. Connected businesses are required to restrict use to the project, protect information, and honor applicable deletion and contact restrictions. We can help relay a request, but providers are also responsible for their independent records and legal duties.
5. Other recipients and vendors
| Recipient | Purpose and information involved |
|---|---|
| Supabase | Database, authentication, and private file storage for account, project, application, permission, and related operational records. |
| Cloudflare | Website hosting and delivery, with request, device, network, and application information needed to serve and secure the site. |
| Stripe | Provider payment-method setup, payment collection, invoices, fraud prevention, refunds, and disputes. Stripe may process information for its own legal and fraud-prevention purposes under its privacy notice. |
| Resend, when transactional email delivery is enabled | Recipient address and the account or transaction message being sent, together with delivery status. |
| Cloudflare Turnstile, if presented | Challenge and device/request signals used to reduce automated abuse. |
| Sentry, when error monitoring is enabled | Minimized diagnostic information, such as error events and technical context, with personal information and secrets excluded where possible. |
| Professional advisers and authorities | Limited information reasonably required for accounting, legal advice, a valid legal process, safety, security, or protection of rights. |
We use service providers under restrictions appropriate to their functions. Optional email delivery, security challenges, and monitoring only involve the named service when enabled. We review vendor changes and update this notice before materially changing how information is used or disclosed. A service provider may have its own privacy notice for processing it independently controls.
If the business is reorganized, financed, sold, or transferred, relevant information may be shared under confidentiality restrictions and transferred to a successor responsible for protecting it consistently with this policy. We will give any required notice and obtain any required consent.
6. Automated assistance and human review
When photo review is enabled, sanitized project images are sent to OpenAI to check for nudity and identifying or contact details before provider preview. Measurements are allowed. We send the image without its original filename, location metadata, account contact record, or payment data, but information visible inside the image remains visible to the reviewer. Clear results may approve a photo automatically; flagged or uncertain results remain hidden from providers for owner review. AI can make mistakes. You may ask support to review a decision. We request no API response storage; the provider may retain data for security and abuse monitoring under its data controls. This photo check is separate from any optional project scope assessment.
Rules help classify projects, determine geographic eligibility, match service seats, enforce purchase capacity, and prevent duplicates. Automated results can be wrong; contact support if a classification, eligibility result, or account decision needs correction.
Any optional external AI scope-assessment service must be identified to users before it receives project data. The planned scope-assessment input is minimized project text, service and timing details, and approximate location after checks for direct identifiers. It does not include raw project photos, payment data, passwords, or a deliberately supplied contact record. Free text can contain information that automated redaction misses, so minimization and human review remain necessary. Until the provider, processing terms, and notice are confirmed, external AI processing remains disabled.
An assessment is advisory and requires administrator review before a project is published. We do not use an AI estimate as a binding quote or as the sole basis for a decision with legal or similarly significant effects.
7. Cookies and communication choices
We use necessary storage and similar technologies for login sessions, security, preferences, and payment flows. Disabling necessary storage may prevent those functions. Nonessential advertising trackers, cross-site targeting, and session replay are outside this policy’s approved operating model and must remain disabled unless a later notice and any required consent are implemented.
Optional marketing is separate from account or project participation. If offered, each marketing email will include a simple unsubscribe method; you may also email support. We honor marketing opt-outs within ten business days or sooner where required. Required operational notices may continue. A request for one service-area update authorizes that update only, and you may withdraw it before delivery.
Where applicable law requires recognition of a browser or device opt-out signal, we will honor it for the covered processing. You can also request an opt-out by email without creating an account. An advertising opt-out is not itself an instruction to cancel a project you expressly ask us to share; tell us to stop matching if you also want to end future project introductions. We will resolve conflicting signals and consent in accordance with applicable law.
8. Retention and deletion
We keep identifiable information only for a documented operational or legal need, then delete or de-identify it. The following schedule is the ordinary maximum unless you make a valid earlier deletion request or a specific legal, security, or dispute reason requires a different period. A record’s financial status does not justify retaining every associated photo or full project description.
| Record | Ordinary retention rule |
|---|---|
| Account profile | While active; delete or de-identify nonrequired profile information within 30 days after verified closure. Accounts unused for 24 months receive 30 days’ notice before closure, unless an active job or unresolved matter requires continued access. |
| Unsubmitted drafts and unattached uploads | Delete after 90 days without activity. |
| Project photos, exact address, contact details, and full scope | For the active project and up to twelve months after closure for user access and support; then delete or de-identify unless a specific dispute or legal need remains. Apply a valid earlier deletion request as required. |
| Provider qualification documents | While needed for active participation; delete within 90 days after rejection, withdrawal, replacement of the document, or account closure, unless a specific legal or dispute need applies. Keep only minimal decision evidence if needed separately. |
| Unsuccessful applications and waitlist records | Up to twelve months after the final decision or withdrawal. An active waitlist entry may remain while requested; review entries without activity annually and delete after notice if the business no longer wants to wait. |
| Invoices, payment and tax records, necessary consent and contract evidence | Transaction and tax records: seven years after the transaction or settlement. Necessary contract and acceptance evidence: seven years after the relevant agreement ends. Keep only information needed to document the obligation or resolve claims; an account remaining open does not automatically extend every transaction’s retention. Earlier deletion applies where law requires it. |
| Coupon eligibility and disclosure-limit evidence | Keep minimal business/project identifiers, counts, and grant or disclosure dates while needed to prevent repeat claims or a fourth disclosure. Remove raw photos and unnecessary contact details under their shorter schedule. Review necessity annually. |
| Routine support correspondence | Up to two years after the matter closes; a transaction dispute follows the necessary financial/legal record schedule. |
| Routine security and diagnostic logs | Up to 90 days; isolate evidence of an identified incident only as long as needed for investigation or legal obligations. |
| One-time service-area update list | Until the requested update is sent, permission is withdrawn, or twelve months pass, whichever occurs first; remove the address within 30 days after that event. |
| Backups | Deleted data may persist in restricted backups for up to 90 additional days before rotation. Backups are not used for ordinary processing; if restored, applicable deletions are reapplied. |
A legal hold is limited to relevant records and lasts only as long as the documented need. We review holds periodically and delete or de-identify released records under this schedule. We may keep minimal suppression information to honor opt-outs or deletion instructions. Truly de-identified statistics may be kept longer, and we will not attempt to re-identify them.
Closing an account and requesting deletion are related but distinct: tell us if you want both. We will explain what is removed, what must be retained, the reason, and any applicable restriction on use. A seven-year retention period is an internal recordkeeping choice for necessary records, not a statement that every law requires seven years.
9. Access, correction, deletion, and other privacy requests
Email Support@homingwork.com with the subject Privacy request and describe what you want to access, correct, receive a copy of, delete, or stop sharing. You do not need a new account. We will verify identity proportionately, generally using the existing account or an email confirmation. We will not ask for a password or full payment-card number; if more evidence is necessary, we will explain why and use a secure method.
We offer access, correction, deletion, and a usable copy of personal information subject to verification and lawful exceptions. Depending on the applicable law, you may also have rights to opt out of sale, targeted advertising, or certain significant profiling, use an authorized agent, or withdraw consent. We do not discriminate against people for exercising privacy rights; a requested service may be unavailable if it cannot be provided without the information you decline to supply.
We aim to acknowledge a request within ten business days and respond without undue delay, no later than 45 calendar days after receipt unless a shorter period applies. If a legally permitted extension is necessary, we will explain the reason before the initial deadline; it will not exceed 45 additional days. Identity checks do not automatically restart the response clock. Ordinary requests are free; any legally permitted response to abusive or excessive requests will be explained.
If we deny a request in whole or part, we will explain the reason and how to appeal. Reply with Privacy appeal within 60 days of the decision, or later when applicable law allows. We will decide within 60 days after receipt or any shorter required period, give written reasons, and identify the relevant attorney general or regulator complaint route if the denial stands.
10. Security, children, and international processing
We use access restrictions, authenticated sessions, private storage controls, encryption in transit, and limited administrative access to reduce risk. No system is completely secure. We investigate suspected incidents and provide notices required by applicable law. Contact support promptly if you believe information has been exposed.
The marketplace is intended for people 18 and older. We do not knowingly offer accounts to children or seek children’s personal information. If you believe a child supplied information, contact support so we can investigate, restrict access, and delete information as appropriate. A project photo containing a child is not required to use the service.
Our US-focused service and its providers may process information in the United States and other countries where their infrastructure or support operates. Protections may differ from those where you live. We use contractual and other safeguards required by applicable law rather than treating use of the website alone as consent to an otherwise restricted transfer.
11. Changes and contact
We will identify the effective version and give at least 30 days’ advance notice of a material change through the website, account, or email as appropriate, unless law or urgent security needs require faster action. Where a new purpose or disclosure requires consent, we will obtain it before the change applies. Updating this notice alone does not authorize a materially incompatible use of information already collected.
Contact Homing Work LLC at Support@homingwork.com for privacy questions, requests, or complaints. Legal-notice mailing address: 7244 Vellex Ln, Annandale, VA 22003.