GDPR Compliance.

1. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Contractual Necessity: To execute the mission verification you agreed to perform.
• Legitimate Interest: To prevent fraud (GPS spoofing, emulators) and ensure protocol security.
• Legal Obligation: For financial reporting and tax compliance via our Merchant of Record, Lemon Squeezy.

2. Data Subject Rights

As a user, you have specific rights designed to give you control over your personal information:

• Right to Access: Obtain a copy of your mission logs and payment history.
• Right to Erasure: Request the permanent deletion of your worker profile and WhatsApp ID.
• Right to Rectification: Update inaccurate bank details or contact information.
• Right to Data Portability: Receive your data in a structured, XLSX.format.

3. Data Transfers & Security

Data is stored using Cloudflare’s encrypted infrastructure. As we operate globally, your data may be processed outside the EEA. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs). All biometric "Liveness Checks" are processed on-device.

4. Third-Party Processors

We share limited data with essential partners to maintain the service:

• Lemon Squeezy (Merchant of Record): Manages billing, tax, and compliance globally.
• Cloudflare: Provides DDoS protection and secure data hosting.
• Mission Owners: Access worker names and WhatsApp IDs only to facilitate payroll.

5. Data Retention & Automated Anonymization

We adhere to the principle of "Storage Limitation". Personal identifiers are permanently stripped and anonymized once the mission reaches its automated expiry date (90 days for PRO, 30 days for STARTER, and 7 days for BASIC). Internal activity logs are completely purged from our database every 30 days.