Privacy Policy
How Mendli collects, uses, shares, protects and retains personal information under UK data-protection law.
1. Who is responsible for your data?
Mendli is the controller for personal data used to operate the Mendli marketplace, except where a separate written agreement expressly says Mendli acts only as a processor. You can contact Mendli about privacy through Help & Support in the platform.
If Mendli later trades through a registered company or publishes a dedicated privacy address, those controller contact details should be added here and kept current.
2. Information we collect
- Identity and contact: name, email, phone, role, area, postcode and profile details you choose to provide.
- Worker/business: trade, business name, experience, qualifications/verification material, areas covered, availability and profile/work-gallery information.
- Jobs and communications: job descriptions, categories, budgets/quote requests, dates, photos, interests, quotes, messages, attachments, booking/completion records, reviews, support and dispute material.
- Financial and account records: invoices, fees, deposits, refunds, credits, payment status, account statements and records needed for tax/accounting.
- Security/technical: authentication, browser/session data, logs and risk/safety signals reasonably needed to secure the service, investigate faults or prevent abuse.
- Marketing preferences: whether you opted in or out, when the preference changed and how it was collected.
Please do not include unnecessary special-category or highly sensitive information in job descriptions, messages or uploads.
3. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create accounts, post/find jobs, messaging, quotes, booking, completion, reviews and support | Contract / steps requested before entering a contract |
| Account security, fraud prevention, platform integrity, reliability and misuse prevention | Legitimate interests; legal obligation where applicable |
| Invoices, accounting, tax and legal records | Legal obligation and legitimate interests |
| Handling disputes, complaints, appeals and legal claims | Contract, legitimate interests and establishment/exercise/defence of legal claims where applicable |
| Optional email marketing | Consent where required by PECR/UK GDPR; otherwise only where a lawful exception genuinely applies |
| Mendli AI support, if you choose to use it | Contract/legitimate interests to provide support; only the support content needed for the request should be sent |
4. How information is shared
We share information only where necessary for the marketplace, support, security, legal or service-provider purpose involved. This can include customers, workers, authorised Mendli staff and service providers that host or process data for Mendli.
Current core service providers include Supabase (database, authentication and storage), Cloudflare (hosting/delivery/security) and OpenAI for the optional Mendli AI support feature. Provider roles and safeguards are described in our Data Processing Addendum & Subprocessor Schedule.
5. International transfers
Some service providers may process data outside the UK. Where UK personal data is transferred internationally, Mendli requires an appropriate transfer mechanism and contractual safeguards where required, such as an adequacy regulation, the UK International Data Transfer Agreement/Addendum, or other lawful mechanism.
6. Retention
Mendli keeps personal data only for as long as necessary for the purpose for which it was collected. Active profile data is kept while the account is active. On deletion, active profile/contact data is erased or anonymised unless retention is justified.
Transaction, invoice, accounting, dispute, safety, fraud-prevention and legal-claim records may be retained for longer where law or a defensible legal/business need requires this. Accounting/tax records may need to be kept for up to six years or longer in some circumstances. Retention is reviewed and records are deleted or anonymised when the justification ends.
7. Your rights
Subject to the law and any applicable exemptions, you may ask for access, correction, erasure, restriction, portability, or object to certain processing. Where processing relies on consent, you may withdraw it at any time. You can also ask for appropriate safeguards around solely automated decisions that have legal or similarly significant effects.
Use Mendli Help & Support to make a privacy request. You also have the right to complain to the UK Information Commissioner’s Office (ICO).
8. Account deletion
Customers and workers can use Delete my account in Profile & Account. Mendli will remove the login and active profile and erase/anonymise personal details that are no longer required. Some information may be retained only where there is a lawful reason, for example accounting, tax, dispute, safety, fraud-prevention or legal-claims records.
9. Marketing and service messages
Marketing email consent is separate and optional. Turning marketing off does not stop essential messages needed to operate your account or jobs, including job activity, messages, quotes, bookings, invoices, payments, security, safety, disputes and support. We do not disguise advertising as a service message.
10. Cookies and similar technologies
See our Cookie & Tracking Policy. Mendli currently does not intentionally run advertising or behavioural analytics cookies in the public website build. Strictly necessary authentication, security and browser-storage technologies may still be used.
11. Changes
We may update this notice when the service, law or our providers change. The latest version will remain available in the Legal & Privacy Centre with its update date.