Data Security & Minimisation
The privacy-by-design, minimisation, retention and security controls Mendli uses to protect personal data without publishing sensitive security details.
1. Data minimisation
2. Access and application security
- Role-based access for customers, workers, staff and admin functions.
- Database Row Level Security and server-side checks for protected operations.
- Private storage for sensitive job/message attachments where configured.
- Least-privilege access for administrative/support functions.
- Authentication through Supabase; production service secrets are not intentionally exposed in browser code.
- Security logs, risk signals and audit records used proportionately for fraud, safety and incident response.
3. Secure development and change control
- Changes are developed against a protected working version and tested before release.
- Desktop and mobile layouts are checked for functional regressions and JavaScript errors.
- Security-sensitive database changes are applied as versioned migrations where possible.
- High-risk changes such as account deletion use server-side privileged functions rather than browser-only deletion.
- Third-party services are reviewed for privacy/security terms before being used for personal-data processing.
4. Retention and disposal protocol
| Information | Default approach |
|---|---|
| Active profile/contact information | Keep while the account is active; erase/anonymise after valid deletion unless a lawful retention reason applies. |
| Job/messages/support/disputes | Keep while needed to deliver the service and for proportionate dispute, safety, fraud or legal-claims periods; review for deletion/anonymisation afterwards. |
| Invoices/payment/accounting records | Retain for the applicable tax/accounting period; in the UK this can commonly be up to six years or longer in specific circumstances. |
| Marketing consent/suppression | Keep enough evidence to demonstrate consent and honour opt-outs; do not use an opt-out record for marketing. |
| Security/technical logs | Keep only for the shortest period reasonably necessary for security, diagnostics, incident response and legal obligations, with periodic review. |
5. Incident response
Mendli will investigate suspected personal-data breaches, contain the issue, preserve necessary evidence, assess risk, document decisions and notify affected controllers, individuals and/or the ICO where the law requires it.
6. Privacy by design
New features should be assessed before launch for data collected, purpose, lawful basis, access, retention, security, user transparency and whether a DPIA is required. Higher-risk automated safety/risk systems should provide appropriate review and appeal safeguards.
7. Public-security information is intentionally high level
This page describes Mendli’s control framework without publishing secrets, internal credentials, exploitable architecture detail or security configurations that could weaken the service.