Privacy Policy

1. Overview

This Privacy Policy explains what information HasAGuy ("we", "us", "our") collects, how we use it, and the choices you have. It applies to the HasAGuy website and services (the "Service").

2. Information We Collect

Information you give us:

• Account details — your first name, last name and email address, and a hashed version of your password.
• Business details — if you list a business: its name, description, address, phone, email, website, hours, category, logo and any photos you add.
• Group details — if you create a group: its name, description, category, logo and privacy settings.
• Content you post — reviews, ratings, comments, skill listings and discount offers.
• Messages you send — anything you submit through our contact form, including your name, email, phone and message.

Information collected automatically:

• A one-way hashed version of your IP address, stored with contact messages and used for spam and abuse prevention. We do not store your raw IP address for this purpose.
• Aggregate usage counts, such as how many times a business listing has been viewed.
• A session cookie used to keep you signed in (see Cookies below).

3. How We Use Your Information

• To create and secure your account, and to sign you in.
• To publish your business listing, group or skill listing to other users as you have configured it.
• To operate group memberships and determine which discounts you can access.
• To send transactional email — email verification, password resets, and notices about your listing's review status.
• To review and moderate listings, and to respond to your support requests.
• To detect and prevent spam, abuse and unauthorised access.

We do not sell your personal information, and we do not use it for third-party advertising.

4. What Other Users Can See

Business listings, group pages, skill listings, and reviews are public. If you publish a business or group, its details are visible to anyone. Reviews display your first and last name alongside the rating you left. Your email address is not shown publicly and is not displayed to other users except where a skill listing's contact preference requires it.

5. Cookies

We use a single essential cookie named token, which holds a signed session token so you stay signed in between requests. It is marked HttpOnly, Secure and SameSite=Lax, and it expires after seven days. We also use a short-lived session value to protect forms against cross-site request forgery. We do not use advertising or third-party tracking cookies.

6. Service Providers

We use a small number of providers to operate the Service: a hosting provider to run the application and store the database, a content delivery and security provider that sits in front of the site, and an email provider to deliver transactional messages. These providers process data on our behalf and only as needed to provide their service.

7. Data Retention

We keep account and listing information while your account is active. Contact form messages are retained so we can respond and keep a record of support history. Password reset and email verification tokens are single-use and expire (two hours and 48 hours respectively) and are marked used once consumed. If you close your account, we delete or anonymise your personal information, except where we are required to retain it by law.

8. Security

Passwords are stored using bcrypt hashing, never in plain text. Traffic is served over HTTPS. Session cookies are HttpOnly and Secure. We apply security headers and rate limiting to reduce the risk of abuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your Choices and Rights

You can review and update your name, email and password at any time from your profile. You can edit or remove your business details, photos, discounts, group details, skill listings and reviews from the relevant pages. To request a copy of your data, or its deletion, email us at <function support_email at 0x7f2255844540>. Depending on where you live, you may have additional statutory rights, including rights of access, correction, deletion and portability.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date above will reflect any change, and material changes will be communicated through the Service.

12. Contact

Questions about this policy or your data? Email <function support_email at 0x7f2255844540> or use our contact form.