Privacy policy

ClickLancer is currently operated by its founders ahead of incorporation. They are the controller of personal data processed through the Services (“ClickLancer”, “we”, “us”). When a company is formed to operate ClickLancer, it will become the controller, this policy will be updated with its legal name and address, and we will tell people with an account or a waitlist signup.

For any question about this policy or your personal data, contact privacy@clicklancer.com.

This policy applies to everyone who visits the site, joins the waitlist, is invited to the private preview, creates an account, or uses the marketplace as a client, a freelancer or both. It does not apply to personal data that clients and freelancers exchange with each other and process for their own purposes (for example, a client's customer list shared for a task). In that case the user who decides how that data is used is responsible for it, and must have a lawful basis to share it.

We collect only what we need for the purposes in section 5. Depending on how you use the Services, this may include:

• Waitlist data. Your email address, whether you want to find work, hire, or both, the date and time you agreed to be emailed, and the version of this policy you saw. You also get a random invite code for your own share link. If you joined through someone's invite link, we note which code it was, so their place in line moves up. We never show anyone who joined through their link.
• Identity and contact data. Name or display name, email address, phone number, country of residence and, for business clients, business name. You choose your country when you sign up; if you change it later, we keep a record of the old and new country and when you changed it.
• Account and profile data. Sign-in records, a scrambled (hashed) form of your password that can't be turned back into the password, settings, your confirmation that you are at least 18, when you accepted our Terms and this policy and which versions, role, headline, biography, skills, portfolio items, availability, ratings, reviews and quality statistics.
• Verification data. Confirmation that your email and phone number belong to you and, when you withdraw funds or when required by law or by a payment provider, identity, age, tax and payout verification. Identity documents and biometric checks are handled by specialised verification providers; we receive the result and limited supporting details, not a copy of your documents, wherever that is possible.
• Transaction and financial data. Amounts funded, earned, refunded, held and withdrawn, fees, invoices, payout account identifiers (such as a PayPal account email) and payment status. Card and bank details are entered with and stored by the payment provider; we do not store full card numbers.
• User Content. Anything you post, upload or submit: project and campaign listings, proposals, deliverables, proof of work, files, images, audio and video, and their metadata (such as file names, formats, durations and, if you do not remove it, embedded location or device information). Media may contain the image or voice of you or other people.
• Communications. Messages between users on the platform, revision requests, rejection reasons, appeals, dispute evidence, reports, and your correspondence with us.
• Technical and usage data. IP address, approximate location derived from it (such as the country and time zone our hosting provider assigns to your connection), your browser's time zone setting, browser and device type, operating system, pages and features used, timestamps, referring pages, and error and security logs.
• Trust and safety data. Signals used to detect fraud, duplicate accounts and abuse (for example, whether a connection comes from a VPN or proxy, rate of activity, rejection and appeal rates, chargebacks), and records of warnings, restrictions and enforcement decisions.
• Preferences. Your notification and marketing choices, and the listings you save to look at later (only you can see them, and you can remove them at any time).

We do not intentionally collect special category data (such as health, religion or political opinions). Please don't include it in your profile or User Content unless a task genuinely requires it and the listing says so.

Most of this data comes from you. Some comes from other users (for example, a review, a rejection reason or a dispute statement about your work), from our service providers (for example, a payment provider confirming that a payment succeeded or a verification provider confirming your identity), from the devices and browsers you use to access the Services, and, for fraud prevention, from public or commercially available sources such as sanctions lists.

We process personal data only where a legal basis applies. Under the EU and UK General Data Protection Regulation (“GDPR”), those are:

• Sending waitlist and launch emails

  Data: Email address, role, consent record.

  Legal basis: Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time.

• Creating and running your account and providing the Services

  Data: Identity and contact, account and profile, User Content, communications, transactions.

  Legal basis: Performance of a contract with you (Art. 6(1)(b)).

• Funding, fees, payouts, refunds and the transaction ledger

  Data: Transaction and financial data, verification data.

  Legal basis: Performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)).

• Verifying identity and eligibility, and preventing fraud, spam and abuse

  Data: Verification, technical, usage and trust and safety data.

  Legal basis: Legitimate interests in keeping the marketplace safe and honest (Art. 6(1)(f)), and legal obligations where they apply (Art. 6(1)(c)).

• Reviewing work, handling rejections, appeals, disputes and reports

  Data: User Content, communications, transaction records, moderation records.

  Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interests in resolving disputes fairly (Art. 6(1)(f)).

• Storing, scanning and processing uploaded files and media

  Data: User Content and file metadata.

  Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interests in security and content safety (Art. 6(1)(f)).

• Service messages, security alerts and support

  Data: Identity and contact, account, communications.

  Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)).

• Keeping the Services secure, available and working, and improving them

  Data: Technical and usage data, generally aggregated or pseudonymised.

  Legal basis: Legitimate interests (Art. 6(1)(f)).

• Tax, accounting and regulatory reporting, and responding to lawful requests

  Data: Identity, verification, transaction and financial data.

  Legal basis: Compliance with legal obligations (Art. 6(1)(c)).

• Establishing, exercising or defending legal claims and enforcing our terms

  Data: Any relevant category.

  Legal basis: Legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment. Where data is needed to enter into or perform a contract with you, or to meet a legal requirement, we may not be able to provide the relevant feature without it.

We do not sell personal data, and we do not share it with advertisers or data brokers.

Location check on proposals. Paid work on ClickLancer is tied to the country on your account. When you send a proposal, we compare the country our hosting provider (Vercel) assigns to your connection's IP address with the country on your profile, and refuse the proposal if they differ. The proposal form also compares your browser's time zone setting with the time zone of your connection and, if they are far apart, shows you a note that you may be using a VPN or proxy. Both checks happen at that moment only: we do not store your connection's country or time zone, and your browser's time zone never leaves your device. Using a VPN is not in itself a reason to restrict an account. If you think the check got your location wrong, contact privacy@clicklancer.com.

To keep the marketplace safe we use automated checks, for example to rate-limit sign-ups, flag unusual payment activity, detect duplicate accounts, scan uploaded files for malware, and flag clients whose rejection rate is unusually high. Before a message, proposal, hand-in or revision request reaches the other person, we check it for email addresses, phone numbers, messaging-app handles and payment details meant to move the work or the payment off ClickLancer. If we find any, it is not sent and we tell you which parts to remove; we keep only a count of these refusals on your account, not the text, and after repeated refusals a moderator is asked to review the account. These checks can delay an action or route it to a person for review. We do not make decisions that have legal or similarly significant effects on you, such as closing an account or withholding earnings, based solely on automated processing. A person reviews those decisions, and you can ask for an explanation and contest them by contacting privacy@clicklancer.com.

We disclose personal data only as described here:

• Other users. Your public profile, reviews and quality statistics are visible to other users, and so is your country, shown as a flag next to your name. When you work with someone, they see what is needed for that work: for example, a client sees a freelancer's proposal and deliverables, and a freelancer sees the client's listing and feedback.
• Service providers (processors). Companies that host, store, deliver, process or secure data for us under contract and only on our instructions, in these categories: hosting and content delivery, databases and file storage, media processing, email delivery, phone verification, identity verification, payments and payouts, fraud prevention, customer support tools, and error monitoring.
• Payment providers. Payment and payout providers such as PayPal process payments as independent controllers under their own privacy policies, and may need to verify your identity themselves.
• Professional advisers. Lawyers, accountants, auditors and insurers, under a duty of confidentiality.
• Authorities and legal process. Tax authorities, courts, regulators and law enforcement where we are legally required to, or where it is necessary to protect the rights, property or safety of ClickLancer, our users or the public.
• Business changes. A company formed to operate ClickLancer, or a successor or acquirer in a merger, financing, reorganisation or sale of all or part of the business, subject to this policy.

The providers that process personal data for us today are:

• Vercel Inc. (United States): hosting and server logs.
• Neon, Inc.: database for the waitlist and invited test accounts, hosted in Frankfurt, Germany.
• Resend, Inc. (United States): delivery of sign-in emails and account notification emails.

We will update this list before any new provider starts processing personal data.

Some providers are located in, or access data from, countries outside the UK and the European Economic Area, including the United States. Where that happens we rely on an adequacy decision (such as the EU–U.S. Data Privacy Framework and its UK extension, for certified companies) or on the European Commission's Standard Contractual Clauses and the UK addendum, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

We keep personal data only as long as needed for the purpose it was collected for. In particular:

• Waitlist signups: until you unsubscribe or ask us to delete them, or until we close the waitlist.
• Account data: for as long as your account is open, and a limited period after it closes.
• Transaction, ledger and tax records: for as long as tax, accounting and anti-money-laundering laws require, which can be up to ten years.
• User Content and messages linked to a project or campaign: until the work and any review, appeal, dispute or chargeback period has ended, then for up to 24 months to handle claims. This applies even if you delete your account, because the other side relies on the same record; we remove your name, email and profile from it.
• Server and security logs: for a short period, unless needed to investigate an incident.
• Records of enforcement decisions: for as long as needed to prevent the same person from returning to commit fraud or abuse.

When the retention period ends, we delete or anonymise the data.

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls that limit staff access to people who need it, audit logs for sensitive actions, re-authentication for payout and security changes, and backups. No system is completely secure. If a personal data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires.

Depending on where you live, you have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its use (including any use for direct marketing), to receive it in a portable format, and to withdraw consent at any time without affecting processing that took place before. These rights have legal limits: for example, we may keep transaction records the law requires us to keep.

You can unsubscribe from waitlist emails with the link in any of them, which deletes your signup. For any other request, email us from the address you used with ClickLancer or write to privacy@clicklancer.com. We may need to verify your identity first. We will reply within one month, which the law allows us to extend in some cases; we will tell you if we do.

You also have the right to complain to a data protection authority, in particular where you live or work. In the UK that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

The public site does not set cookies or use analytics, advertising pixels or third-party scripts. The private preview and signed-in areas use only strictly necessary cookies. The cookie policy lists each one. We will ask for your consent before using any cookie that is not strictly necessary.

The Services are not directed at children. The waitlist is open to people aged 16 and over, and accounts are open to adults only. If we learn that we hold data about someone below those ages, we will delete it.

We may update this policy as the Services develop, new features launch, or the law changes. The date at the top shows the current version. If a change materially affects how we use personal data you have already given us, we will notify you by email or in the Services before it takes effect and, where the law requires, ask for your consent.

Questions, requests and complaints about privacy: privacy@clicklancer.com.