Privacy Policy
Effective date: DRAFT — pending founder approval. This text is not in force yet.
This policy explains what personal data we collect when you use Assisting Work (assistingwork.com) and indstry (indstry.id), together “the Platform”, why we use it, who we share it with, and your rights.
Who we are: the Platform is run by Assisting Work Ltd, a company registered in England and Wales, company number 14363015, registered office 344 Flat 1-4 Kingsland Road, London E8 4DA. Assisting Work Ltd is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything about your data, email privacy@indstry.id.
1. What we collect
- Account data: your email address and password (stored only as a secure hash by our authentication provider), or your Google account if you sign in with Google. Your phone number if you add one, for WhatsApp notifications or to show members.
- Your ID and work: your name, photo and cover, profession and specialities, location, biography, links, and the gallery, reel, projects and credits you add.
- Your network: the connections you make, the IDs you save, the recommendations and notes you give and receive, the people you block, and the member whose shared link you joined through, if any.
- Work and messages: availability checks you send and receive, your messages, and the bookings you agree and their terms, including who cancelled a booking. Your minimum day rate, if you set one (private to you). On Assisting Work, the jobs and call outs you post or answer.
- Post-job feedback: after a booking, we may ask whether you would work with the other person again. Your answer is private to you: the other member is never shown it, nor told they were asked about. We use it to improve the matches we show you. Only where a member is the subject of a repeated pattern of serious problems (for example, repeated non-payment) may a person on our team review it.
- Membership and billing: your plan, its dates, and payment status. Stripe handles your card. We never see or store card details.
- Reports and help: reports you make about members or content, and the questions you ask Indi, our help assistant.
- Who views your ID: when you are signed in and open someone’s ID, we record the view. Members with a paid membership can see who viewed their ID. We also count how often an ID appears in directory searches, and how many people saved it. The owner sees those as numbers, never as names.
- Location searches: when you type into a location field, the text you type is sent to Google’s Places service, through our server, to suggest places.
- Technical data: IP address and basic request details, used for security, rate limiting and fixing errors. Product analytics only if you agree to it (section 5).
2. Who can see what
indstry is a trusted network. What other people see of you follows one rule:
- Your network: when you join, your ID is seen by your connections, and by the connections of any member who recommends you. A recommendation, and the note with it, is shown to the recommender’s connections. It is not shown to the person recommended.
- Verified members: a member who pays for a membership, and whose ID a person at indstry has checked, is listed in the directory for everyone and marked Verified. Their ID can be seen by anyone with the link, and can be found through search engines such as Google. Other members’ IDs are not listed publicly and are not offered to search engines.
- Email and phone: shown only to members who are signed in, never on the open web. You choose whether that is anyone on indstry or only your connections. Links you add, such as your website or Instagram, are public.
- Link previews: when your ID link is shared, the preview shows your name and picture.
- Suspended accounts: a suspended or rejected account is hidden everywhere. Its ID stops working and its link preview becomes a plain indstry card.
3. Why we use your data
- To run the Platform (our contract with you): showing your ID and work under the rules above, the directory, Latest, messages, availability checks, bookings, and your membership.
- To send service messages (our contract with you): emails about new messages, bookings and things waiting for you, and, if you choose, WhatsApp. You can change or switch off notifications in your settings. Account emails, such as a suspension notice, always go to your email address.
- To check listings and keep the Platform safe (our legitimate interest in a trusted network): a person checks paid members’ IDs before listing them, and reviews reports. When someone new joins, their name, email, profession, location and ID link are posted to a private channel in our team’s Slack, so we can see who has joined.
- To keep the Platform secure and working (our legitimate interest): rate limiting, error monitoring, and checking new passwords against known leaks.
- To understand how the Platform is used, only if you agree (section 5).
- To keep records the law requires (legal obligation): for example, billing records.
We do not sell your personal data, and we do not share it with advertisers.
4. What happens automatically
Some things on the Platform are decided by software. We want you to know which:
- Your minimum day rate: if you set one, an availability check for a commercial job with a fee below it is declined automatically, with a reply that never gives the figure. You still see the check and can reply. The Terms explain how fees are compared.
- Latest: your Latest feed is put together automatically from recent activity in your network, such as new work, projects and recommendations from the people you are connected to.
- The directory: the order of people in the directory, and tags such as “Most suitable”, are worked out automatically from your search and your network.
- Job alerts: alerts for jobs on Assisting Work go automatically to members whose ID fits the job.
- Memberships: when a paid membership ends or a payment fails, the benefits and the public listing end with it.
Decisions about your standing are always taken by a person, never by software: checking a paid member for listing, declining a listing, and suspending or closing an account. Recommendations never verify or list anyone, and withdrawing one never changes anyone’s standing. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
5. Analytics and your consent
We use PostHog, hosted in the EU, to understand how the Platform is used. It runs only if you choose Accept when we ask. Before you choose, and if you choose Decline, nothing is sent to PostHog and no analytics cookie is set. Declining changes nothing else about the Platform.
If you accept, analytics records the pages you visit and the actions you take, tied to a pseudonymous account number, never your name, email address, phone number or messages. It may also show you the occasional short survey.
If you accept, we may also record a sample of visits as a session replay: where you tapped and scrolled and what the page did, so we can see and fix what went wrong. Every word on the screen and everything you type is hidden in the recording; pictures on the page may show. We also note any error the Platform hits while you use it. Replays are kept by PostHog under its standard retention and are seen only by the team.
Changing your mind: you can change your choice at any time, as easily as you made it. Signed in, open the menu and choose Cookie settings. Signed out, open cookie settings here. If you withdraw, analytics stops straight away and its cookie is removed. Your choice is kept for six months, and then we ask again.
6. Cookies and browser storage
We use only the cookies below. The essential ones make the Platform work and don’t need your consent. The analytics ones are set only if you accept.
| Cookie | Type | Lasts | What it does |
|---|---|---|---|
| sb-*-auth-token | Essential | Up to 400 days | Keeps you signed in (Supabase Auth). Renewed while you use the Platform, removed when you log out. |
| aw_consent | Essential | 6 months | Remembers your analytics choice: accept or decline. |
| aw-theme | Essential | 1 year | Remembers light or dark mode, if you pick one in settings. |
| aw_ref | Essential | 30 days | Set only when you open a link a member shared with you (their Share your ID link or QR code, or a Recommend to join link). It records who shared it, so you are connected to them when you join. Opening an ID any other way sets nothing. |
| aw_ref_share | Essential | 30 days | Carries the shared link’s signed token, which proves the member really shared it. |
| aw_ref_rec | Essential | 30 days | Set only from a Recommend to join link: the member’s signed recommendation, used when you join. |
| aw_ref_gift | Essential | 30 days | Set only from a link that carries a gift membership: the gift, applied when you join. |
| ph_*_posthog | Analytics | 1 year | PostHog product analytics. Set only after you accept, and removed if you withdraw. |
We also keep a few small things in your browser’s own storage, which never leave your device:
| Stored item | Type | Lasts | What it does |
|---|---|---|---|
| aw-entered | Essential | Until you close the tab | Plays the short opening film once per visit, not on every page (session storage). |
| find:* | Essential | Until you close the tab | Keeps your directory filters and picks while you browse (session storage). |
| indstry.sheet.seen, iw_welcome_seen_* | Essential | Until you clear it | Remembers which notices and welcome screens you have already seen, so they don’t repeat. |
| Application draft | Essential | Until you finish joining | Saves your unfinished application, so you don’t lose it if you leave the page. |
| ph_*, __ph_opt_in_out_* | Analytics | Until you clear it | PostHog’s copy of its analytics state, only after you accept, and a note that you withdrew, if you do. |
7. Who we share data with
We share personal data only with these providers, each doing a specific job for us:
| Provider | What they do |
|---|---|
| Supabase | Database, sign-in and file storage. Holds your account, ID, network, messages and bookings. |
| Vercel | Hosts and serves the Platform (from London, UK). |
| Cloudflare | Stores, resizes and delivers the photos and images you upload. |
| Cloudflare (Turnstile) | Checks, without a puzzle, that a person and not a bot is signing up, signing in or resetting a password. Receives technical details of your browser and device. Cloudflare’s Turnstile Privacy Addendum applies. |
| Mux | Hosts and streams the reels you upload. When a reel plays, the viewer’s browser fetches it from Mux. |
| Stripe | Takes membership payments. Receives your name, email, card and billing details. |
| Postmark | Sends our notification emails, such as new messages and bookings. |
| Resend | Sends sign-in, confirmation and password emails for our authentication provider. |
| Meta (WhatsApp) | WhatsApp notifications and phone checks, only if you choose WhatsApp. Receives your phone number and the message we send you. |
| Slack | Our team’s workspace. Receives a new member’s name, email, profession, location and ID link when they join. |
| Anthropic | Powers Indi, our assistant. Receives the questions you ask, your first name and your account type, so Indi can answer from our help pages; and, when you ask Indi to find someone, your request and the search so far, only when she can’t read it on her own. Never your ID, network, rates, messages or bookings, nor anyone else’s. Not used to train AI models. |
| Google (Places) | Suggests places as you type a location. Receives only the text you type, through our server. |
| Google (Sign-in) | “Continue with Google”, only if you choose to sign in that way. |
| Sentry | Error monitoring. Error reports are stripped of IP addresses, cookies and email addresses. |
| Upstash | Rate limiting against abuse. Briefly holds request identifiers, such as IP addresses, in counters that expire within minutes, and an account’s count of Indi’s AI answers for one day. |
| Have I Been Pwned | Checks a new password against known leaks. Only the first five characters of a scrambled (hashed) form of it leave our server, never the password. |
| PostHog (EU) | Product analytics, only if you accept (section 5). |
Our public pages load fonts from Google Fonts, so your browser asks Google for the font files and Google receives your IP address. On the Assisting Work home page, films play in YouTube’s privacy-enhanced player, so YouTube receives your IP address when one plays.
Some of these providers process data outside the UK. Where they do, the transfer relies on UK adequacy regulations or on safeguards such as the UK International Data Transfer Agreement or Addendum.
We may also share data where the law requires it, or to protect the safety of our members or the public.
8. How long we keep it
| Data | How long |
|---|---|
| Account, ID and network | While your account exists. Removed within 30 days of a checked deletion request. |
| Gallery, reel, projects | Until you delete them, or your account. |
| Availability checks, bookings and their terms | While your account exists. Removed or anonymised when it is deleted. |
| Messages | While the conversation exists. Your name is removed from conversations when your account is deleted. |
| Post-job feedback, ID views and search counts | While your account exists. Removed or anonymised when it is deleted. |
| Jobs and call outs on Assisting Work | Shown until they expire, then kept with your account. |
| Billing records | 6 years, as UK tax law requires. |
| New-member notices in our Slack | Removed when your account is deleted. |
| Analytics | Kept by PostHog under its standard retention. Pseudonymous. |
| Error logs | 90 days. |
We may keep some data longer where the law requires it, or to make or defend a legal claim.
9. Your rights
Under UK GDPR, you have the right to:
- Access your personal data and get a copy of it.
- Correct it. You can edit your ID and work in the app at any time.
- Erase it. To delete your account, email privacy@indstry.id from your account email address. We check the request and complete deletion within 30 days.
- Restrict how we use it in some cases.
- Object to our use of it where we rely on legitimate interests.
- Move it: get it in a structured, commonly used format.
- Withdraw consent to analytics at any time (section 5).
- Ask a person to look again at anything decided automatically (section 4).
To use any of these rights, email privacy@indstry.id. We aim to reply within one month.
Changes to this policy
If we make important changes, we will tell you by email or in the app before they apply.
Contact us
For questions about this policy or your data, email privacy@indstry.id, or write to Assisting Work Ltd, 344 Flat 1-4 Kingsland Road, London E8 4DA.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to put things right first.