Privacy Policy

1. Data controller

The controller of personal data for Zeloris Help is Nexidy Labs OÜ, registry code 17422633, located in Narva, Estonia (Estonian Business Register).

Contact for privacy and support: support@zeloris.help. You may also use Support in the app settings where available.

2. What Zeloris Help is

Zeloris Help is a local marketplace for nearby small tasks. Depending on the features you use, you may create an account; post or discover tasks; submit or accept offers; use task chat; coordinate location; create a provider profile; send or receive Direct Service Requests; leave ratings; report or block users; purchase optional digital services (Pro, Task Boost, Featured Provider); and browse limited public task or provider information on the website.

The app is available in English, Estonian, and Russian.

3. Categories of personal data

Depending on how you use the service, we may process:

• Account and sign-in data — for example email address, sign-in method identifiers (email/password, Apple, Google, and other configured providers), and security-related authentication metadata.
• Profile data — display name, optional avatar, language and notification preferences, and records of which Terms and Privacy Policy versions you acknowledged in the app.
• Marketplace content — task titles, descriptions, categories, budgets, schedules or notes, photos, offers, task chat messages, completion state, and ratings.
• Provider profile data — headline, about text, service area, categories, pricing notes, whether you accept requests, and related directory fields you choose to publish.
• Direct Service Requests — information linking a customer request to a provider.
• Location data — approximate public task location for discovery before a match; exact private task location for matched participants after an offer is accepted; optional live helper location while sharing is enabled; and coarse arrival or progress information used for coordination.
• Safety and moderation data — reports, blocks, and review information needed to handle abuse.
• Push notification data — device push tokens and related delivery records (via Expo, Apple Push Notification service, and Firebase Cloud Messaging).
• Purchase and entitlement data — subscription and access status, Task Boost and Featured Provider records, and purchase verification data needed to validate Apple App Store / Google Play transactions (for example product identifiers and store transaction references).
• Product analytics — limited first-party usage and reliability events stored in our systems (designed not to include exact location, task free text, or chat message bodies).
• Technical diagnostics — crash or error diagnostic codes via Expo EAS Observe, without deliberately attaching marketplace free-text content.
• Website technical logs — ordinary server or hosting logs needed to deliver the static site and public browse or share pages. This website does not load third-party marketing analytics tools.

4. Purposes, legal bases, and necessary data

We process personal data only for the purposes below. Where the EU/EEA GDPR applies, the main legal bases are as follows.

• Providing the service you request (account, profile, marketplace posts and offers, chat, matching coordination, provider directory features, optional digital entitlements) — performance of a contract with you (GDPR Art. 6(1)(b)).
• Securing the platform, preventing fraud and abuse, handling reports and blocks, and limited first-party analytics needed to understand reliability — legitimate interests (GDPR Art. 6(1)(f)), balanced against your rights.
• Optional device features that the operating system treats as permission-based — for example push notifications or live location sharing — consent where required (GDPR Art. 6(1)(a)). You can withdraw that consent at any time by turning off the relevant permission or feature in the app or device settings; withdrawal does not affect processing already carried out lawfully before withdrawal.
• Compliance with legal obligations that apply to us — legal obligation (GDPR Art. 6(1)(c)), where applicable.

Data that is generally necessary to provide the core service includes sign-in credentials (such as email), a display name for marketplace identity, and the marketplace content you choose to submit when you use those features. Optional features (for example an avatar, live location sharing, push notifications, or paid digital services) process additional data only when you use them.

Acknowledging this Privacy Policy in the app records that you were informed about processing. It is not treated as a single blanket consent covering every processing activity listed here. Processing continues on the bases above.

We do not sell personal data and do not use advertising tools for cross-app tracking.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Offer acceptance and similar marketplace choices are made by users.

5. Location privacy

Before a match, other users generally see an approximate public location for a task — not the exact private address.

After an offer is accepted, exact task location is available to matched participants for that task.

Live helper location sharing is optional and intended for arrival coordination while sharing remains enabled. Coarse arrival progress may still be shown to the customer under participant rules even when live map sharing is off.

Route suggestions for approved features use Mapbox Directions on our servers. Map display may use Google Maps (Android) or Apple Maps (iOS).

6. User-generated content, messaging, and provider features

Content you submit (tasks, offers, chat, photos, ratings, provider profile text, Direct Service Requests) is processed to show it to the intended recipients under marketplace rules and to operate moderation.

Other users may see open tasks and public provider profiles. Where enabled, the public website may show limited public fields on browse or share pages.

Users may report tasks or users and block users. Our moderation team reviews reports in an internal tool that is not part of this public website.

7. Payments: task pay vs digital purchases

Payment for real-world task work is arranged directly between the customer and the helper outside Zeloris platform settlement. Zeloris does not hold task escrow, pay helpers for task work, or take commission from task pay in the current model.

Optional digital services sold by Zeloris — Pro subscription, Task Boost, and Featured Provider — are purchased through Apple In-App Purchase and/or Google Play Billing. Apple and Google process those store payments under their own terms. We receive and process purchase verification data needed to grant, renew, revoke, or expire the corresponding access on our systems.

We do not store full payment card numbers for those store purchases on Zeloris systems.

8. Analytics and diagnostics

First-party product analytics events in the mobile app are kept for 90 days and then deleted. They are operational data and are not used to build advertising profiles.

Crash and error diagnostics via Expo EAS Observe are limited to technical stability signals. How long the diagnostics provider keeps related records is determined by that provider and is separate from the 90-day analytics deletion.

This public website does not load third-party marketing analytics tools.

9. Recipients and service providers

Depending on the feature, personal data may be disclosed to:

• Other users — for example task or provider information you make available, chat between matched participants, and approximate or exact location according to the location rules above.
• Our processors and infrastructure providers acting on our instructions, including: Supabase (authentication, database, file storage, realtime features, and server functions; Production region EU North / Stockholm); Expo, Apple Push Notification service, and Firebase Cloud Messaging (push delivery); Mapbox (route directions for approved features); Google Maps (Android map display) and Apple Maps (iOS map display); Resend (transactional account emails such as confirmation and password reset); Vercel (public website hosting); and Expo EAS Observe (crash/error diagnostics).
• Apple and Google — where you use their sign-in or make in-app purchases; they also process store payments under their own roles and terms.

We do not sell personal data to third parties for their own marketing.

10. Retention and account deletion

We keep personal data only as long as needed for the purposes described in this Policy, including security, handling disputes or abuse, and complying with law.

Product analytics events are deleted after 90 days. Other data is kept while your account is active and the relevant marketplace or security purpose continues, unless a shorter period applies or you delete your account.

You can delete your account in the app: Settings → Privacy & safety → Delete account (two confirmations). Instructions are also at https://zeloris.help/delete-account.

When you delete your account, we remove your sign-in identity and personal profile information so you can no longer use the account. We also remove or clear private data such as preferences, push tokens, your private task locations, photos on tasks that are deleted or anonymised, messages you authored (and related chat content on anonymised tasks), blocks, and ratings that involve you. Ongoing matched work is cancelled as a neutral safety exit so deletion itself does not create a reliability penalty for you.

Some limited information may remain where another user still needs a coherent marketplace history: for example an anonymised task or offer record without your name, contact details, or private location. Redacted moderation records without personal details may also remain for security and audit integrity. Analytics events may remain without a link to your user account until the 90-day analytics deletion runs. Store purchase records held by Apple or Google remain subject to their own retention rules.

11. Your rights (including GDPR)

If the GDPR or equivalent law applies to you, you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability, subject to legal limits.

Where processing is based on consent, you may withdraw that consent at any time as described in section 4, without affecting the lawfulness of processing before withdrawal.

You may also have the right to lodge a complaint with a supervisory authority. For Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), without prejudice to other competent authorities where you live or work.

To exercise rights, contact support@zeloris.help. Some requests can be handled directly in the app (for example profile edits or account deletion).

12. International transfers

Primary application data is hosted with Supabase in the European Union (Stockholm / eu-north-1). Some service providers (for example Apple, Google, or Expo push and diagnostics paths) may process data in other countries.

Where a transfer outside the EU/EEA requires safeguards, we rely on the transfer tools those providers make available under applicable law — for example Standard Contractual Clauses — or on another lawful ground that applies to that transfer. We do not claim a specific transfer tool for every vendor beyond what those providers document for their services.

13. Children and eligibility

Zeloris Help is intended for people who can lawfully create an account and use an online marketplace service under the laws that apply to them. It is not designed for children and is not offered as a children’s product.

If you are not legally able to use the service, do not create an account.

14. Changes

We may update this Privacy Policy when the service or legal requirements change. The “Last updated” date and version id (currently 2026-10-19) identify the published version.

When a new Privacy Policy or Terms version must be reviewed before you continue in the app, we will ask you to review the updated documents. Smaller informational edits that do not require that step will not change the required version id.