Privacy Policy

1. Information We Collect

Personal Information:

• Name, email address, and phone number
• Profile information and professional details — title, skills, hourly rate, location, avatar, and bio
• Payment details — the amount, transaction reference, payment method, and a masked mobile-wallet number for payments made through our payment partners. Full card numbers, PINs, and OTPs are entered on the payment partner's own page and are never collected by us
• Communication records and messages exchanged on the platform. When a message is edited, the earlier text is kept and can be read only by mehenot staff, for disputes
• A record of each step of a contract (offered, funded, delivered, approved, paid, refunded, disputed), which both parties are emailed and can view as the contract's Job record
• Files delivered on a contract, stored privately and opened only by the two parties and mehenot staff through links that expire
• Portfolio items and work samples
• Preferences and interests, such as the categories you browse and the language you choose

Usage Information:

• Platform usage patterns and preferences
• Device information and IP addresses
• Cookies and similar tracking technologies
• Log files and analytics data

We collect this information when you:

• Create an account or sign in with Google
• Build or edit your profile, post a project, or publish a service
• Make a payment — a contract deposit or a credit purchase
• Message another user, apply to a project, or order a service
• Contact our support team
• Interact with the website or app through cookies and similar technologies

2. Signing In With Google

You can create a mehenot account, and sign in to it, with your Google Account. When you do, Google shows you a consent screen and then passes us only the following, which we store on your mehenot profile:

• Your name — so your profile, your messages, your contracts and your invoices name a person rather than an email address
• Your email address — it is the identifier your account is keyed to, it is how we recognise you on your next visit, and it is where contract, payment and account notices are sent
• Your Google profile photo — used as your starting avatar so your profile is not blank on day one. You can replace it or remove it at any time from your profile settings

That is the whole of it. We do not request, receive, or store your Google password, and we ask Google for no access beyond your basic profile and email address — not your Gmail, contacts, Drive files, calendar, photos, or any other Google service. We do not use Google user data to train any machine-learning or AI model, we do not sell it, and we do not transfer it to anyone except as described in section 4.

mehenot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can read that policy at developers.google.com/terms/api-services-user-data-policy. You can withdraw mehenot's access to your Google Account at any time from your Google Account permissions page. Doing so stops future Google sign-ins; it does not delete your mehenot account or the data already on it — to delete those, see section 6.

3. How We Use Your Information

We use your information to:

• Sign you in — your name, email address and profile photo, whether typed in or received from Google, identify your account and keep you signed in across the website and the Android app
• Build your public profile — your name, photo, title, skills, rate and portfolio are what a client sees when deciding whether to hire you
• Match clients and freelancers — we use your skills, category, location and activity to suggest work to freelancers and freelancers to clients, and to rank search results
• Take and settle payments — we use your name, email, phone number and transaction details to take a payment, to hold a contract deposit in escrow until the work is approved, to release it to the freelancer, and to issue invoices and refunds
• Prevent fraud and abuse — we use account, device, payment and messaging signals to detect fake accounts, scams, stolen payment instruments, and attempts to manipulate orders, ratings or reviews, and to enforce our Terms
• Provide and improve our platform services
• Facilitate communication between clients and freelancers
• Process your payments, hold and release contract deposits, and manage contracts
• Personalise what you see — for example the categories and freelancers suggested to you
• Send important updates and notifications about your contracts, payments, and account
• Send promotional emails and platform announcements, which you can opt out of at any time
• Review projects, services, images, and profiles against our content standards (see section 7 of the Terms of Service), and record the moderation decision and the reason sent to you
• Prevent fraud and ensure platform security
• Comply with legal obligations
• Analyze usage patterns to improve user experience

4. Information Sharing

We never sell your personal information, and we never rent or trade it. We do not share it with advertisers or data brokers. It leaves mehenot only in the situations below, and only to the extent each one needs.

We may share your information with:

• Other Users: Basic profile information visible to potential clients/freelancers
• Payment Processors: When you pay through the platform we share only what the payment needs — your name, email, phone number, the amount, and a transaction reference — with our payment partners, SSLCommerz (bKash, Nagad, Rocket, Visa, Mastercard, and other supported methods) and bKash. Card numbers, PINs, and OTPs are entered on the processor's own PCI-DSS-certified page and never reach mehenot; we store only the transaction ID, status, and a masked payer number. The merchant account is registered under the name SaasVentur, so that is the name the payment partner sees
• Payment Partners, by name: SSLCommerz (the gateway that carries bKash, Nagad, Rocket, Visa, Mastercard and other supported methods) and bKash. They receive your name, email, phone number, the amount and a transaction reference — nothing about your work, your messages or your contracts
• Service Providers: Third-party services that help us operate the platform, each bound to use your data only to provide that service to us. The one that holds your account data is Supabase, our database, authentication and file-storage provider. The others are limited to email delivery, push notifications, hosting, analytics, and the AI models behind mehenot AI
• Legal Authorities: When the law requires it — a court order, a lawful request from a regulator or a law-enforcement agency in Bangladesh, a tax obligation — or where sharing is necessary to establish or defend a legal claim, to investigate fraud, or to protect the safety of our users. We disclose only what the request actually covers
• Business Transfers: In case of merger, acquisition, or sale of assets

5. Storage and Security

Your account data — your profile, your listings, your messages, your contracts and your files — is stored in our Supabase project (managed PostgreSQL, authentication and object storage), on infrastructure operated by Supabase and its cloud providers. The website and the Android app are served from Cloudflare's network. Every page and every API call is served over HTTPS, and mehenot.com sends HSTS, so a browser will not connect to it unencrypted at all.

We implement appropriate security measures to protect your information:

• Encryption in transit (HTTPS/TLS on every request) and at rest (database and file storage encrypted by the provider)
• Row-level access rules in the database, so one account cannot read another account's private data
• Regular security audits and updates
• Access controls and authentication systems
• Secure payment processing through PCI-DSS-certified providers — every payment page is served over HTTPS and card or mobile-wallet credentials never touch our servers
• Employee training on data protection practices

No method of transmission over the internet or of electronic storage is entirely secure. We work to protect your information, but we cannot guarantee absolute security, and you should keep your account credentials confidential.

6. Data Retention and Deletion

We retain your information for as long as necessary to provide our services and comply with legal obligations. Specifically:

• Account information: Until account deletion or 3 years of inactivity
• Contract and payment data: 7 years for tax and legal compliance
• Communication records: 2 years after contract completion
• Moderation records (rejected or removed listings and the reason given): 2 years, so repeat violations can be identified
• Analytics data: 2 years in anonymized form

Deleting your account and your data

You can delete your account yourself from Settings → Danger Zone in the app or on the website, which takes effect immediately. If you cannot sign in, or you would rather ask us, email mehonotforlife@gmail.com from the address registered to your account, with the subject “Delete my account”.

Either way, your account and the personal data on it are deleted within 30 days of the request. That includes everything we received from Google — your name, email address and profile photo. The only exceptions are the records we are legally required to keep: transaction and payment records for tax and anti-fraud obligations, and records of disputes or policy violations needed to protect other users. Those are kept secure, are not used for anything else, and are listed with their retention periods above and on our account deletion page.

7. Your Rights

You have the right to:

• Access and review your personal information
• Correct inaccurate or incomplete data
• Request deletion of your account and data
• Object to certain processing activities
• Data portability (receive your data in a structured format)
• Opt out of marketing communications at any time

To exercise any of these rights, email legal@mehenot.com from the address on your account. Account deletion is also available in-app and described on our account deletion page.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Remember your preferences and settings
• Analyze platform usage and performance
• Provide personalized content and recommendations
• Ensure platform security and prevent fraud

We use strictly necessary cookies for sign-in and security. We also use three measurement tools: Google Analytics, PostHog and the Meta Pixel. They show us which pages are visited, how people move through the platform, and which of our own ads brought someone to mehenot and whether they then signed up, posted a project or placed an order. For that, these tools receive the page address, the action (for example “signed up”), their own cookie ID, your IP address and browser type, as they do on any website that uses them, and, if you are signed in, an internal account number that means nothing outside mehenot.

They never receive your name, email address, phone number, messages, payment details, or anything you type. We have switched off the features of these tools that read forms or page text, screen recordings hide all text, and we never upload customer lists to Meta, Google or any other advertising platform. You can manage cookies through your browser settings, but disabling necessary cookies will prevent you from signing in.

9. Third-Party Services

Our platform integrates with third-party services for payment processing, analytics, and communication. These services have their own privacy policies, and we encourage you to review them.

No third-party advertising. mehenot does not display third-party advertisements and does not sell, rent, or share your personal information with advertisers or data brokers. Any sharing of customer information with a third party is mehenot's responsibility and happens only as described in section 4.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information during such transfers.

11. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will take steps to delete the information.

12. Changes to This Policy

We may update or modify this Privacy Policy at any time. Changes are effective immediately upon posting the revised policy on this page, and the date at the top always reflects the current version. We will notify you of significant changes via email or platform notification. Your continued use of the platform constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Data controller: mehenot (sole proprietorship, registered under the name SaasVentur)
• Trade licence: APPT/DNCC/011093/2026, Dhaka North City Corporation (DNCC)
• Registered address: Jabbar Housing, Darussalam, Mirpur, Dhaka-1216, Bangladesh
• Country: Bangladesh
• Email: legal@mehenot.com (privacy) · support@mehenot.com (support) · mehonotforlife@gmail.com (data deletion)
• Hours: 9 AM – 6 PM (GMT+6), Sunday – Thursday