Privacy Notice

1. Who controls your data

The data controller is HIX IT LTD (Companies House 13491634), Pershore, Worcestershire, trading as Hixit.

We aim to process personal data in line with UK GDPR, the Data Protection Act 2018, and (where relevant) PECR. This notice is a draft for soft launch - not a substitute for formal solicitor review.

2. What data we process

Depending on how you use Hixit, we may process:

Account: email address, authentication data (for example magic-link or password hashes managed by our auth provider).
Profile: display name, role (homeowner / trade / both), trade categories, town or area, phone number (for contact after an accepted interest), and other details you choose to add.
Jobs: titles, descriptions, category, town/area, urgency, budget band, access notes, and status.
Photos: images you upload with a job (stored privately and shown to relevant users).
Interests: expressions of interest, messages or notes you add, and accept/decline outcomes.
Admin / safety: limited operational logs used by founder admin tools (for example account status such as bans), plus technical logs from hosting.
Technical: basic device and usage signals from our hosting and analytics (see Cookies below).

Please avoid putting special-category data, or other people’s personal data, in free-text fields unless necessary and lawful.

3. Why we use it (purposes and lawful bases)

At a high level (to be refined with a solicitor before wider marketing):

Run the marketplace - create accounts, show jobs, enable interest and accept/decline, and share contact details after an accept (typically contract / steps at your request, and legitimate interests in operating a facilitation platform).
Safety and integrity - prevent abuse, enforce rules, operate admin tools (legitimate interests; legal obligation where applicable).
Improve the service - understand usage via privacy-light analytics such as Vercel Analytics (legitimate interests; or consent where PECR requires it).
Communicate with you - sign-in emails, service messages, and responses to your requests (contract / legitimate interests).

We do not sell your personal data. Soft launch does not currently rely on paid advertising cookies.

4. Sharing

Other users after accept: when a homeowner accepts a trade’s interest, limited details (for example phone numbers and names you have provided) may be shown to the other party so you can arrange the work. Until then, we aim to keep contact details more restricted.
Service providers: infrastructure such as hosting (for example Vercel), database and auth (for example Supabase), email/DNS where used (for example Namecheap; Resend when transactional email is enabled), and analytics (Vercel Analytics, only if you Accept). They process data on our instructions as processors where that model applies. A draft processor register is kept for solicitor review.
Automated safety screening (Anthropic): when enabled, job listing content you submit - title, description, access notes, and photos - may be sent to Anthropic for automated safety screening before publication. Items held or flagged may be reviewed by a human (for soft launch, often the founder admin). This supports platform safety and integrity; it is not used to sell your data. Formal transfer and contract wording should be confirmed with a solicitor.
Law: we may disclose information if required by law or to protect rights, safety, or the platform.

5. Retention (outline)

We keep account, profile, job, photo, and interest data while your account is active and as needed to provide the service. Job photos are generally kept while a job is open and for up to 90 days after it is marked filled or cancelled (longer if needed for safety, legal claims, or an open moderation investigation), then deleted or anonymised. If you ask us to erase data, or we close an account, we will delete or anonymise personal data within a reasonable period, except where we need to retain limited records for legal claims, abuse prevention, or legal obligation. Exact retention schedules should be confirmed with a solicitor before relying on this notice.

6. Your rights (UK)

Under UK data protection law you may have rights to:

access your personal data;
rectify inaccurate data;
erase data in certain cases;
restrict or object to certain processing;
data portability in certain cases;
withdraw consent where processing is based on consent.

To exercise these rights, email hello@hixit.co.uk. You can also complain to the UK Information Commissioner’s Office (ICO) - see ico.org.uk.

7. Cookies and similar tech

We use essential cookies/storage needed to keep you signed in and run the site securely. Analytics cookies are optional: on first visit we ask you to Accept or Reject Vercel Analytics. We only load that script if you Accept; Reject means no analytics script. Your choice is stored in localStorage on your device. This is a light consent banner, not a full cookie management platform. If we add further non-essential cookies later, we will update this notice and, where PECR requires it, seek consent. PECR/cookie approach should be confirmed with a solicitor before wider invite.

8. International transfers

Some providers (including, where used, Vercel, Supabase, and Anthropic) may process personal data outside the United Kingdom. Where international transfers occur, we intend to rely on appropriate safeguards required by UK GDPR (for example a UK adequacy regulation, or standard contractual clauses / UK international data transfer agreement as applicable). The exact mechanism for each provider is subject to formal solicitor review and is not finally confirmed in this draft notice.

9. Children

Hixit is aimed at adults (18+). We do not knowingly collect personal data from children.

10. Changes

We may update this Privacy Notice. The “Last updated” date at the top will change when we do. Please check this page from time to time.

11. Contact

HIX IT LTD · Pershore, Worcestershire · hello@hixit.co.uk.