Privacy Policy

1. Controller

NADO APP LTD, company number 17434089, registered in England and Wales, is the controller where that role applies. Registered office: 5 Williams Road, Upper Heyford, Bicester, England, OX25 5AX, United Kingdom. Privacy contact: hello@nadoapp.ch. We have not appointed a Swiss representative. This notice does not determine whether one is required.

2. What we collect

• Account data — name, email, password hash or OAuth identifiers, interface language, account status.
• Contact data — optional phone number.
• Profile data — display name, bio, photos you upload, languages, locations you choose to show.
• Provider service information — the services you list, prices, availability.
• Identity-verification status — result, vendor name, reference, dates. Raw ID images only if you upload them for the current manual check.
• Business details — only if you claim a registered business.
• Qualification or licence evidence — only when a rule, a badge claim or a review asks for it.
• Messages, bookings and quote requests.
• Reviews you write or receive.
• Support tickets and reports you file.
• Approximate location from a postcode or city you enter; not continuous tracking.
• Technical logs needed to keep the service secure.
• Cookie and analytics identifiers — only after you accept analytics cookies, if those tools are configured.
• Marketing preference (opt-in on the customer profile).
• For Ukraine participation — a mission flag, not a professional check.

We do not collect payment-card data. NADO does not currently take payment for a professional’s work.

Health information

NADO does not ask for medical records, diagnoses, medication lists or other sensitive health information, and does not want them. Healthcare professionals can be discovered on NADO. Public healthcare requests are not posted. If you choose to message or book a healthcare professional, or to file a safety report, you may type health information yourself. Please include only what is necessary to make contact or to report a concern.

That text is stored with the message, booking or report so the other participant, and authorised NADO staff dealing with a safety report, can read it in the app. It is not placed in ordinary notification emails, product analytics, marketing events or automatic AI features. Identity documents, licence documents and incident evidence files are not sent to those tools either. Access to the thread or booking requires an authenticated account that is party to it, or an authorised admin role. Public pages and search engines are not given the text.

Messages are kept for the period in the retention list below, then deleted. You can ask for access, correction or deletion by writing to the privacy contact. Some records may be kept longer where a dispute, a safety report or the law requires it.

3. Why, and on what basis

• Providing the account and marketplace — contract.
• Identity and service-specific compliance — contract and legitimate interests in not facilitating illegal or unauthorised work; sometimes a legal obligation.
• Security, fraud and abuse prevention — legitimate interests.
• Optional analytics — consent.
• Marketing email — consent, which you can withdraw.
• Responding to a regulator or court — legal obligation.

We do not treat every processing activity as “consent”. Things needed to run your account are not optional tick-boxes.

4. Identity verification

Publishing services requires an identity check. Today that is a manual review by NADO staff: you may upload an image or PDF of an official ID. No third-party KYC vendor is connected. NADO does not run its own facial recognition. If a vendor is added later, this notice will name them, say whether they receive raw images or only a result, and whether liveness or biometric matching occurs. Raw ID files are stored in a private bucket, are not shown to other users, and are scheduled for deletion after the retention period once a decision is recorded.

5. Where data goes

We do not claim that all data is stored in Switzerland. Active processors in this environment: Amazon RDS (PostgreSQL) (Primary application database; region: eu-central-2); Amazon S3 (or S3-compatible storage) (Public media and private compliance documents; region: eu-central-2); Transactional email (EmailJS) (Account verification, resets, booking notices, support replies; region: EmailJS (server-side delivery)); OpenAI (Optional campaign / placeholder image generation (admin, not live listings); region: United States); Stripe (Hosted checkout for the optional For Ukraine supporter membership; region: Ireland / United States, per Stripe's own infrastructure). International transfers, if any, depend on those processors’ regions.

6. How long we keep it

• account — 365 days after account closure, then deletion of residual profile fields
• identity result — 1825 days after verification decision
• identity raw — 90 days after verification decision (approved or rejected)
• licence evidence — 365 days after document expiry or replacement
• support — 1095 days after ticket closed
• security logs — 365 days after log created
• messages — 1095 days after last message in the conversation
• deleted account — 30 days after deletion requested
• legal audit — 2190 days after compliance decision or rule change

7. Your rights

You can access and correct account data from Profile & settings, export a copy of your data from the same place (a structured file we generate), and request deletion. Deletion anonymises reviews you left so the professional’s public record stays intact. Marketing opt-out is in your customer profile. Some requests — objection to a particular legitimate-interest use, or a complex access request — are handled by writing to hello@nadoapp.ch. We do not promise instant automation for every right.

8. High-risk processing

Before enabling facial recognition, biometric matching or large-scale sensitive-data processing we will complete a data-protection impact assessment. That work is not done yet because those systems are not live.

How we measure use

Optional analytics cookies (PostHog, Google Analytics) run only with your consent. Separately, we record first-party product events — profile views, search appearances, empty searches and contact clicks — on our servers without an extra tracking cookie, so professionals can see demand and we can fix searches that return nothing. Details are in the cookie policy.