1. Introduction
Rognoc ("we", "our", or "us") operates a platform that connects property owners with professional tradespeople for construction and renovation projects. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Platform").
By using the Platform, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our services.
Data controller: Csongor Szigeti (individual), 1037 Budapest, Jutas street 127., Hungary. Email: support@rognoc.com
2. Information We Collect
2.1 Account Information
When you register for an account, we collect:
- Full name (first name and last name)
- Email address
- Password (stored in hashed form using bcrypt; we never store your password in plain text)
- Phone number (optional)
- Your chosen role on the platform (Property Owner or Professional)
2.2 Profile Information
Depending on your role, you may provide additional profile information:
- Profile photo (avatar)
- Address and location details
- Preferred language (English, Hungarian, German, or French)
For Professionals additionally:- Professional type (e.g. Plumber, Electrician, Carpenter, Architect, etc.)
- Biography and years of experience
- Skills and certifications
- License number
- Portfolio URL
- Service areas and service radius
- Languages spoken
- Availability status
2.3 Location Data
We collect address and geographic coordinates for users and properties to enable location-based features such as finding nearby professionals. To protect your privacy, we use a location fuzzing system: your exact coordinates are stored securely and used only for distance calculations, while an approximate location (offset by approximately 150 meters) is displayed publicly. You can control whether your location is visible to other users through your profile settings.
2.4 Property and Project Data
When you create properties or projects on the Platform, we collect:
- Property details (name, type, address, size, year built, description, images)
- Project details (title, description, type, budget, timeline, special requirements, images)
- Task information (descriptions, required professional type, pricing, scheduling, materials and tools needed)
2.5 Communication Data
We store communications made through the Platform, including:
- Chat messages between project participants (text, images, and file attachments)
- Message read receipts and timestamps
- Feedback and contact form submissions
- Notifications sent to you
2.6 Contract and Offer Data
When you use the Platform to manage work, we collect:
- Task offers submitted by professionals (quotes, timelines, notes)
- Contracts generated between owners and professionals
- Contract signature records and timestamps
2.7 Payment and Billing Information
When payment features are active on the Platform, we may collect billing information including company name, tax number, EU VAT number, company type, and billing address. Payment card details are collected and processed directly by our payment processor (Stripe) and are never stored on our servers. We store only references such as Stripe customer and account identifiers.
2.8 File Uploads
You may upload files to the Platform, including profile photos, property images, project gallery images, inspection photos, chat attachments, and documents. We store file metadata (name, size, type) and the files themselves in secure cloud storage. All uploaded files are automatically scanned for viruses and malware.
2.9 Automatically Collected Information
When you use the Platform, we may automatically collect:
- IP address and device information (browser type, operating system)
- Error and crash reports (via Sentry) for debugging purposes — these do not include personally identifiable information
With your consent, we use the following analytics tools to understand how users interact with the Platform and improve our services:
- Google Analytics 4: Collects anonymized usage data such as page views, session duration, and user interactions. Operated by Google LLC.
- Microsoft Clarity: Records anonymized session replays and heatmaps to help us understand user behavior and improve the user experience. Operated by Microsoft Corporation.
- Meta Pixel (Facebook): Tracks page views, registrations, project creation, contact submissions, and other key actions to measure the effectiveness of our advertising campaigns and to enable retargeting. With Advanced Matching enabled, your email, name, phone number, city, postal code, country, and an internal user ID are hashed (SHA-256) in your browser and sent to Meta to improve conversion attribution. Operated by Meta Platforms Ireland Limited.
These tools are only activated after you provide consent via our cookie banner. You can withdraw or change your consent at any time using the "Cookie Settings" link in the website footer.
3. How We Use Your Information
We use your information for the following purposes:
- Providing our services: Creating and managing your account, enabling project creation, facilitating connections between owners and professionals, and delivering real-time chat and notifications
- Location-based matching: Using your location data to help owners find nearby professionals and help professionals discover relevant projects in their service area
- Contract generation: Using AI (Anthropic Claude) to generate contract drafts based on project and task details you provide
- Communication: Sending transactional emails (password resets, account notifications, project updates) and responding to feedback or contact form submissions
- Payment processing: Processing payments between owners and professionals when payment features are active
- Security and integrity: Scanning uploaded files for malware, authenticating users, preventing fraud, and maintaining platform security
- Error monitoring: Collecting anonymized error reports to identify and fix bugs
- Legal compliance: Fulfilling legal obligations and responding to lawful requests
Legal Bases for Processing
We rely on the following legal bases under Article 6 of the EU General Data Protection Regulation (GDPR):
- Performance of a contract (Art. 6(1)(b)): Account management, project creation, connecting professionals and owners, chat, notifications, contract generation, payment processing
- Consent (Art. 6(1)(a)): Analytics cookies (Google Analytics, Microsoft Clarity), advertising and retargeting cookies (Meta Pixel), marketing communications
- Legitimate interest (Art. 6(1)(f)): Error monitoring and debugging (Sentry), maintaining platform security, fraud prevention, malware scanning of uploads
- Legal obligation (Art. 6(1)(c)): Retention of billing data as required by accounting regulations
4. Third-Party Services
We use the following third-party services to operate the Platform. Each service receives only the minimum data necessary for its function:
- Stripe (stripe.com) — Payment processing. When payment features are active, Stripe processes payment card details, manages connected accounts for professionals, and handles fund transfers. Stripe's privacy policy applies to payment data they process.
- Resend (resend.com) — Email delivery. We use Resend to send transactional emails such as password resets, notifications, and contact form responses. Resend receives recipient email addresses and email content.
- Cloudflare R2 (cloudflare.com) — File storage. Uploaded files (images, documents) are stored securely in Cloudflare R2 cloud storage.
- Google Maps Platform (google.com) — Geocoding and mapping. We use Google Maps to convert addresses into coordinates and to display location information. Google receives address data for geocoding requests.
- Anthropic (anthropic.com) — AI services. We use Anthropic's Claude API to generate contract drafts and assist with task planning. Project and task details (not personal contact information) are sent to Anthropic for processing.
- Sentry (sentry.io) — Error monitoring. We use Sentry to capture and track application errors. Sentry receives anonymized error data and does not receive personally identifiable information.
- Google Analytics 4 (analytics.google.com) — Web analytics. With your consent, collects anonymized usage data (page views, sessions). Operated by Google LLC (USA). Subject to Google Ads Data Processing Terms.
- Microsoft Clarity (clarity.microsoft.com) — User behavior analytics. With your consent, records anonymized heatmaps and session replays. Operated by Microsoft Corporation (USA).
- Meta Pixel (facebook.com) — Advertising analytics and retargeting. With your consent, tracks website actions to measure ad campaign effectiveness and enable retargeting. Uses Advanced Matching which sends hashed (SHA-256) personal identifiers (email, name, phone, city, postal code, country) to Meta. Operated by Meta Platforms Ireland Limited (Ireland), subject to Meta's Data Processing Terms.
- Vercel (vercel.com) — Web hosting. The Platform's frontend application runs on Vercel's servers. Operated by Vercel Inc. (USA).
- Railway (railway.app) — Server infrastructure. The Platform's backend server and database run on Railway's infrastructure. Operated by Railway Corporation (USA).
- Fly.io (fly.io) — File upload server. The file upload service runs on Fly.io's infrastructure. Operated by Fly.io Inc. (USA).
5. Information Sharing and Disclosure
We share your information only in the following circumstances:
- With other Platform users: When you create a project, submit an offer, or participate in a chat, relevant information (such as your name, profile photo, professional details, and project-related data) is shared with the other party to facilitate the transaction. Your exact address and coordinates are never shared — only the approximate (fuzzed) location is visible to other users.
- With service providers: As described in Section 4, we share limited data with third-party services that help us operate the Platform.
- For legal reasons: We may disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
6. Data Security
We implement the following measures to protect your information:
- Passwords are hashed using bcrypt and are never stored in plain text
- Authentication uses JSON Web Tokens (JWT) with HTTP-only, secure cookies
- All data in transit is encrypted using HTTPS/TLS
- Uploaded files are automatically scanned for viruses and malware
- Internal service-to-service communication is authenticated with API keys
- CORS policies restrict which domains can interact with our API
- Exact user and property locations are fuzzed before being displayed publicly
While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.
7. Cookies and Authentication
We use HTTP-only cookies for authentication purposes (storing your session token). These cookies are strictly necessary for the Platform to function and cannot be opted out of while using the service. We use session storage to remember certain UI preferences (such as whether the welcome guide has been shown).
With your consent, we use analytics cookies from Google Analytics 4 and Microsoft Clarity, and advertising/retargeting cookies from Meta Pixel (Facebook), to understand how users interact with the Platform and to measure the effectiveness of our marketing campaigns. These cookies are only set after you accept all cookies via our cookie consent banner. You can choose to accept only essential cookies, in which case no analytics or advertising cookies will be used.
8. Data Retention
We retain your information as follows:
- Account data: Retained for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law.
- Project and contract data: Retained for as long as needed to fulfill contractual obligations and for 5 years after project completion, in accordance with the general statute of limitations under Hungarian civil law.
- Chat messages: Retained for as long as the associated project exists on the Platform.
- Error logs: Anonymized error data is retained for up to 90 days.
- Uploaded files: Retained for as long as the associated content (profile, project, chat) exists on the Platform.
9. Your Rights
Under applicable data protection laws (including GDPR for users in the European Economic Area), you have the following rights:
- Access: Request a copy of the personal information we hold about you
- Rectification: Request correction of inaccurate or incomplete information. You can also update most information directly through your profile settings.
- Erasure: Request deletion of your personal information, subject to legal retention obligations
- Restriction: Request that we restrict processing of your information in certain circumstances
- Data portability: Request a copy of your data in a structured, machine-readable format
- Objection: Object to processing of your information based on legitimate interests
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, please contact us at support@rognoc.com. We will respond to your request within 30 days.
If you believe our data processing practices violate your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):
- Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
- Website: www.naih.hu
- Email: ugyfelszolgalat@naih.hu
- Phone: +36 (1) 391-1400
10. Children's Privacy
The Platform is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, please contact us immediately at support@rognoc.com and we will take steps to delete such information.
11. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence — particularly the United States — where our third-party service providers operate (see Section 4). The legal basis for data transfers outside the EU is the Standard Contractual Clauses (SCCs) approved by the European Commission, which our service providers apply. For transfers to countries covered by an adequacy decision of the European Commission, such decision provides the appropriate level of protection.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the updated policy on this page and updating the "Last Updated" date. For significant changes, we may also notify you via email or through a notice on the Platform. Your continued use of the Platform after such changes constitutes acceptance of the updated policy.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
- Email: support@rognoc.com