SqueRoots Privacy Policy

What we hold depends on how you use SqueRoots. We have grouped it by the kind of relationship you have with us.

If you are a client

• Your name, email address, and phone number
• Your password, stored only as a salted cryptographic hash — we never store or have access to the password itself
• A profile photo, if you upload one
• Your city and country, used to set regional context on your account
• Your Google account identifier, if you choose to sign in with Google rather than a password
• Property and project details: the site address, city, and country, project descriptions, budgets, milestones, and scheduled dates
• Financial records relating to your project: escrow deposits, milestone releases, amounts, currency, payment status, and the reference issued by our payment provider
• Messages you exchange with contractors and with our team
• Sign-in timestamps and activity records associated with your account

If you are a contractor

• Your name, email address, and phone number
• Your password, stored only as a salted cryptographic hash
• Professional background you provide during verification: your biography, years of experience, and supporting information
• Your verification status and the record of the administrator who approved or rejected your application
• The projects, milestones, and tasks assigned to you
• Progress updates you submit, including photographs and video taken on site
• Messages you exchange with clients and with our team

If you visit our website

• Your name and email address, if you request the white paper or book a consultation
• Whether you asked to receive marketing updates from us
• A session cookie, if you sign in — see the Cookies section below

Site evidence and third-party information

Progress photographs and video taken on your site are central to how SqueRoots works. These may incidentally capture workers, neighbours, or others present at the property. Where you provide us with a contractor's details in order to invite them onto a project, you are sharing another person's information with us. We will use it only to issue that invitation and to operate the project.

Information we do not collect

We do not collect your card number, bank details, or other payment credentials. Payments are completed on our payment provider's own systems, and we receive back only a transaction reference, an amount, and a status. We do not knowingly collect information about children, and our services are not directed at anyone under 18.

To provide the service you asked for

Operating your account, running your project, releasing escrow funds against verified milestones, delivering progress reports and site evidence, and carrying messages between you, your contractor, and our team. Our lawful basis is performance of our contract with you.

To verify contractors

Assessing the professional information a contractor submits so that clients are matched only with people we have checked. Our lawful basis is our legitimate interest in protecting clients from unverified contractors, and performance of our contract with the contractor.

To keep records and prevent misuse

We maintain an audit trail of significant actions taken on a project — who approved a milestone, who released funds, who changed a budget. This protects both clients and contractors in the event of a dispute. Our lawful basis is our legitimate interest in accountability and fraud prevention, and compliance with our legal obligations.

To send you the white paper or respond to enquiries

If you download the white paper we use your name and email to send it to you and to follow up on your enquiry. Our lawful basis is your consent, given when you tick the box on the form.

To send marketing updates

We send occasional updates about construction insights, diaspora building resources, events, and new services only to people who have separately opted in. Ticking the consent box to receive the white paper does not opt you into marketing — that is a separate, optional choice. Our lawful basis is your consent. You can withdraw it at any time using the unsubscribe link in any message, or by contacting us.

We do not sell your personal information. We share it only with the service providers we need in order to operate, and only to the extent each one requires. Each acts under contract and may use the information solely to provide their service to us.

Our service providers

• Payment processing — Paystack, which handles escrow deposits and milestone releases. Your card and bank details go to Paystack directly and are never held by SqueRoots.
• Marketing email — Mailchimp (Intuit Inc.), which receives the name and email address of people who opt in to marketing. Nobody who declines the marketing box is sent to Mailchimp.
• Messaging — Stream, which powers real-time chat between clients, contractors, and our team.
• Media storage — Namecheap, which stores project photographs, video, and documents.
• Authentication — Google, if you choose to sign in with a Google account.
• Email delivery — our transactional email provider, which sends account, invitation, and notification emails.
• Hosting and databases — our infrastructure providers, whose servers for this platform are located in the European Union (Frankfurt).

Other disclosures

We may disclose information where we are required to by law, court order, or a regulator; where it is necessary to establish, exercise, or defend legal claims; or in connection with a merger, acquisition, or sale of assets, in which case we will tell you beforehand.

Between clients and contractors

Working on a shared project necessarily means some information is visible to the other parties on it. Your contractor can see the project details, milestones, budget lines, and messages on your project. You can see the contractor's professional profile and the evidence they submit. Our administrators can see both, in order to verify work and authorise fund releases.

SqueRoots operates across borders by design: clients are typically in the United Kingdom, United States, Canada, or elsewhere in the diaspora, while projects and field teams are in Nigeria, Ghana, and Kenya. The platform itself is hosted in the European Union. This means your information will be transferred between countries, including to countries whose data protection laws differ from those where you live. Where we transfer personal information out of the UK or European Economic Area, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses or equivalent safeguards with the receiving party. You can request details of the safeguards that apply by contacting us.

• Account information — for as long as your account is open, and for 14 days after you close it, so that we can handle any question or dispute that arises afterwards.
• Project records, financial records, and audit trails — for 5 years after a project completes, reflecting the period in which a construction dispute or tax enquiry may realistically arise.
• Site photographs and video — for the life of the project and 2 years thereafter, as evidence of what was built and when.
• Marketing contacts — until you unsubscribe, after which we keep a minimal suppression record so that we do not contact you again by mistake.
• White paper and enquiry records — for 1 year from your last interaction with us.
• Password reset links — these expire shortly after being issued and are then deleted.

When an account is closed we mark it as deleted and withdraw it from active use. Records we are required to retain for legal, accounting, or dispute-resolution purposes are kept for the periods above and then deleted or anonymised.

Depending on where you live, you have rights over your personal information. In practice we extend the following to everyone who uses SqueRoots, wherever they are:

• Access — ask for a copy of the information we hold about you
• Correction — ask us to fix anything inaccurate or incomplete
• Deletion — ask us to delete your information, subject to records we must retain
• Restriction — ask us to pause how we use your information while a concern is resolved
• Objection — object to processing we carry out on the basis of legitimate interests
• Portability — receive the information you gave us in a portable, machine-readable format
• Withdraw consent — where we rely on your consent, withdraw it at any time, without affecting what we did before you withdrew it

To exercise any of these, contact us at privacy@squeroots.com. We will respond within one month, and will tell you if we need longer because the request is complex. You also have the right to complain to a data protection authority. Depending on where you are, that may be the Information Commissioner's Office in the United Kingdom, your national supervisory authority in the European Economic Area, the Nigeria Data Protection Commission, the Data Protection Commission in Ghana, or the Office of the Data Protection Commissioner in Kenya. We would ask that you raise the matter with us first so we have the chance to put it right.

We keep our use of cookies deliberately narrow. When you sign in, we set a single session cookie so that the platform knows who you are as you move between pages. It contains a random session identifier and no personal information. It is marked HttpOnly, so it cannot be read by scripts in your browser, and Secure, so it is only ever sent over an encrypted connection. It expires after 30 days, or sooner if you sign out. This cookie is strictly necessary for the platform to function — without it you could not stay signed in. We do not use advertising cookies, and we do not track you across other websites.

• Passwords are stored only as salted cryptographic hashes, never in a form we can read or recover
• Traffic between your browser and our platform is encrypted in transit
• Access to client and project data is limited by role — contractors see only the projects assigned to them, and administrative access is restricted to staff who need it
• Significant actions on a project are written to an audit log, so changes can be traced
• Card and bank details are handled entirely by our payment provider and never reach our systems

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant regulator and, where required, you directly.

We may update this policy as our services change. When we make a material change we will update the date at the top of this page and, where the change significantly affects how we use your information, tell you directly.