Privacy Policy

This Privacy Policy explains how TakeoverWork (https://takeoverwork.com) handles personal data. The Service is operated by the site owner, an individual based in India, who decides why and how your personal data is processed. In Indian law this makes us the "Data Fiduciary"; in EU and UK law, the "controller".

Last updated: . Questions or requests: grievance@takeoverwork.com.

1. Summary

• We collect what we need to run a marketplace: your account details, what you post, your messages, and basic technical and usage data.
• Contact details you add to your account stay private until you approve sharing them with a specific user.
• Messages are scanned automatically to hide contact details and block secrets. A person may read messages only when they are reported, flagged, or needed for a safety or legal investigation.
• Most free tools run entirely in your browser. The exceptions are listed in section 6.
• We show Google ads and use analytics. Where the law requires it, these load only after you consent.
• We do not sell personal data.
• Only adults (18+) may use the Service.

2. Data we collect

Account data. Email address; display name; profile picture and username if you sign in with Google or GitHub; your GitHub account creation date (for the GitHub connected badge); country and time zone; whether you use the site as a customer, provider or both.

Private contact fields. Phone number, contact email or other contact details you choose to add. These are shown to another user only after you approve their contact request.

Profile data (providers). Headline, business name, about text, skills, specialties, experience, availability, website, GitHub link, portfolio items and images.

Listing data (customers). Project descriptions, tools used, completion estimate, repository status and public repository URL, live URL, budget and deadline if given, screenshots, video links and attachments. Images are resized and location metadata (EXIF) is removed before storage.

Messages and interactions. Interest notes, questions and answers, messages and attachments, contact requests and approvals, connection status, reviews, reports, blocks and saved searches.

Waitlist and alerts. If you join a waitlist or ask to be notified, your email address, your role and any project summary you add.

Communications with us. Emails you send us and our replies.

Technical and usage data. IP address, approximate location derived from it (country), browser and device type, pages viewed, clicks, referring site, error reports, and security signals such as rate-limit counters and bot checks.

Payment data (only when paid products are on). Order details, amount, currency, status and the payment provider's order reference. Card and bank details are collected by the payment provider, not by us.

We do not ask for identity documents, and we never ask for your passwords to other services.

3. Why we use it

Purpose	Data used	Legal basis (EU/UK)
Create and secure your account, sign you in	Account data, technical data	Contract
Publish listings and profiles, run search, send matching alerts	Listing and profile data	Contract
Deliver messages, share contact details by mutual approval	Messages, contact fields	Contract
Hide contact details and block secrets in messages and listings	Messages, listing text	Legitimate interests (user safety)
Detect spam, fraud, prohibited content and duplicate listings, including AI risk scoring	Listing text, messages, technical data	Legitimate interests (safety, preventing abuse)
Moderate content and handle reports and grievances	Reported content, account data	Legitimate interests; legal obligation
Send service emails and notifications	Account data, notification settings	Contract
Send marketing or update emails	Email address	Consent
Measure and improve the site with analytics	Usage data	Consent where required; otherwise legitimate interests
Show advertising	Cookie and device data	Consent where required
Provide AI features such as summaries, category suggestions and the AI Listing Writer	Text you submit	Contract; legitimate interests
Process orders for paid products	Payment data	Contract; legal obligation (tax records)
Comply with law and respond to lawful requests	Any relevant data	Legal obligation

Automated checks can flag content, but they never remove content or close accounts on their own. A person makes those decisions.

4. Who we share data with

Other users. Your listings, public profile, answered questions and reviews are public. Customers appear on listings by first name and last initial (or company name), country, join date and badges. Messages are visible to the people in the conversation. Private contact fields are shared only with users you approve.

Service providers (processors) that run parts of the Service for us:

Provider	What they do
Supabase	Database, sign-in, real-time messaging
Cloudflare	Hosting, content delivery, security, R2 file storage, Turnstile bot checks, Web Analytics, email routing
Resend	Sending emails
Google	AdSense advertising, Google Analytics 4, the Gemini API for AI features, and Google sign-in
PostHog	Product analytics
Sentry	Error tracking
GitHub	GitHub sign-in and the GitHub connected badge
Lemon Squeezy, Razorpay	Payments, only when paid products are on. Lemon Squeezy acts as merchant of record and processes your order under its own privacy policy

Legal and safety. We may disclose data if required by law, court order or a lawful request from a government authority, or where needed to protect users, the public or the Service from fraud or harm.

Change of operator. If the Service is transferred to a new operator, such as a company set up to run it, your data may transfer with it under this policy. We will tell you before that happens.

5. Advertising cookies

We use Google AdSense to show ads on some content pages. Google and its partners may use cookies and similar technologies to show ads based on your visits to this and other websites, and to measure ad performance. You can learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

In the EEA, UK and Switzerland, and in other places where the law requires it, a consent message lets you choose whether to allow personalised advertising and analytics. You can change your choice at any time through the privacy and cookie settings link in the footer. You can also manage personalised ads in your Google account's ad settings. See the Cookie Policy for details.

6. Free tools: what stays in your browser and what is sent

Tool	Where it runs
Repo Health Check	Your browser calls GitHub's public API directly to read information about the public repository you enter. GitHub receives your IP address and the repository name under GitHub's privacy statement. We do not receive the results
Dependency Freshness Check	Your browser calls the public npm registry to look up the packages in the package.json you paste. The registry receives package names and your IP address
AI Takeover Listing Writer	The text you paste is sent to our server and then to Google's Gemini API to produce a draft. We keep usage counts for rate limiting
Secret Leak Scanner	Runs entirely in your browser. Nothing you paste is uploaded
Supabase RLS Checker	Runs entirely in your browser
Production Readiness Checklist	Runs in your browser; progress is saved in your browser's local storage
Project Handover Checklist Generator	Runs in your browser
Rescue Effort Estimator	Runs in your browser

We record that a tool was used (for example, the tool name) for analytics, but not what you entered into a local tool.

7. AI processing

We use Google's Gemini API to suggest categories and titles, write listing summaries, give improvement hints, detect likely spam or prohibited content, find duplicate listings, translate text when you ask, and power the AI Takeover Listing Writer. Each feature has a non-AI fallback, and AI never removes content by itself.

While we use Gemini's free tier, Google's terms allow it to use the content sent to it to provide, improve and develop its products, and human reviewers may read some inputs and outputs. For that reason, do not paste personal data, customer data, passwords or keys into the AI Takeover Listing Writer or any listing text. If we move to a paid tier with different terms, we will update this section.

8. Message masking and moderation access

To protect users, messages and listing text are checked automatically before they are delivered or published:

• phone numbers, email addresses and messaging handles are replaced with a notice until both sides approve a contact request;
• text that looks like a password, API key, private key or connection string is blocked with a warning.

Messages are not public. A moderator or the operator may read a message or conversation only when it has been reported, flagged by automated checks, or is needed to investigate fraud, abuse or a legal request. Access to moderation tools is limited to the operator and any moderators acting for us, and moderation actions are recorded in an audit log.

9. How long we keep data

• Active accounts: for as long as your account is open.
• Deleted accounts: when you delete your account, it is deactivated straight away and your personal data is purged within 30 days. Messages you sent remain visible to the other participants but are anonymised, so your name and profile are removed from them. Your listings and public profile are removed.
• Exceptions: we may keep limited records for longer where the law requires or allows it, for example records relating to removed content or a closed account under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (generally up to 180 days), records needed for an ongoing investigation or legal claim, and order and tax records for as long as tax law requires.
• Expired or closed listings: kept in your dashboard until you delete them or your account.
• Waitlist emails: until the purpose is met or you unsubscribe.
• Backups: encrypted database backups are overwritten on a rolling cycle of about 8 weeks.
• Analytics and error data: kept for the period set in each provider's settings, then deleted or aggregated.

10. Security

We use encryption in transit (HTTPS), row-level security on every database table so users can only read what they are allowed to read, short-lived signed links for private attachments, bot protection, rate limits, and server-only storage for secret keys. Access to production systems is limited to the operator. No system is perfectly secure, so please use a secure email account and never share passwords or keys through the Service. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as the law requires.

11. International transfers

The Service is run from India, and our providers store and process data in several countries, including the United States, the European Union and India. When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses and the UK addendum. Transfers out of India follow the Digital Personal Data Protection Act, 2023 and any restrictions notified under it.

12. Your choices and rights

Everyone can, from their settings or by emailing grievance@takeoverwork.com:

• see and update most account and profile information;
• download a copy of their data (data export in settings);
• delete their account;
• change notification and email preferences;
• withdraw consent for analytics and personalised ads through the cookie settings link.

We will respond within the period the law that applies to you requires, and in any case aim to reply within 30 days. We may need to confirm that a request comes from the account holder.

12.1 India: Digital Personal Data Protection Act, 2023

If you are in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, which take effect in phases, apply to how we process your digital personal data.

• Notice and consent. This policy is our notice. Where we rely on consent, we ask for it clearly, and you can withdraw it as easily as you gave it. Withdrawal does not affect processing that already happened. Some processing relies on other lawful uses permitted by the Act, such as data you provide voluntarily for a specific purpose or processing required by law.
• Your rights. You can ask for a summary of the personal data we process and the processing activities, the identities of others we have shared it with and what was shared; ask us to correct, complete, update or erase your data; use our grievance redressal process; and nominate another person to exercise your rights if you die or become unable to do so.
• Grievances. Contact our Grievance Officer, the site owner, at grievance@takeoverwork.com. Details are on the Grievance Officer page. If you are not satisfied with our response, you may complain to the Data Protection Board of India once our grievance process has been used.
• Your duties. The Act also asks users not to give false information, impersonate others or file frivolous complaints.

12.2 EEA and UK: GDPR and UK GDPR

If you are in the European Economic Area or the United Kingdom, the legal bases we rely on are listed in section 3. You have the right to:

• access your personal data and receive a copy;
• correct inaccurate data;
• have your data erased;
• restrict or object to processing, including processing based on legitimate interests and any direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing.

You can also complain to your local data protection supervisory authority, such as the authority in your EU country of residence or, in the UK, the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.

12.3 California and other US states: CCPA/CPRA notice

If you are a California resident, this section is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

• Categories collected: identifiers (such as name, email and IP address), commercial information (orders, when paid products are on), internet activity (usage data), approximate geolocation (country), professional information (provider profiles) and the content of your messages and listings. Sources, purposes and recipients are described in sections 2 to 4.
• No sale. We do not sell personal information, and we do not knowingly sell or share the personal information of anyone under 16.
• Sharing for advertising. Advertising cookies set by Google on our pages may count as "sharing" personal information for cross-context behavioural advertising under California law. You can opt out at any time through the privacy and cookie settings link in the footer. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sharing for that browser.
• Sensitive personal information. We do not use or disclose sensitive personal information to infer characteristics about you.
• Your rights. You can ask to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of sharing. Email grievance@takeoverwork.com or use your account settings. You can use an authorised agent. We will not treat you differently for using these rights.
• Retention: see section 9.

Residents of other US states with similar laws can make the same requests in the same way.

13. Children

The Service is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact grievance@takeoverwork.com and we will delete it.

14. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your personal data, we will tell you by email or on the site before it takes effect and, where needed, ask for your consent again.

15. Contact

• Privacy requests and complaints: grievance@takeoverwork.com
• General questions: hello@takeoverwork.com
• Account help: support@takeoverwork.com

Operator: the site owner, an individual based in India.