Skip to main content
Skip to content
BarabaraPost a job

Privacy Policy

Last updated: 31 August 2026

Who we are

Barabara is operated by Burdtec Industries Ltd, a company registered in England and Wales (company number 17069644) with its registered office at 69 Toxteth Street, Manchester, England, M11 1EQ (“we”, “us”). We are the data controller for the personal data described here. Contact: barabaraltd@gmail.com.

What we collect

  • Account & profile — name, email address, and (if you sign in with Google) your Google account identifier; your bio, skills, trading name, profile photo, and location, including approximate coordinates so jobs and professionals can be shown near you.
  • Marketplace activity — jobs you post (including photos), applications and cover letters, messages, reviews and star ratings, saved jobs, and team membership.
  • Verification data — if you choose to get verified: identity checks are performed by Stripe Identity, which processes your photo ID document and a selfie (biometric data) on our behalf — we receive and store only the outcome (verified / needs review) and the name shown on the document, not the images. We keep that name so the ID Verified badge only appears next to the name it was issued to. Trade qualification and insurance documents you upload are stored by us and read by automated text-recognition software running on our own infrastructure to pre-fill details for review.
  • Payments — handled by Stripe. We store your Stripe customer and subscription identifiers and your plan; we never see or store your card number. If you join our affiliate programme, the payout bank details you provide are stored encrypted (AES-256) and are only decrypted to process payouts.
  • Business Suite documents — if you use the Business Suite, the quotes, invoices and receipts you raise: the line items, amounts, VAT treatment, dates and notes, the business and payment details printed on them (including the bank details you ask to be paid into), and the customer details you type in — their name and, where the VAT rules require it, their address. Whose data that last part is, and who is responsible for it, is set out below.
  • Technical & safety data — error reports and performance data (with message text, inputs, and media masked before they leave your browser), push-notification subscriptions you opt in to, and the IP address recorded when an account is created through a referral link (used only for fraud prevention).

The Business Suite: whose data is whose

Almost everything on this page is data we decide what to do with — we are the controller of it. The Business Suite has one part that works differently. When you raise a quote, invoice or receipt, the customer details you type in are your record of your customer. For those details you are the controller and we are only your processor: we hold them, show them back to you, print them on your documents, and otherwise use them only to do what you ask us to. We decide nothing about them ourselves. The written agreement that governs it — what we may do, who else is involved, and what happens at the end — is the “Your customers’ data” section of our Terms of Service.

If you are on the receiving end of a document — someone raised an invoice for you — then the account, profile and messages that brought you here are still ours to answer for, and this policy covers them. The contents of the invoice are the issuer’s; ask them.

AI features

Three parts of Barabara send data to OpenAI. In all three OpenAI acts as our service provider under API terms that do not permit it to use your data to train its models, and in none of them can the AI issue, send or change anything — a person always presses the button.

  • The job planner (Pro and above) — we send your bio, skills, location, your typed goal, and a shortlist of matching job posts. Your last 50 planner results are stored in your account history and are deleted when you delete your account.
  • Draft from this conversation (Business Suite) — when you ask for a draft quote or invoice, we send up to the last 40 messages of that conversation (both sides, trimmed), the job post it relates to, and your own service price list. Nothing is saved: the suggestion fills in the form and you edit it before anything is issued.
  • The business assistant (Business Suite) — we send your question, the recent turns of that conversation with the assistant, and whichever of your own figures it looks up to answer: your invoice and quote totals, and reference, customer name, amount, status and date for recent documents. If you open the assistant from a message thread and ask about “this customer”, it also sends that thread’s recent messages, the job it is about, and who it is with. It can only ever read your own account’s records. The transcript is kept — the last 60 messages — and you can clear it at any time in the assistant; it is deleted when you delete your account.

How we use your data, and on what basis

  • To run the marketplace (profiles, jobs, matching, messaging, payments, verification badges) and, if you have it, the Business Suite (quotes, invoices, receipts, Insights and the assistant) — necessary to perform our contract with you.
  • To keep the platform safe (fraud prevention, moderation, rate limiting, error monitoring) — our legitimate interest in a safe, working service.
  • To send you emails and push notifications — job alerts and digests only with your consent, and every email includes an unsubscribe link; essential service emails (e.g. payment failure) are sent as part of our contract. If you have unpaid invoices, we send you a weekly summary of them, which you can turn off on its own. We never email your customers automatically — a payment reminder goes out only when you press the button, and it goes from us on your behalf, naming you.
  • To meet legal obligations — tax and accounting records for paid subscriptions.

We do not sell your personal data, and we do not use it for advertising.

Who we share it with

Service providers acting under contract for us:

  • Clerk — sign-in and account security
  • Convex — our database, hosted in the EU (eu-west-1)
  • Vercel — website hosting
  • Stripe — billing, and Stripe Identity for optional ID verification
  • Resend — transactional email delivery, including a payment reminder you choose to send to a customer
  • Sentry — error monitoring (masked as described above)
  • OpenAI — the job planner, quote and invoice drafting, and the business assistant (as described above)
  • UploadThing — storage for job photos
  • CARTO / OpenStreetMap — map tiles and location search: when you view a map or search for a place, your IP address (and the place name you typed) is sent to these services to return results
  • Companies House — if you verify a business, we look up the company number you provide on the public register
  • Your browser’s push service (Apple, Google, or Mozilla) — if you enable push notifications

Some of these providers process data outside the UK (including in the United States). Where they do, transfers are protected by UK-approved safeguards such as the UK International Data Transfer Agreement / Addendum or the UK–US Data Bridge.

Retention

We keep your data while your account is active. If you delete your account (Settings), your profile, jobs, applications, planner history, assistant transcript, uploaded verification documents and the files behind them, and push subscriptions are removed. We retain minimal fraud-prevention and audit records for as long as the law requires, and reviews you wrote about other people stay up with your name removed.

Conversations are shared, so they follow a different rule. A thread belongs to both people in it. If you delete your account, the messages you sent stay visible to the person you were talking to, shown against a deleted user — they keep their own record of the exchange, the same way a received email survives the sender closing their account. Once everyone in a thread has deleted their account, the thread and its messages are removed outright.

Quotes, invoices and receipts are the exception. An invoice or receipt is a financial record that both the person who issued it and the person who received it may need for their tax returns, so it survives either side deleting their account and stays readable from the details frozen onto it at the time. Deleting your account does not withdraw an invoice you sent, and it does not remove one that was sent to you.

Your rights

Under UK GDPR you may request access to, correction of, or deletion of your personal data; ask us to restrict or object to processing; and request a portable copy. Email barabaraltd@gmail.com and we will respond within one month. If your request is about details a tradesperson put on a quote or invoice, they are the controller of those — ask them, and we will help them answer you. You can also complain to the ICO at ico.org.uk.

Age

Barabara is for adults. You must be 18 or over to use it.

Changes

If we make material changes to this policy we will notify you by email or in-app before they take effect.

Contact

Questions? Email barabaraltd@gmail.com.