ABEL — Privacy Policy
Version 2.2 · October 2026
Data controller: ABEL Solutions Ltd, a company registered in Malta (company number [to be inserted])
Registered office: [to be inserted]
getabel.app · info@getabel.app
1. Introduction
ABEL Solutions Ltd ("ABEL", "we", "us") is the data controller for the personal data described in this policy. This policy explains what we collect, why, how long we keep it, who we share it with, and what rights you have.
It applies to:
- Customers who book services through the ABEL app
- Providers who offer services through the ABEL Partner app
- Visitors to getabel.app
We are subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Cap. 586) of Malta. Our supervisory authority is the Information and Data Protection Commissioner (IDPC) — idpc.org.mt.
Data Protection Officer. ABEL has not appointed a statutory Data Protection Officer. Privacy enquiries should be sent to info@getabel.app.
2. Data We Collect
2.1 Customers
| Category | Data | Source |
|---|---|---|
| Identity | Name, email address, phone number | You |
| Account | Password (stored hashed), settings, preferences | You |
| Address | Home and service addresses, access instructions | You |
| Booking | Services booked, options, dates, notes, job description | You |
| Rental properties | Property name, address, access notes and cleaning preferences; the calendar (iCal) link you give us; the check-in and check-out dates we read from that calendar; stays and a schedule you add yourself; a checklist with any reference photographs, a restock list and linen preference. We do not keep guest names or any other details the calendar may contain | You / your listing's calendar |
| Payment | Last four digits and card type, transaction history, wallet ledger, subscription status | Stripe |
| Location | Approximate location for matching; live map view of your Provider during an active booking | You / your device |
| Communications | In-app chat with Providers, support conversations, emails to us | You |
| Content | Reviews, ratings and photographs you upload, including photographs and descriptions you send for a photo estimate | You |
| Ratings received | Ratings given to you by Providers after a booking (used internally only; not displayed publicly) | Providers |
| Device | Device model, OS version, app version, push notification token and whether notifications are allowed, IP address | Your device |
| Platform activity | A record of what happens on your account and Bookings (see clause 5.1), and of the emails, push notifications and in-app messages we send you, with their content and whether they were delivered and opened | The Platform |
| Third-party sign-in | Name and email address from Google or Apple where you sign in that way | Google / Apple |
Apple Sign-In. If you use "Hide My Email", we receive only a relay address, not your real email address. We will use the relay address for all communication.
2.2 Providers
| Category | Data | Source |
|---|---|---|
| Identity | Full name, email address, phone number, date of birth, address | You |
| Verification documents | Photo ID (passport, or the front and back of an ID card or driving licence), professional certifications | You |
| Criminal offence data | Police Conduct Certificate (Kondotta) — see clause 3 | You |
| Business | Tax registration number, business name, insurance certificate and policy number | You |
| Financial | Bank account details (held by Stripe, not by ABEL), payout history, earnings ledger | You / Stripe |
| Location | GPS location, shared with the customer only while a booking is active | Your device |
| Performance | Job history, ratings and reviews received, completion and cancellation rate, strikes | Platform |
| Content | Profile photograph, business description, before and after job photographs | You |
| Device | Device model, OS version, app version, push notification token and whether notifications are allowed, IP address | Your device |
| Platform activity | A record of what happens on your account and the jobs you take (see clause 5.1), and of the emails, push notifications and in-app messages we send you, with their content and whether they were delivered and opened | The Platform |
Identity verification. Your profile photograph is compared with your photo ID visually by a member of our team. We do not use automated facial recognition, and we do not create biometric templates. We no longer ask for a selfie or for proof of address; if you provided either before October 2026, we keep it as a verification document for the period in clause 5 and do not use it for anything else.
2.3 Website Visitors
Anonymous usage data via Google Analytics — pages viewed, time on page, approximate country, device type, referring source. This is collected only if you accept analytics cookies.
2.4 Data We Do Not Collect
We do not collect biometric data, health data, or data about your race, religion, political opinions, trade union membership, sex life or sexual orientation. Please do not include such information in reviews, chat messages or job descriptions.
3. Criminal Offence Data — Police Conduct Certificates
3.1 To protect customers who admit Providers into their homes, ABEL requires every Provider to supply a Police Conduct Certificate (Kondotta). This is data relating to criminal convictions and offences under Article 10 GDPR, and we treat it accordingly.
3.2 We use the certificate solely to assess a Provider's suitability. We record the outcome of that assessment (verified / not verified / expired) and the date. Access is limited to the ABEL personnel responsible for Provider approval.
3.3 We retain the certificate itself for no longer than 12 months from verification — the period after which a fresh certificate is required — after which only the outcome and date of the assessment are retained.
3.4 We do not share the certificate, or its contents, with customers or with any third party other than the storage provider listed in clause 7.
4. Why We Use Your Data, and Our Legal Basis
Performance of a contract — Article 6(1)(b)
- Creating and managing your account
- Matching customers with Providers and processing Bookings
- Reading the calendar of a rental property you add, to plan, request, move and cancel its cleanings
- Making a photo estimate when you ask for one, from the photographs and description you send
- Processing payments, refunds, wallet credit and Provider payouts
- Enabling in-app chat and live tracking during a booking
- Sending transactional messages: booking confirmations, status updates, receipts, payout notifications
- Providing customer support
Legal obligation — Article 6(1)(c)
- Keeping financial records for tax and accounting purposes (6 years)
- Responding to lawful requests from authorities
Legitimate interests — Article 6(1)(f)
- Preventing and detecting fraud, abuse and misuse of the Platform
- Verifying Provider identity and credentials, for the safety of customers
- Improving the Platform and developing new features
- Analysing aggregated booking patterns for demand forecasting and surge pricing
- Establishing, exercising or defending legal claims
- Keeping a record of what happens on the Platform and of the messages we send (clause 5.1), so that we can answer your questions, resolve disputes, and detect fraud and mistakes
- Producing statistics about the Platform (bookings, revenue, cancellations, response times, areas and services) from anonymised records
Where we rely on legitimate interests, we have carried out and documented a balancing assessment, which is available on request. You may object to this processing at any time — see clause 9.
Consent — Article 6(1)(a)
- Marketing emails and promotional push notifications
- Analytics cookies on our website
- Access to your device's precise location, camera and photo library
You may withdraw consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
Criminal offence data — Article 10 — see clause 3.
Which data you must provide. To use the Platform as a customer, you must provide your name, contact details, a service address and a payment method; without them we cannot form or perform a Booking. To register as a Provider, you must provide the identity and verification documents listed in clause 2.2; they are a condition of admission to the Platform, and without them your application cannot be considered. Everything else — precise device location, marketing consent, analytics cookies — is optional, and the Platform works without it.
5. How Long We Keep Data
| Data | Retention |
|---|---|
| Customer account data | Until you delete your account, then 30 days |
| Provider account data | Until termination, then 12 months |
| Financial and transaction records | 6 years (required by tax law) |
| Provider verification documents (including any selfie or proof of address provided before October 2026) | 2 years after the Provider relationship ends |
| Police Conduct Certificate | 12 months from verification; outcome and date thereafter (clause 3.3) |
| In-app chat messages | 2 years from the Booking |
| Support conversations | 2 years |
| Rental property calendar links | Stored encrypted until you remove the link or the property, or close your account; then deleted at once |
| Stay dates read from a rental calendar | Only the calendar's current dates, replaced at each check (about every 30 minutes); deleted with the property |
| Rental property checklist photographs | Until you remove them or the property, or close your account |
| Photographs sent for a photo estimate | 12 months after the estimate, or as before and after job photographs for a Booking made from it, and while a quote request made from it is open; deleted when you close your account unless a Booking needs them |
| Before and after job photographs | 12 months after the job, or until any dispute or refund about it is closed, whichever is later — even if an account is deleted in the meantime (evidence in the event of a dispute) |
| GPS location data | Deleted within 30 days of the Booking completing |
| Push notification tokens, and whether notifications are allowed on the device | Until you uninstall the app or log out of it |
| Reviews and ratings | Retained as part of the Platform record; pseudonymised if you delete your account |
| Contractor declaration acceptance records | 6 years after the Provider relationship ends |
| Google Analytics data | 26 months |
| Marketing consent records | 3 years after withdrawal (to evidence compliance) |
| Activity record (clause 5.1) | 6 years, then anonymised; anonymised at once when your account is (30 days after you delete it as a customer, 12 months after the relationship ends as a Provider) |
| Messages we send you: content, your email address and delivery status | Content and address: 2 years from sending, then removed and the record anonymised; anonymised at once when your account is |
| Records of our staff viewing or exporting your data | 6 years, then anonymised |
After these periods, data is deleted or irreversibly anonymised.
5.1 The activity record. We keep a record of what happens on the Platform: sign-ups; Bookings being made, accepted, changed, cancelled and completed; payments, refunds, wallet credit and disputes; ratings; quotes and photo estimates; rental property settings and their cleanings; changes to a Provider's status; and actions taken by our staff. Each entry says who did it (you, the other party, our staff or the Platform itself), when, and the values before and after the change. We also record each email, push notification and in-app message we send, with its content as sent, whether it was delivered and, where your email or device tells us, whether it was opened. The record cannot be altered. Only our staff can see it, and every time one of them views or exports it, that is recorded too. Exports never include identity documents, card details or the internal identifiers of people.
5.2 Anonymisation. When a retention period ends, or when your account is anonymised after deletion, we do not delete the activity record: we anonymise it. We remove your name, email address, phone number, addresses, photographs and any free text (notes, reasons, comments and the content of messages), and we replace any identifier that points to you with a random one that cannot be traced back to you. What remains — that something happened, when, which service, in which locality, the amounts and the rating — no longer relates to an identifiable person and is used only for statistics about the Platform. Your right to erasure (clause 9) is met in the same way.
6. Automated Decision-Making
We want to be clear about where automated systems make decisions that affect you.
6.1 The following are fully or partly automated:
| Decision | What it does | Human involvement |
|---|---|---|
| Provider matching | Decides which Providers are notified of your job request, and in what order | None — algorithmic |
| Surge pricing | Applies a multiplier at times of high demand | None — algorithmic, and disclosed before you pay |
| Booking expiry | Cancels and refunds a request that no Provider accepted within 30 minutes | None |
| Cancellation fee calculation | Determines the fee tier from the status of the Booking | None |
| AI support assistant | Answers questions, and at your request may cancel a Booking, issue wallet credit up to a capped limit, or refund up to €20 to your original payment method where you are entitled to a refund | Escalates to a person for anything beyond the cap or outside its confidence |
| Photo estimates | Suggests the Service, the options likely to apply and a price range from ABEL's prices, and shows safety advice where the photographs or description suggest danger | None for the estimate, which is not binding: you decide what to book and your Provider confirms the work on arrival |
| Provider ordering | Customer rating, reliability, distance and availability determine the order in which Providers are notified of a request | None routinely |
| Provider suspension | Strikes are counted automatically | A person reviews before any suspension takes effect |
6.2 No decision that produces legal effects, or similarly significantly affects you, is taken by automated means alone. Provider suspension and account termination are always reviewed by a person.
6.3 You have the right to obtain human intervention, to express your point of view, and to contest any automated decision. Contact info@getabel.app.
7. Who We Share Data With
We do not sell your personal data. We share it with the following processors, each under a written data processing agreement:
| Processor | What they do | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Substantially all Platform data | EU (Ireland) |
| Stripe | Payments and Provider payouts | Payment and bank data | EU / US |
| Google Firebase | Push notifications | Device tokens, notification content | EU / US |
| Google Maps | Maps, address autocomplete, geocoding | Addresses, coordinates | EU / US |
| Resend | Transactional and marketing email | Name, email address, message content | EU / US |
| Anthropic | AI customer support assistant and photo estimates | Support conversation content, and the booking and wallet data the assistant looks up; photographs and descriptions sent for a photo estimate | US |
| Vercel | Website hosting | Website usage, form submissions | EU / US |
| Google Analytics | Website analytics (with consent only) | Anonymised usage data | EU / US |
We also share:
- With your Provider — your first name, service address, access instructions, phone number and job description, only after they have accepted your Booking. Before acceptance, a Provider sees only the town, your first name and the job description, and, for a quote request, the photographs you attach to it (including any from a photo estimate), which only Providers who may quote can see while it is open.
- With your customer (if you are a Provider) — your name, profile photograph, rating, and your live location while a Booking is active.
- With professional advisers — lawyers, accountants and insurers, where necessary.
- With authorities — where legally required, or to protect the vital interests of any person.
- On a business sale — if ABEL is sold or restructured, with the acquirer, subject to this policy.
8. International Transfers
8.1 Our primary data storage is in the European Union (Ireland).
8.2 Some of the processors listed in clause 7 are established in, or transfer data to, the United States. Where they do, transfers are made under the European Commission's Standard Contractual Clauses, with supplementary technical measures including encryption in transit and at rest. We have documented a transfer risk assessment, which is available on request.
8.3 Anthropic processes support conversation content in the United States. Where the assistant looks up your bookings or wallet balance in order to answer a question, that information forms part of the conversation. If you would prefer your enquiry not to be processed in this way, email info@getabel.app instead of using the in-app assistant. Anthropic also processes, in the United States, the photographs and description you send for a photo estimate, only to make that estimate. Neither we nor Anthropic use them to train AI models. If you would prefer this not to happen, book or request quotes without a photo estimate.
8.4 You may request a copy of the safeguards applying to any transfer by emailing info@getabel.app.
9. Your Rights
| Right | What it means |
|---|---|
| Access | Obtain a copy of the personal data we hold about you, including your activity record and the messages we have sent you (clause 5.1) |
| Rectification | Have inaccurate data corrected |
| Erasure | Have your data deleted, subject to our legal retention obligations; records we must or may keep are anonymised instead (clause 5.2) |
| Restriction | Have us limit how we use your data while a dispute is resolved |
| Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests, and to direct marketing, at any time |
| Withdraw consent | Withdraw consent where processing is based on it |
| Human review | Obtain human intervention in respect of automated decisions (clause 6) |
| Complain | Lodge a complaint with the IDPC |
How to exercise them. Email info@getabel.app. We respond within one month, extendable by two further months for complex requests (we will tell you if so). We may ask you to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.
In the app. You can access and correct most of your data directly in the app, and you can request deletion of your account from Account settings.
Complaints. Information and Data Protection Commissioner, idpc.org.mt. You may also complain to the supervisory authority in your country of residence.
10. Security
We use appropriate technical and organisational measures, including:
- TLS encryption for all data in transit
- Encryption at rest for sensitive data
- Row-level security in the database, so that users can only reach their own records
- Server-side price calculation, so that prices cannot be altered by a modified client
- Customer addresses withheld from Providers until a Booking is accepted
- Access controls limiting which personnel can view personal data
- Payment card data handled entirely by Stripe — ABEL never stores full card numbers
- An activity record that cannot be altered (clause 5.1), including every action our staff take and every time they view or export personal data
- Exports by our staff limited to owners and administrators, and never including identity documents, card details or internal identifiers of people
No system is completely secure. If we suffer a personal data breach that is likely to result in a high risk to your rights, we will notify you without undue delay, and we will notify the IDPC within 72 hours where required.
If you believe your account has been compromised, contact info@getabel.app immediately.
11. Cookies
Our apps do not use cookies. Our website uses the following:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
abel_cookie_consent |
Essential | Remembers your cookie choice | 12 months |
| Session cookies | Essential | Page delivery and security | Session |
_ga, _ga_* |
Analytics (consent only) | Google Analytics — distinguishes users, measures sessions | Up to 24 months |
Essential cookies cannot be disabled — the site cannot function without them. Analytics cookies are set only if you accept them in the banner. If you decline, Google Analytics is not loaded at all. Declining is as easy as accepting.
You can change your choice at any time by clearing your browser data for getabel.app, which will show the banner again.
12. Children
The Platform is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact info@getabel.app and we will delete it.
13. Marketing
13.1 We send transactional messages — booking confirmations, status updates, receipts, payout notifications — because they are necessary to perform our contract with you. You cannot opt out of these while you hold an account.
13.2 We send marketing messages only with your consent. Every marketing email includes a one-click unsubscribe link, and you can change your notification preferences in the app at any time.
13.3 Withdrawing marketing consent does not affect transactional messages.
14. Changes to This Policy
We may update this policy from time to time. Material changes will be notified by email or in-app notification at least 30 days before they take effect. The current version is always available at getabel.app/privacy, with the version number and date at the top.
15. Contact
ABEL Solutions Ltd
[registered office address]
Malta
info@getabel.app
Supervisory authority
Information and Data Protection Commissioner (IDPC)
Floriana, Malta — idpc.org.mt