Privacy Policy
Version 1.2 · Last updated July 2026
1. Introduction
Internetivo Ltd ("we", "us", "our") operates the IVO work marketplace platform, accessible via the IVO mobile application, the IVO web application at internetivo.com, and via federated mesh nodes operated by authorised node partners ("the Platform").
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Platform, and sets out your rights under the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Cypriot data protection law.
Data Controller: Internetivo Ltd Contact: a privacy and data ticket
2. Data We Collect
2.1 Account Data
- Full name
- Email address
- Phone number (optional, used for 2FA via Twilio)
- Username and profile information
- Profile photo
- Country and timezone
2.2 Identity Verification Data (KYC)
For users who choose to become verified or who transact above threshold amounts, we collect identity documents and biometric data via our KYC provider Sumsub:
- Government-issued ID (passport, national ID, driving licence)
- Selfie / liveness check
- Address proof documents
This data is processed by Sumsub under their own privacy policy. Internetivo does not store raw identity documents on its own servers.
2.3 Task and Project Data
- Task titles, descriptions, budgets, attachments
- Bids, proposals, counter-offers
- Milestones, deliverables, and completion records
- Review and rating content
- Dispute records
2.4 Payment and Financial Data
- Payment method metadata (card last 4 digits, expiry - no full card numbers are stored by us)
- Transaction history (amounts, timestamps, parties)
- Escrow funding and release records
- Payout records and bank account details (for Payouts, stored encrypted)
- Invoices and receipts
Payment card data is processed by Stripe, Inc. under PCI-DSS Level 1 compliance. Internetivo does not receive or store full card numbers.
2.5 Communications Data
- Messages sent between users within the Platform's messaging system
- Support tickets and correspondence with our team
- Notification preferences and delivery records
- Security verification codes sent to confirm sign-in attempts our systems flag as unusual
2.6 Device and Technical Data
- Device type, operating system, and version
- App version
- IP address and approximate geographic location
- Push notification tokens (Expo)
- Session identifiers, cookies, and local storage values
- Crash reports and error logs
- Historical sign-in records retained per account - approximate date/time, IP address, device/browser/operating-system type, and VPN/proxy/Tor/hosting-provider detection status - used for account-security review, fraud prevention, and to let you review your own account's sign-in history
2.7 Location Data
- Approximate location (city / country level) derived from IP address
- Precise GPS location, only if explicitly granted by the user within the mobile app for features such as local task discovery. This permission can be revoked at any time via your device settings.
2.8 Usage Data
- Features accessed and screens viewed
- Search queries
- Click and interaction events (anonymised aggregate analytics)
- Task view, bid, and conversion events
2.9 Reputation and Scoring Data
- AI-generated matching scores (not directly visible to users)
- Completion rate, response rate, on-time delivery rate
- Peer ratings and written reviews
- Skill endorsements
3. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Providing marketplace services (posting, bidding, messaging) | Performance of contract (Art. 6(1)(b)) |
| Processing payments and managing escrow | Performance of contract (Art. 6(1)(b)) |
| Identity verification (KYC) | Legal obligation (Art. 6(1)(c)) / Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and platform security | Legitimate interest (Art. 6(1)(f)) |
| AI-powered job matching and recommendations | Legitimate interest (Art. 6(1)(f)) |
| Reputation scoring and review display | Legitimate interest (Art. 6(1)(f)) |
| Push notifications (transactional) | Performance of contract (Art. 6(1)(b)) |
| Push notifications (marketing) | Consent (Art. 6(1)(a)) |
| Analytics and platform improvement | Legitimate interest (Art. 6(1)(f)) |
| Tax and financial record-keeping | Legal obligation (Art. 6(1)(c)) |
| Customer support | Legitimate interest (Art. 6(1)(f)) |
| Compliance with court orders or regulatory requests | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, we have conducted a balancing test and determined that our interests do not override your fundamental rights and freedoms. You may request a copy of our legitimate interest assessments by contact us by opening a privacy and data ticket.
Where we rely on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
4. Data Retention
| Category | Retention Period |
|---|---|
| Account data (active accounts) | Duration of account + 2 years after deletion |
| Account data (deleted accounts) | 30 days post-deletion, then anonymised |
| Transaction and financial records | 7 years (Cyprus tax law requirement) |
| Identity verification records | 5 years from last transaction (AML requirement) |
| Task and project records | 3 years after project closure |
| Messages | 2 years after last activity in thread |
| Support tickets | 3 years |
| Login/sign-in security history (IP, device, location, VPN/proxy detection) | Retained for the life of the account (fraud-prevention and account-security purpose); reviewable via your account security settings |
| Device / technical logs | 90 days |
| Crash reports | 30 days |
| Aggregated analytics | Indefinitely (anonymised - no personal data) |
When a retention period expires, data is securely deleted or irreversibly anonymised. You may request early deletion - see Section 7.
5. Third-Party Data Sharing
We share personal data with the following categories of third parties. All third parties are subject to appropriate data processing agreements (DPAs):
| Third Party | Purpose | Location | Basis |
|---|---|---|---|
| Stripe, Inc. | Payment processing, escrow, payouts | USA (Standard Contractual Clauses) | Contract |
| Sumsub | Identity verification (KYC/AML) | EU / UK | Contract |
| IP-intelligence providers (proxycheck.io; ip-api.com) | Security: IP geolocation and VPN/proxy/Tor detection for fraud prevention, account-security alerts, and persistent per-account sign-in history | UK / EU | Legitimate interest |
| Twilio, Inc. | SMS and voice 2FA | USA (SCC) | Contract |
| Expo (Expo Go) | Push notification delivery | USA (SCC) | Contract |
| Node operators (licensed) | Local marketplace hosting, task/bid data visible on their node | EU (primarily) | Contract + DPA |
| Hetzner / Plesk hosting | Server infrastructure and storage | EU (Germany) | Contract |
| PostHog (EU Cloud) | Product and usage analytics, EU-hosted and only with your consent | EU | Contract |
| Google (Google Analytics 4) | Aggregate website analytics, loaded only after you opt in | USA (Standard Contractual Clauses) | Consent |
| Meta Platforms (Facebook Login) | Optional "Sign in with Facebook" authentication, only if you choose it | USA (Standard Contractual Clauses) | Contract |
We do not sell your personal data to any third party. We do not share personal data with advertisers.
We may disclose personal data to law enforcement or regulatory authorities where required by applicable law, a court order, or to protect the vital interests of individuals.
6. International Transfers
Where personal data is transferred outside the European Economic Area (EEA), we ensure an adequate level of protection is in place through:
- European Commission adequacy decisions (where applicable)
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Binding Corporate Rules (BCRs) where applicable
A list of the transfer mechanisms we rely on for each third party is available on request from a privacy and data ticket.
7. Your GDPR Rights
Under GDPR, you have the following rights. To exercise any of these rights, contact us by opening a privacy and data ticket or use the data controls in your account settings. We will respond within 30 days.
7.1 Right of Access (Art. 15)
You may request a copy of all personal data we hold about you, together with information about how it is used.
7.2 Right to Rectification (Art. 16)
You may request correction of inaccurate or incomplete personal data. Most account data can be updated directly in your profile settings.
7.3 Right to Erasure (Art. 17)
You may request deletion of your personal data ("the right to be forgotten") where:
- The data is no longer necessary for the purpose for which it was collected
- You withdraw consent (where consent was the basis)
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
Note: we may be unable to delete data we are legally required to retain (e.g. financial records, AML records).
7.4 Right to Restriction of Processing (Art. 18)
You may request that we restrict processing of your data in certain circumstances, for example while a dispute about accuracy is resolved.
7.5 Right to Data Portability (Art. 20)
You may request your personal data in a structured, commonly used, machine-readable format (JSON or CSV) for transfer to another service. This applies to data you provided to us under contract or consent.
7.6 Right to Object (Art. 21)
You may object to processing based on legitimate interest at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
You may opt out of direct marketing at any time using the unsubscribe link in emails or notification settings in the app.
7.7 Rights Related to Automated Decision-Making (Art. 22)
Our AI matching system produces recommendations but does not make binding automated decisions that significantly affect you without human review. If you believe an automated process has produced an unfair outcome, you may request human review by contact us by opening a support ticket.
7.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus:
- Website: www.dataprotection.gov.cy
- Email: [email protected]
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- TLS 1.3 encryption in transit for all API and web traffic
- AES-256 encryption at rest for sensitive fields
- Role-based access controls and least-privilege principles
- Two-factor authentication for admin access
- Regular security audits and penetration testing
- Incident response procedures with 72-hour breach notification (Art. 33 GDPR)
9. Cookie Policy
The IVO web application uses the following types of cookies and local storage:
| Type | Purpose | Consent Required |
|---|---|---|
| Essential cookies | Session management, authentication, CSRF protection | No (strictly necessary) |
| Functional cookies | Preferences (language, theme, timezone) | No |
| Analytics cookies | Aggregate usage analytics (privacy-preserving) | Yes |
| Marketing cookies | None | N/A - we do not use marketing cookies |
You may manage cookie preferences through the cookie banner displayed on first visit, or through your browser settings. Note that disabling essential cookies will prevent the Platform from functioning.
The mobile app does not use cookies; it uses secure device storage for authentication tokens.
10. Children's Privacy
The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, contact us by opening a privacy and data ticket immediately and we will delete the account.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to users by email and in-app notification at least 30 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance.
12. Contact
Data Protection Officer / Privacy Enquiries: Internetivo Ltd Open a privacy and data ticket Website: https://internetivo.com/privacy
Response time: within 30 days of receipt.
This policy is governed by the laws of Cyprus and EU data protection law.