Privacy policy

The data controller is the publisher of the MIPOconnect platform, a sole trader (French micro-entrepreneur). Their identity and contact details are in the legal notice. As MIPOconnect has no legal personality, the publisher decides why and how your data is used.

For any question about your data or to exercise your rights: e-mail contact.mipoconnect@gmail.com, or the Contact us form, subject “Personal data”. The publisher has not appointed a data protection officer: the law does not require one for an activity of this size; the publisher answers personally.

• We only collect what the service needs: your account, your profile, your gigs and your conversations.
• We do not sell your data, we do not do targeted advertising and we use no audience measurement tool.
• The platform does not store your banking details: payments go through an external provider.
• Every piece of data has a precise retention period (section 3); automatic deletions apply it every day.
• You can see, correct, download or delete your data at any time from your settings.

Legal bases refer to article 6 of the GDPR: the contract (your sign-up and use of the service, art. 6(1)(b)), legal obligation (art. 6(1)(c)) and legitimate interest (art. 6(1)(f)), always weighed against your rights. No processing by the platform relies on your consent, except Google sign-in, which you choose.

3.1 Creating and managing your account

Data

E-mail address; password (stored only in encrypted, irreversible form); if you choose Google sign-in: Google ID, Google name and profile picture; date and version of the terms accepted; date of your last activity.

Why

Create your account, sign you in, keep proof that you accepted the terms, send you the essential e-mails (verification code, forgotten password).

Legal basis

Contract. Proof of acceptance of the terms: legitimate interest (being able to prove what was accepted).

Who can access it

You; the platform team; our technical processors (section 5).

How long

As long as your account exists. After 3 years without any sign-in, you receive an e-mail: unless you sign in within 30 days, the account and its data are deleted.

Required?

E-mail and password (or a Google account) are needed: without them, no account.

3.2 Your profile and matching

Data

First name, last name, phone, introduction, country and city (those you enter: the site does not use your device location), company name (clients), trades and skills, availability, profile photo (optional), portfolio photos, language and currency preferences.

Why

Present talents to clients and gigs to talents, suggest gigs near you and in your trades, let Client+ clients find a talent by trade, city, free date and rating, show amounts in your currency.

Legal basis

Contract.

Who can access it

Other members see your public profile: first name and initial of the last name (or company name), city, trades, introduction, profile photo, portfolio photos, average rating, availability calendar (free or not, never the reason). Client+ clients can find this public profile in their talent search, unless you untick “Appear in the search of Client+ members” in your profile. Your “Book me” page (/t/…) is visible to anyone with the link; it is indexed by search engines (Google…) only if you tick “Let Google and other search engines show my “Book me” page” in your profile, and stops being so when you untick it (search engines may take a few days to remove it). The date of your consent is kept. Your phone and e-mail are only given to the client or talent with whom an application was accepted. The platform team; our processors.

How long

As long as your account exists. A photo you remove (profile photo or portfolio) is erased; all your photos are erased with your account.

Required?

Optional for an account, but a talent must give at least a first name, a phone, an introduction and a country to apply; a client, a city and a country to post a gig. The profile photo is never required.

3.3 Gigs, applications and messaging

Data

Gigs posted (title, description, category, budget, place, dates, number of people), applications and their message, messages between client and talent, favourites, saved searches, gigs declared finished, dates when Client+ was turned on and off, Client+ credits (balance and history of movements) and talents contacted from the search.

Why

Run the platform: post, apply, choose, talk, follow your gigs and income.

Legal basis

Contract.

Who can access it

A live gig is visible to registered talents. A gig posted from 6 November 2026 on and open to every talent (not a proposal made to a single talent) also has a public page, readable without an account and indexed by search engines: title, description, category, city, neighbourhood, dates and number of talents wanted. It never shows your name or your budget, and phone numbers, e-mail addresses and links written in the post are hidden there. This page disappears as soon as the gig is filled, closed, removed or deleted. An application is only visible to the client concerned. Messages are only visible to the two people in the conversation: the team does not read them (a report only passes on the reason and the explanation of its author). Our processors, which store them.

How long

As long as the accounts concerned exist. A gig deleted by the client is erased with its applications and conversations. When one of the two members deletes their account, the conversation is erased for both.

3.4 Reviews and ratings

Data

Rating from 1 to 5 stars and optional comment given by a client to a talent after a completed gig; first name and initial of the client; date.

Why

Help clients choose and reward good work, through trust between members.

Legal basis

Legitimate interest (trust on the platform). The talent can dispute a review they find unfair or unlawful through the Contact us form.

Who can access it

Any visitor to the talent’s “Book me” page (rating, comment, first name and initial of the client); any visitor to the site’s home page, where recent 4 or 5-star reviews may be shown (comment, first name and initial of the client and the talent, trade, city, the talent’s profile photo if they added one); clients receiving their application (average rating); the talent; the team.

How long

As long as the client’s and the talent’s accounts exist and the gig is not deleted. The client can change the review at any time.

3.5 Referral

Data

Your invitation code; for each person who signed up with your link: first name, initial of the last name, sign-up date, whether the profile is complete, whether a first gig was posted (never its content); days of Talent+ earned.

Why

Run the referral programme described in the terms of use and fight fraud.

Legal basis

Contract; legitimate interest for fraud prevention.

Who can access it

The person who invited you (only the information above); the team.

How long

As long as your account exists. If the person who invited you deletes their account, the link between you is erased.

3.6 Talent+ subscription and payments

Data

Plan chosen, start and end dates, free trial, reminders sent; for each payment (Talent+ or Client+ credits): amount, currency, date, status and the reference given by the payment provider, and a numbered receipt in your name, which you can download. If you agree, the reason why you did not renew (optional one-click answer, after your pass ends).

What we do not store

The platform does not store your banking details: no card number, no security code, no Mobile Money PIN. You enter them directly with the payment provider or your operator. The provider processes them as a separate data controller under its own privacy policy, and only sends us the result of the payment. The Mobile Money number you give when paying is used to open the payment: it is sent to the provider and is not saved with the order.

Why

Provide the subscription, stop it on the right date, remind you before renewals, keep the accounts, and follow the health of the service (subscriptions, departures and their reasons, as overall figures).

Legal basis

Contract; legal obligation for accounting records; legitimate interest for statistics and the reason for not renewing (improving the service; you never have to answer).

Who can access it

You; the team; the payment provider; if required, the tax authorities.

How long

Subscription: as long as your account exists. Accounting records (payments, invoices): 10 years from the end of the financial year (article L123-22 of the French Commercial Code), even after the account is deleted, but no longer linked to your name, e-mail or phone. Technical notifications from the payment provider: 90 days. Reason for not renewing and subscription history used for statistics: kept, but detached from your account as soon as it is deleted.

3.7 E-mails and notifications

Data

In-app notifications, notification preferences, e-mails sent (recipient, subject, date, delivery status), messages from the team you received (date the e-mail was sent, date you clicked “Got it” on the banner).

Why

Tell you about your gigs (application, answer, message, review), gigs matching your trades and your subscription; tell you in advance about changes to the service (prices, new rules, new features) with an e-mail from the team and/or a banner at the top of your space.

Legal basis

Contract. You choose which messages you receive in Settings > Notifications; security e-mails and messages from the team about changes to the service cannot be turned off: they are not advertising.

Who can access it

You; the team; our e-mail provider.

How long

Notifications and messages from the team: as long as your account exists. Record of e-mails sent: 30 days.

3.8 Security of the service

Data

Sign-in history (browser, system, device type, approximate city and country given by the host — the IP address itself is not stored); anti-abuse counters (sign-in and sign-up attempts); anti-robot check; log of the platform team’s actions; verification and reset codes.

Why

Protect accounts against hacking, block robots and mass sending, know who did what in the back-office.

Legal basis

Legitimate interest (security of the service and its members); security obligation (article 32 GDPR).

Who can access it

You (your sign-ins in Settings > Security); the team; our processors.

How long

Sign-in history and team log: 12 months. Anti-abuse counters: 1 hour at most. Verification codes: valid 15 minutes, erased by the next day at the latest. Anti-robot check: 10 minutes.

3.9 Reports and moderation

Data

Author of the report, member reported, reason, explanation, conversation concerned, decision and comment of the team.

Why

Protect members, remove unlawful content, sanction abuse, handle appeals.

Legal basis

Legitimate interest (members’ safety); legal obligation to handle unlawful content reported.

Who can access it

The team only. The member reported never knows who reported them.

How long

Until the team’s decision, then 12 months after that decision, to spot repeated abuse.

3.10 Contact form

Data

Name, e-mail, subject, message, our answer; your account if you were signed in.

Why

Answer you and handle your requests, including the exercise of your rights.

Legal basis

Legitimate interest (answering people who write to us); legal obligation for requests to exercise rights.

Who can access it

The team; our e-mail provider for the answer.

How long

12 months after the last exchange.

3.11 Internal statistics

Data

Overall figures (sign-ups, gigs posted, accounts deleted). When an account is deleted, only an anonymous trace remains: sign-up and deletion dates, spaces opened, country.

Why

Follow the activity of the service and improve it.

Legal basis

Legitimate interest.

Who can access it

The team.

How long

Anonymous traces no longer identify you: they are no longer personal data and are kept without limit.

3.12 What stays on your device

Data

Pages already viewed and pending sendings (to work offline); a gig written before creating an account (/publier); your display preferences.

Why

Use the site without a connection and lose nothing you wrote.

Legal basis

Contract; these items are strictly necessary for the service you ask for.

Who can access it

Nobody but you: this data stays on your device and is only sent to us when the connection comes back or when you sign up.

How long

Until it is sent, or until you clear the site data in your browser.

The platform takes no decision producing legal effects concerning you based solely on automated processing. Gig alerts (by your trades and city) and the order applications are shown in (Talent+ subscribers first) help people find each other, but the client always chooses the talent.

These providers process your data only on our behalf and on our instructions. Each is bound to the publisher by a contract complying with article 28 GDPR, which requires them in particular to protect the data and to tell us about any incident:

• Vercel Inc. (United States) — website hosting;
• Neon, Inc. (United States) — database, on servers located in the United States;
• Upstash, Inc. (United States) — cache and anti-abuse counters;
• Cloudinary Inc. (United States) — photo storage and display;
• Resend (United States) — sending e-mails;
• Google — Google sign-in, if you choose it.

Independent from the platform, not processors: the payment providers (separate data controllers, see 3.6), namely pawaPay for Mobile Money, to which we send your Mobile Money number, the amount, the currency, the country and an order reference; Moneroo for bank cards and for Mobile Money in countries pawaPay does not cover, to which we send your first name, last name, e-mail address and the amount; and Stripe, which processes the card payments opened by Moneroo. Also the “Have I Been Pwned” service, which checks that a new password has not leaked: it only receives the first 5 characters of an encrypted fingerprint of the password, never the password or your e-mail.

These providers store or access data in the United States. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, which Vercel, Neon, Upstash, Cloudinary and Resend have joined, and, in addition, on the European Commission’s standard contractual clauses included in their contracts.

Technical backups of the database are overwritten automatically according to our host’s restore window: deleted data also disappears from backups at the end of that window.

The GDPR (articles 15 to 22) and the French Data Protection Act no. 78-17 of 6 January 1978 give you the following rights over your data:

• Right of access: know which data about you is processed and get a copy. You can download your data at any time in Settings > Account > Download my data.
• Right to rectification: have inaccurate data corrected or incomplete data completed. You can do it yourself in Settings > Profile.
• Right to erasure: have your data deleted. Deleting your account (Settings > Account) erases your data, except what the law requires to be kept (accounting records, see 3.6), which is then no longer linked to your name.
• Right to restriction of processing: ask for your data to be kept without being used, for example while data you dispute is being checked.
• Right to data portability: receive the data you provided in a structured, machine-readable format (the JSON file of the download), to reuse it elsewhere.
• Right to object: object at any time, on grounds relating to your situation, to processing based on legitimate interest (reviews, statistics, security…). Processing stops unless there are compelling legitimate grounds or it is needed for legal claims.
• Withdrawing consent: for Google sign-in, you can withdraw your consent at any time by using a password instead.
• Instructions after death: you can say what should happen to your data after your death.

To exercise these rights, e-mail contact.mipoconnect@gmail.com, or use the Contact us form with the subject “Personal data”. The publisher answers within one month (extendable by two months for a complex request; you are then told) and may ask you to prove your identity if there is a doubt. Exercising your rights is free.

If you think your rights are not respected, you may complain to the CNIL (www.cnil.fr) or to the data protection authority of your country (for example the CDP in Senegal or the ARTCI in Côte d’Ivoire).

• Encrypted connections (HTTPS) and passwords encrypted irreversibly.
• Sign-in cookies unreachable by scripts, protection against forged requests, time-limited sessions; you see your sign-ins in Settings > Security, and changing your password signs out your other devices.
• Limits on sign-in attempts and an anti-robot check built for the platform (no third-party service sees your data during this check).
• Team access limited to those who need it, and logged.

In the event of a data breach (loss, theft, unauthorised access), the publisher immediately takes steps to stop it and limit its effects, records it in an internal register, notifies the CNIL within 72 hours when it presents a risk to people, and tells you directly if the risk to your rights is high, with the precautions to take (for example changing your password).

The platform only uses cookies that are essential for the site to work. They are used neither for advertising nor for audience measurement: that is why no banner asks for your consent.

• Sign-in and security: app-token (15 minutes), app-refresh (7 days), app-csrf (7 days), app-sid (30 days).
• Google sign-in: app-oauth-state, app-oauth-pkce, app-oauth-next (5 minutes).
• Display preferences: app-locale (language), app-country (country for the currency), app-tz (time zone), app-last-space (last space opened).

The publisher of the MIPOconnect platform reserves the right to change this policy at any time, for example when the service changes. The update date is shown at the top of the page. Any substantial change is notified by e-mail to all members of the platform before it takes effect.