Privacy Policy

1. Introduction

Tunisie Freelance ("we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our website at tunisiefreelance.tn, the Tunisie Freelance iOS and Android applications (bundle / package ID tn.tunisiefreelance.app), our API, and related services such as optional AI assistant (MCP) connections (collectively, the "Platform").

By creating an account or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. This Privacy Policy is incorporated into and forms part of our Terms and Conditions.

If you do not agree with this Privacy Policy, please do not use the Platform. Your continued use of the Platform constitutes your ongoing consent to the practices described herein.

2. Data Controller

Tunisie Freelance is the data controller responsible for your personal data processed through the Platform. For any questions or concerns regarding your data, you may contact us at:

3. Information We Collect

3.1. Information You Provide Directly

• Account Information: First name, last name, email address, password (stored in hashed form), optional phone number, active role (client or freelancer), language preference, and country/city you enter on your profile. We do not collect date of birth or precise GPS location.
• Client company details: If you use the Platform as a client, company name and optional company size you enter during setup or in your profile.
• Profile Information: Professional title, biography, skills, education history, work experience, languages spoken, profile photo, optional custom profile slug or hidden earnings (Premium), and optional video introduction (website).
• Portfolio Content: Files, images, documents, and other materials you upload to showcase your work.
• Job and Application Data: Job descriptions, budgets, requirements, proposals, cover letters, screening answers, and attachments submitted through the Platform.
• Communications: Messages exchanged with other Users through the Platform's messaging system, including text content, timestamps, read receipts, and file attachments.
• Reviews and Ratings: Feedback you provide about other Users, including star ratings and written reviews.
• Identity Verification (KYC): Identity checks are performed by our payment partner DHMAD (and its verification vendor). We send DHMAD your email and a unique user ID and receive a verification status (pending/approved/rejected) and, if you linked DHMAD, KYC and phone flags. We do not receive or store copies of your government ID documents or selfies.
• Payment Information: Payment method details are processed through our integrated payment provider (DHMAD) for Units, Premium, and escrow. We do not directly store your payment card numbers.
• Offers and contract terms: Amounts, delivery times, escrow mode, and written contract terms you include when sending or suggesting an offer.
• Referrals and unit missions: Referral codes, referral-link visit counts, and public social-post URLs you submit to earn free Units (for example Facebook or LinkedIn).
• Support Communications: Information you provide when contacting our support team, including email content and attachments.

3.2. Information Collected Automatically

• Device and Network Information: IP address, browser or app user agent, operating system, and approximate geographic location (country/city) derived from IP (for example Cloudflare headers and/or a GeoIP lookup).
• Device and Install Identifiers: On the website, a browser fingerprint (visitor ID) used for login risk assessment (new-device email OTP) and to limit unit-drop abuse across accounts. In the mobile apps, a random install ID stored in the device keychain, plus OS, an optional device label, a last-seen timestamp for that install, and — if you enable notifications — an Expo push token. We do not use the advertising identifier (IDFA/GAID) or App Tracking Transparency.
• Usage and Log Data: Server logs of requests to our API (timestamps, HTTP methods, response codes), features you use on the Platform, search queries you submit, and similar operational telemetry. When you are signed in, a realtime connection (Socket.IO) also records whether you are online and whether you are typing in a conversation, so other participants can see presence and typing indicators. Detailed click-stream analytics on the website are handled by third-party tools only after you accept non-essential cookies (see Section 8). The native apps may include first-party PostHog product analytics (no advertising identifier, opt-out in Settings). They do not include Google Analytics, advertising SDKs, or Sentry.
• Cookie Data (website): Information stored in cookies and similar technologies, as described in Section 8. The native apps do not use website cookies for authentication.

3.3. Information from Third Parties

• OAuth Providers: If you sign in with Google, we receive your Google user ID, email, given name, family name, and email-verified flag. If you sign in with Apple (iOS app), we receive Apple's user ID, an email address (which may be Apple's Hide My Email relay), and, on first authorization, the name you share. If you sign in with DHMAD, we receive your name, email, DHMAD user ID, KYC status, and phone number when provided.
• Payment Provider: Transaction status, payment confirmations, and dispute information from DHMAD payment and escrow services.

4. How We Collect Information

We collect information through the following methods:

• Direct Input: When you create an account, complete your profile, post jobs, submit applications, send messages, or interact with any form or feature on the Platform.
• Automated Collection: Through server logs, device identifiers, cookies (website), push token registration (mobile), and — when you consent — analytics and advertising pixels on the website.
• Third-Party Authentication: When you choose to register or log in using Google, Apple, or DHMAD OAuth services.
• Integrations: Through our integrations with third-party services (payment processing, email delivery, error monitoring, optional AI features, push delivery) that may provide us with transactional or operational data.

5. Mobile Apps

The iOS and Android apps (bundle / package ID tn.tunisiefreelance.app, URL scheme tunisiefreelance://) authenticate without browser cookies. A refresh token is stored in the device keychain (iOS Keychain / Android Keystore via Expo SecureStore); the access token stays in memory. CSRF cookies used on the website are not used for cookieless mobile API routes. Universal Links / App Links on tunisiefreelance.tn and the custom scheme are used only to open the app (for example after DHMAD sign-in or checkout).

• Sign-in: Email and password, native Google Sign-In, Sign in with Apple (iOS), or DHMAD OAuth in an in-app browser (PKCE). New-device logins may require a one-time code sent to your email, using the install ID and device label described in Section 3.2.
• Push notifications: Optional. If you grant OS permission and do not disable pushes in app Settings, we store an Expo push token linked to your account and install, plus a last-seen timestamp for that device. Lock-screen notifications use generic copy (for example "New message") and do not include message text or payment amounts. Push is never required to use the app.
• Photos, videos, and files: When you choose to, the apps can read photos and videos you select from the library (profile photo; conversation images and videos) and files you pick through the system document picker (for example PDF, Office documents, ZIP, or video) as conversation attachments. Those files are stored on Amazon S3 and delivered via our CDN. The apps do not use the camera or microphone, and they do not currently upload portfolio items or job attachments from the device (those remain website features).
• In-app browser: DHMAD sign-in, Units and Premium checkout (when purchases are enabled in that build), and escrow / contract / payment pages open in an in-app browser. Those pages are operated by DHMAD and may set their own cookies on dhmad.tn. We do not treat the checkout redirect as proof of payment; we reconcile purchases through our API.
• Realtime messaging: While you are signed in, the apps keep a Socket.IO connection to deliver messages, notifications, typing indicators, and online/offline status shown to other Users.
• On-device preferences: Language, theme, onboarding completion, and similar UI flags are stored locally on the device (AsyncStorage). The OS language is used only as the initial UI language. If you change language in Settings, we also save it on your account so emails match. These local preferences are not advertising identifiers.
• Sharing: You can share a referral link through the OS share sheet (the destination app is yours to choose). Optional unit-earning missions may open Facebook or LinkedIn; we only store the public post URL if you submit it.
• Units and Premium: Balances, free-unit missions, drop claims, and referrals work in the app. Drop claims use your install ID for monthly caps (no website Turnstile). When purchase buttons are shown, payment runs through DHMAD in the in-app browser, not Apple or Google in-app purchase. Some store builds hide purchase buttons entirely; free Units features still work.
• Optional AI: The post-job flow can send your draft title, description, skills, and instructions to our servers (and then OpenAI) to suggest edits, the same as on the website. We do not run on-device speech recognition or CV parsing in the apps.
• Analytics and tracking: The native apps may send first-party product events to PostHog Cloud EU (same events as the website API: job apply, hire, checkout). No advertising SDKs, no IDFA/GAID, and no App Tracking Transparency. You can opt out in Settings. Server logs and the install ID still apply as described in Section 3.2. We do not include Google Analytics, Meta/LinkedIn pixels, or Sentry in the native apps.
• Permissions we do not use: Contacts, camera, microphone, precise GPS, Face ID / biometrics to unlock the app, and advertising tracking. Photo-library and (on Android) notification permission are requested only when you use those features.
• Account deletion: You can delete your account in the app under Settings. We email a one-time code to confirm; after confirmation we permanently delete your profile, messages, applications, devices, push tokens, and uploaded files, subject to limited records described in Sections 11 and 13.

6. Legal Basis for Processing

We process your personal data on the following legal bases under applicable Tunisian data protection law:

• Contractual Necessity: Processing necessary to perform our contract with you (the Terms and Conditions), including account management, service delivery, payment processing, and communications.
• Consent: Processing based on your explicit consent, such as marketing communications, website analytics/advertising cookies, and optional push notifications. You may withdraw consent at any time.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, Platform security, service improvement, and error monitoring, provided these interests are not overridden by your fundamental rights.
• Legal Obligations: Processing necessary to comply with legal or regulatory obligations, including tax reporting, anti-money laundering requirements, and responding to lawful government requests.

7. How We Use Your Information

We use the information we collect for the following purposes:

7.1. Platform Operations

• Create, maintain, and manage your account.
• Determine your applicable service fee tier based on your account registration date (Early Adopter or standard rate).
• Facilitate the matching of Clients and Freelancers.
• Process job postings, applications, invitations, offers, and Service Contracts.
• Enable real-time messaging, typing indicators, online/offline status, and in-app / email notifications.
• Manage the Units and Premium systems (awarding, spending, purchasing, and refunds).
• Process payments through escrow and facilitate fund transfers via DHMAD.
• Optionally generate AI-assisted drafts when you use those features: job-description assist (website and app), and on the website only translations, CV parsing, support drafts, or voice-to-text on public job briefs.

7.2. Security and Fraud Prevention

• Detect, prevent, and investigate fraud, abuse, and security threats.
• Enforce our Terms and Conditions and other policies.
• Rely on DHMAD for identity verification status where applicable.
• Assess login risk (for example new device or country) and send a verification code by email when needed.
• Monitor for suspicious activity, multiple accounts, and policy violations.
• Implement rate limiting, bot challenges (website), and access controls.

7.3. Communications

• Send transactional emails (account verification, password resets, login / deletion OTPs, payment confirmations).
• Deliver notifications about job updates, applications, messages, and reviews.
• Send job-alert digest emails to freelancers with matching interests unless they turn off job alerts in website Settings. (The mobile app Settings toggle controls push notifications only.)
• Respond to your inquiries and support requests.
• Send service-related announcements and policy updates.

7.4. Analytics and Improvement

• Analyze usage patterns to improve Platform features and user experience.
• Conduct internal research and development.
• Generate aggregated, anonymized statistics about Platform usage.
• Monitor errors and reliability (including website session replay sampled by Sentry).
• Test new features and improvements.

7.5. Legal and Compliance

• Comply with applicable laws, regulations, and legal processes.
• Respond to lawful requests from government authorities.
• Protect our legal rights, property, and safety.
• Resolve disputes and enforce our agreements.

8. Cookies and Tracking Technologies

On the website, we use cookies and similar technologies to collect and store information about your interactions. A cookie is a small text file placed on your device by a web server. The native mobile apps do not rely on these website cookies for sign-in. When the apps open DHMAD in an in-app browser, DHMAD may set its own cookies on dhmad.tn under DHMAD's privacy policy.

8.1. Types of Cookies We Use

8.2. Essential Cookies

Essential cookies are strictly necessary for the website to operate. They include our authentication refresh token (httpOnly cookie), CSRF tokens, and bot-protection challenges. You cannot opt out of essential cookies as they are required for login and security on the website. Access tokens are kept in memory (not in a cookie accessible to JavaScript).

8.3. Managing Cookies

On your first visit to the website, a cookie banner lets you accept or reject non-essential cookies (analytics and marketing). Essential cookies remain active because they are required for login and security. You can change your choice later by clearing site data for tunisiefreelance.tn, which will show the banner again. You can also manage cookies in your browser settings, or opt out via Google Analytics Opt-out and Facebook Ad Preferences. Blocking essential cookies may prevent you from using the website.

9. Information Sharing and Disclosure

We do not sell your personal data. We share your information only in the following circumstances:

9.1. With Other Users

Your public profile information (display name, title, bio, skills, portfolio, ratings, and reviews) is visible to other Users of the Platform. Client profiles may also show the company name you entered. Your public display name is your first name plus the initial of your last name (for example "Sara B."). Other users do not see your full last name or email on public profiles. Administrators may see full names. While you are connected, other Users may see whether you are online and whether you are typing in a shared conversation. We do not automatically email your address to the other party; after you are in an engagement, you may choose to share contact details in messages. Off-platform contact details may be restricted early in a relationship to reduce scams.

9.2. Service Providers

We share data with trusted third-party service providers who assist us in operating the Platform:

• DHMAD: Payment processing, escrow services, and identity verification status. DHMAD receives transaction details and the identifiers needed to run KYC on its side. In the mobile apps, sign-in, checkout, and escrow pages open in an in-app browser on DHMAD's domain.
• MongoDB Atlas: Primary database hosting for Platform data.
• Amazon Web Services (AWS): Cloud hosting, file storage (S3), and email delivery (SES). AWS processes data on our behalf as a data processor.
• Cloudflare: Content delivery network (CDN), DDoS protection, and Turnstile bot challenges on the website.
• Expo: Push notification delivery for the mobile apps when you enable notifications.
• Sentry: Error monitoring on the website (including sampled session replay). User ID and email may be attached to error events for debugging.
• OpenAI: Optional AI features you invoke (job-description assist on website and app; translations, CV parsing, support drafts, and voice-to-text on the website).
• Google (Analytics / Sign-In): Website usage data for analytics after cookie consent, and OAuth profile fields when you sign in with Google (website or native app).
• Meta (Facebook) and LinkedIn: Website conversion measurement after marketing cookie consent, including hashed identifiers where applicable. In the apps, we only open those sites if you start a share mission yourself.
• Apple: Sign in with Apple authentication on iOS.
• Trustpilot: Review invitations after completed work, using your email and display name where applicable.

9.3. Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including but not limited to: (a) complying with a subpoena, court order, or similar legal process; (b) responding to requests from law enforcement authorities; (c) protecting the rights, property, or safety of Tunisie Freelance, our Users, or the public; (d) detecting, preventing, or addressing fraud, security, or technical issues.

9.4. Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform of any change in ownership or use of your personal data.

10. International Data Transfers

Your data may be transferred to and processed in countries outside Tunisia where our service providers operate, including the United States (AWS, Google, Meta, MongoDB Atlas, Sentry, OpenAI, Expo) and other jurisdictions. These countries may have data protection laws that differ from those in Tunisia.

When we transfer your data internationally, we implement appropriate safeguards to protect your information, including contractual data processing agreements with our service providers that require them to protect your data to standards consistent with this Privacy Policy and applicable law.

11. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, including:

• Active Account Data: Retained for the duration of your account's existence and active use of the Platform, including messages, applications, and uploaded files.
• Account Deletion: When you delete your account (website or app Settings), we permanently delete your marketplace profile, messages, applications, devices, push tokens, and uploaded files on our side, including Units and Premium history we store. Payment and escrow records held by DHMAD follow DHMAD's retention rules.
• Security and Operational Logs: Login risk, device, and server logs may be retained for a limited period for security, abuse prevention, and debugging.
• Legal Compliance: Data required for compliance with legal obligations, audits, unpaid or ongoing escrow with DHMAD, or dispute resolution may be retained for as long as legally necessary, even after account termination.
• Anonymized Data: Aggregated, anonymized data that does not identify you may be retained indefinitely for analytics and research purposes.

12. Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: Data transmitted between your client and our servers is encrypted using TLS (HTTPS). Passwords are stored using bcrypt hashing.
• Authentication Security: Access tokens are stored in memory only (not in localStorage or cookies accessible to JavaScript). On the website, refresh tokens are stored in secure httpOnly cookies. In the native apps, the refresh token is stored in the platform keychain instead of an httpOnly cookie.
• CSRF Protection: Website state-changing requests are protected against Cross-Site Request Forgery using token-based validation. Cookieless mobile API routes do not use website CSRF cookies.
• Rate Limiting: Multi-layer rate limiting protects against brute-force attacks, credential stuffing, and denial-of-service attempts.
• Access Controls: Role-based access controls restrict data access to authorized personnel and systems only. Public APIs redact full last names.
• Infrastructure Security: Our infrastructure uses MongoDB Atlas and AWS, with DDoS protection and CDN provided by Cloudflare.

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you acknowledge that you transmit your data at your own risk. You are responsible for maintaining the security of your account credentials.

13. Your Rights

Subject to applicable Tunisian data protection law, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right of Rectification: You have the right to request that we correct any inaccurate or incomplete personal data. You can update most of your information directly through your account settings.
• Right of Deletion: You may delete your account in Settings on the website or in the mobile app. We email a 6-digit code to your registered address; after confirmation we permanently delete your profile, messages, applications, devices, push tokens, and uploaded files, subject to records we must keep for security logs, unpaid/ongoing escrow with DHMAD, and legal obligations. Emailing support remains available if you cannot use the in-app flow.
• Right of Portability: You have the right to request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case we will cease processing unless we demonstrate compelling legitimate grounds. Push notifications can be turned off in the mobile app Settings. Job-alert emails can be turned off in website Settings.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

To exercise any of these rights (other than self-serve deletion and settings toggles), please contact us at [email protected]. We will respond to your request within thirty (30) days. We may ask you to verify your identity before processing your request. In certain cases, we may charge a reasonable fee or decline your request if it is manifestly unfounded, excessive, or contrary to law.

14. Children's Privacy

The Platform is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal data from children under 18, and we do not verify age at registration. If you are under 18 you must not create an account. If we discover that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such information. If you believe that a child under 18 has provided us with personal data, please contact us immediately at [email protected].

15. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or applications that are not operated by us (including DHMAD payment, OAuth, and escrow pages opened in the mobile in-app browser, review platforms, and apps you pick in the OS share sheet). We are not responsible for the privacy practices, content, or security of any third-party sites or services. We encourage you to review the privacy policies of any third-party services you access through the Platform. The inclusion of a link does not imply endorsement by Tunisie Freelance.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Provide notice through the Platform (via notification or prominent banner).
• For significant changes, send an email notification to your registered email address at least thirty (30) days before the changes take effect.

Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

If you are not satisfied with our response to your inquiry, you have the right to lodge a complaint with the relevant Tunisian data protection authority, the Instance Nationale de Protection des Données Personnelles (INPDP).