Privacy
What Affirmat holds, for how long, and why. This page is written to be read, not to be survived.
Status
Draft structure, not in force. Everything factual below is derived from the running system and was checked on 11 September 2026. The controller identity, the lawful bases and the rights sections have not been drafted.
Not open yet
Affirmat is opening in Ireland first, and it is not open yet. Nothing on this site can be signed into, searched or put up today.
There is no waiting list and no sign-up: this page asks for nothing, not even an email address. It is here so what is being built can be read and held to.
Everything below is built and tested. None of it has yet met a phone network, a customer or a bill.
Who holds this
Not drafted
[FOR SOLICITOR: the controller identity, registered address, company number and contact address; and whether a data protection officer is required. The company is not yet registered]
Not drafted
[FOR SOLICITOR: the controller and processor mapping where a business logs its own customer’s details — whether the business is a controller in its own right at that moment, and what the terms must require of it. See section 9 of the solicitor brief]
If you are a tradesperson or a business
- Name and profile
- Published at a public profile page, with a trade and a bio.
- Phone number, and email if given
- Encrypted. Looked up only by a salted hash, never by decrypting. Never shown in full.
- Identity document
- A passport or driving licence image, held privately and deleted 30 days after the decision. What survives is the decision, never the document.
- Employment history
- Which businesses the person worked for, and between which dates. Ending a role closes the record rather than removing it, so past jobs stay attributable.
- Qualifications
- Self-asserted, with an optional certificate held privately.
- Job counts and ratings
- Computed from confirmed jobs and published. Not editable by anyone, including staff.
A business also holds its own trading details — legal name, company number, premises location and areas covered — and a contact number. The contact number is encrypted and is never printed in the page source: it is revealed by a rate-limited request when somebody taps to call, and that tap is recorded and opens a draft job for the business.
Where you were, if you captured work
Capturing evidence records location. When a working session opens at a site, the system records the anchor fix, its accuracy, the distance from the expected location, and which named person opened it, between which two times. Each photograph carries its own coordinates, accuracy, distance from the anchor and capture time.
Two limits are built in. Background location is never used — location is read only while a person is on the capture screen with a job open. And a session records an anchor and a distance, not a track: there is no continuous trail.
Not drafted
[FOR SOLICITOR: the position where the person whose location is recorded is an employee of the business that benefits from the record, and whether that is a distinct purpose needing its own notice to staff rather than to businesses. See section 2.4 of the solicitor brief]
If you are a customer
- Phone number or email
- Encrypted and looked up by hash only. Where a business entered it to request a confirmation, it is erased 30 days after the job closes.
- Home address or vehicle registration
- Held so a logbook can exist. Never public: a public card shows the coarse area key, or a vehicle make and model.
- The confirmation
- The four ratings, an optional comment of up to 300 characters, and which role the person confirmed in. The ratings and the comment are published.
- Snags, callbacks and disputes
- What was raised, when, any photograph attached, and the reply.
- Quote requests and work posts
- What was asked for, with any photographs, and which businesses saw it.
Your address and your vehicle registration are never public. A public card shows a coarse area key such as D06, or a make and model.
Affirmat can hold your phone number before you have ever used Affirmat: a business enters it so that a confirmation request can be sent to you. That number is used for that request and its reminders, for nothing else, and is erased 30 days after the job closes. It is never sold and never used for marketing.
Not drafted
[FOR SOLICITOR: the lawful basis for that first message, and how the ePrivacy Regulations 2011 bear on it. The engineering position is that it is transactional — it asks a person to confirm work done at their own property — and is not marketing. See section 4.2 of the solicitor brief]
Photographs of your home
This is the most sensitive thing Affirmat holds, and it is worth being exact about it. The photographs are of the inside of a home — a kitchen mid-refit, a consumer unit in a hall press, a bathroom stripped to the joists. Each one carries the coordinates of where it was taken and the minute it was taken.
What is done about that. The original is hashed and kept in a private store that is never served to anyone. Only a stamped, EXIF-stripped rendition is published, so the precise coordinates are not embedded in any file a member of the public can download. The stamp burned into the published image carries the date, the time, the coarse area key and the distance from the job anchor — enough to show the photograph was taken at the job, not enough to find the house.
A customer can hide photographs from public cards. They stay in the job record and in the customer’s own logbook.
Not drafted
[FOR SOLICITOR: whose consent is required to photograph and publish the interior of a private dwelling, whether it must be a separate and specific act, and whether the existing consent line shown at confirmation does that work given the photographs were already taken. See sections 2.3 and 4.3 of the solicitor brief]
Held about everyone who uses the site
- Sign-in attempts
- The hashed target, a hashed one-time code valid for 10 minutes, and the IP address the attempt came from. The code itself is never stored.
- Sessions
- A hash of the session token — never the token — with the device's user-agent string, so a signed-in device can be recognised and revoked. Sessions last 30 days and extend while in use.
- QR scans and contact taps
- The time, the outcome, a coarse area and a hashed user agent. The raw user-agent string is not kept for either.
- Messages sent
- A delivery receipt: channel, hashed recipient, provider reference, status and time. The message text is not recorded in production.
- Do not contact
- A hash of any contact that has replied STOP, bounced or complained. Held with no way to reverse it back to an address, and kept so contact cannot resume.
How it is protected
Phone numbers and email addresses are encrypted at rest with AES-256-GCM. Every lookup goes through a salted hash of the value, so ordinary operation never decrypts a contact detail. One-time codes, session tokens, confirmation links and transfer codes are held only as hashes; the values themselves are never stored.
Phones, emails and tokens are never written to a log and never shown in full anywhere in the product. That is enforced by a fixed redaction list in the logger rather than by care alone.
Photograph originals, documents and identity images live in a private store, affirmat-private, which is never served publicly and has versioning on. The database runs with point-in-time recovery.
How long it is kept
- Identity documents
- 30 days after the verification decision, then deleted. The window exists so a rejected applicant can appeal against the actual document.
- A customer’s contact details on a job
- 30 days after the job closes, then erased. The job, its photographs and its confirmation survive; the means of contacting that customer does not. Affirmat does not keep a list of anybody’s customers.
- A confirmation link
- Valid for 30 days after the job is marked done, then dead.
- A logbook transfer code
- Valid for 90 days, then dead. Only a hash of the code is ever stored.
- Confirmed jobs and their photographs
- Kept. A confirmed job is three parties’ record at once and is the evidence the product rests on. See what cannot be removed, below.
Not drafted
[FOR SOLICITOR: retention periods for everything not listed above, none of which is fixed in code yet: sign-in attempts including the IP address, expired sessions including the user-agent string, QR scans, contact taps, the audit and event logs, business reports, waitlist entries, and — the largest of them — photograph originals, which are currently kept indefinitely. See section 3.5 of the solicitor brief]
Who else touches it
The application and the database run in Frankfurt. Photographs, documents and identity images are stored in the EU. Texts are sent through a messaging provider and emails through an email provider; a phone number or an email address is necessarily readable by that provider at the moment of sending. Errors go to a monitoring service in its EU region, with contact details redacted before anything is sent. Analytics are page-level and cookieless.
Not drafted
[FOR SOLICITOR: the named list of processors and sub-processors, each transfer mechanism, and a signed agreement with each of the five: hosting and database, object storage, the messaging provider, the email provider, and error monitoring. See section 5 of the solicitor brief]
What cannot be removed, and why
A confirmed job writes to three records at once — the business’s public ledger, the profile of the person who captured it, and the customer’s logbook — and none of the three can delete another’s copy. Job counts and confirmation rates are computed from those records and cannot be edited by hand by anyone, including staff. So a record cannot be quietly removed without changing what is published about somebody else.
What can be done today: a person can take their jobs off their own profile; a business can archive a job, which never deletes it; a customer can hide photographs from public cards.
Not drafted
[FOR SOLICITOR: the erasure position, which is the hardest open question in the product. A tradesperson asks to be deleted; their confirmed jobs are also the business’s ledger and the customer’s logbook, and the customer wrote the confirmation. What can be erased, what is retained and on what basis, what pseudonymisation would have to mean when coordinates and capture times remain, and what a tradesperson must be told about this at sign-up. See section 7 of the solicitor brief]
Your rights
A request from a tradesperson reaches their profile, memberships, qualifications, jobs, photographs, site sessions, co-signs, sessions, sign-in attempts and the audit log. A request from a customer reaches their account, assets and logbook access, jobs, confirmations, snags, callbacks, disputes, quote requests, work posts, reminders, transfer codes and photographs — including, we assume, the photographs of their own home.
Not drafted
[FOR SOLICITOR: the rights section in full: access, rectification, erasure, restriction, portability and objection; what an export must contain; the response time; how identity is verified without collecting more data than the request itself; and the complaint route to the Data Protection Commission]
If something goes wrong
Not drafted
[FOR SOLICITOR: the breach notification wording. The private store holds the only copy of every photograph original, every document and every identity image, so the severity of a compromise there should shape it. See section 9 of the solicitor brief]