Privacy notice

Who is responsible for your information

Ratidza is operated by Helion Minds Ltd, a company registered in England and Wales (16663268). For questions about how we use your information, email enquiries@ratidza.work. Registered-office and corporate details are provided on our company-information page when the legal notices are published.

Information we collect

• Account details: name, email address and sign-in records, including securely stored password credentials and session information.
• Organisation and provider details: names, contact information, locations, capabilities, experience descriptions and the accounts authorised to act for a person or business.
• Project records: work descriptions, location, budgets, invitations, responses, proposals, decisions, notes and associated dates.
• Evidence and trust records: submitted claims, documentary references, source details, observations, verification findings, supporting links and project outcomes. Some references may concern other people.
• Communications: information you send directly to our monitored email address, including your address and the message itself.
• Technical information: authentication cookies, device or browser information, IP addresses and activity recorded where needed to operate, troubleshoot and secure the service.

Why we use it and our lawful bases

We do not treat every submission as consent to unrelated marketing. If we introduce optional marketing or processing requiring consent, we will explain it separately and provide appropriate controls.

• Providing accounts and the project service: information needed to register users, maintain sessions, invite participants, display proposals and record decisions. Our usual lawful basis is performance of a contract or taking steps requested before entering one.
• Operating a trustworthy service: protecting accounts, investigating misuse, retaining relevant evidence and handling disputes. Our usual lawful basis is our legitimate interests in operating a safe, accountable service, balanced against users' rights.
• Responding to enquiries and research corrections: our legitimate interest in communicating with users and maintaining accurate published information, or pre-contractual steps where relevant.
• Complying with a legal obligation: where we must retain information or respond to a lawful request, our basis is compliance with that obligation.

Who sees your information

Customers may see proposals and relevant provider information for their projects. Providers may see the project information they are authorised to access. We use project-specific permissions for private evidence, references and decision records. A submitted claim is not the same as a verified fact.

Authorised platform operators may need access to manage the service and investigate problems. Our current and planned service providers include DigitalOcean (managed PostgreSQL database), Vercel (application hosting when deployed), and Google Workspace (our monitored contact email). Those providers process information as needed to deliver their respective services. The optional Resend contact form is disabled and is not used to collect public enquiries.

When secure photo, document or video attachments are enabled, we use Cloudinary as an additional service provider for private evidence-file storage and authorised delivery. File content and technical metadata may be processed by Cloudinary. The use of this feature is controlled by our deployment settings.

Information may also be disclosed where legally required or to protect rights and safety. We do not sell project information or contact details to advertisers.

International use and data locations

Ratidza serves people who may be located in Zimbabwe, the United Kingdom and elsewhere. Our managed PostgreSQL database is located in DigitalOcean's London (LON1) region. We plan to deploy the application on Vercel with its functions configured for a European region. The precise live deployment region must be confirmed at launch; globally distributed delivery and supporting service operations may involve other locations. We do not currently have platform administrators based in Zimbabwe.

Participants in different countries may access information shared with them through authorised project workflows. Our technology providers, including Google Workspace and Cloudinary if evidence attachments are enabled, may process certain information in other countries according to their service arrangements. Where restricted international transfers occur, we assess and use any safeguards legally required. Contact us for information about the safeguards relevant to your data.

How long we keep information

Account and profile information is ordinarily retained while the account is active. We review it when an account is closed or an erasure request is received, subject to the need to preserve shared project records, investigate misuse or meet legal obligations.

We target a retention review for project, proposal, evidence, verification and decision records after 24 months of project inactivity. We review expired project invitations approximately 90 days after expiry. A review is a decision point, not an automatic deletion deadline: records may need to be retained for an active dispute, legitimate legal requirements or the integrity of a decision involving several people.

We review whether records that are no longer needed should be deleted, anonymised or kept with restricted access. You may request earlier review or erasure. Some related project records cannot be removed immediately without affecting other participants' records; we will explain the applicable outcome and any lawful reason for retaining information.

If evidence files are enabled, the related private Cloudinary objects are reviewed along with their project records. An upload that is not completed as an evidence submission can leave an unattached object, which we must identify and clean up operationally.

DigitalOcean Managed PostgreSQL includes automatic daily backups with a recovery window covering the previous seven days. Information removed from the live database may remain in an existing backup until it expires. If we restore a backup, we must take reasonable steps to reapply relevant deletion or restriction decisions. Logs and correspondence have separate retention arrangements depending on the services and settings in use.

Security and account eligibility

We use authentication and authorisation controls to restrict access to private areas. No online service can guarantee complete security. Please do not send us identity documents or sensitive third-party reference details by ordinary email.

Registered accounts are intended for adults aged 18 or over. The public research library remains available without an account. If we learn that an account belongs to someone under 18, we may restrict access and consider the appropriate handling of their information.

Your data rights

Depending on the circumstances, you may ask to access or correct your personal information, request erasure or restriction, object to processing based on legitimate interests, or request portability where it applies. Some rights are subject to legal exceptions and the integrity of records involving other people.

Email enquiries@ratidza.work to make a request. We may ask for information necessary to confirm your identity. You may complain to the UK Information Commissioner's Office (ico.org.uk). Where processing relies on consent, you can withdraw it without affecting processing carried out before withdrawal.

Changes to this notice

We may update this notice as the platform changes. We will identify significant changes and, where required, notify affected users before new processing begins.