Privacy Policy

mendyjob.com · Effective date: October 15, 2026 · Version 2026-10-15-v2

Pavel Karabitski owns and operates this website and provides its platform service as an individual. MendyJob is the name of the website and software product at mendyjob.com. In these documents, “we,” “us,” “our,” and “operator” refer to Pavel Karabitski. The platform agreement and the operator's duties and commitments are with Pavel Karabitski.

This Policy describes how Pavel Karabitski handles personal information to operate the marketplace at mendyjob.com, initially offered for service jobs in Maryland. It covers customers, professionals, visitors, and people who contact Pavel Karabitski. MendyJob is the website and product name. Pavel Karabitski determines the purposes and means of the platform's processing and is responsible for the operator's practices and commitments in this Policy. Independent professionals are responsible for their own records and information practices. The Notice at Collection summarizes categories, purposes, recipients, and retention at the point of collection.

1. Information and its sources

Accounts: email address, internal identifiers, password hashes and authentication records, email-confirmation status, and security settings. If configured and chosen, Google sign-in supplies account identifiers and email/profile information needed for authentication. We do not receive your Google password.

Operator accounts: separately provisioned operator accounts record their operator account type, a declaration of age 17 or older and authorization, the acknowledged document version, and its timestamp. This does not record an adult customer/professional declaration or independently verify age.

Advertising records: an advertiser's public name, approved text, website and applicable public license number, plus restricted review notes, reviewer identifiers, times and earlier versions. We use these records to manage placements, check claims and address concerns. Pausing or archiving an ad stops its public display but retains its restricted history. Applicable access, correction, deletion and retention requests use the process below.

Jobs and transactions: category, description, questionnaire answers, exact service address, ZIP code, location coordinates, timeframe, optional budget, quotes and agreed amounts, scheduling, messages, cancellations, statuses, and job history. New quote versions and change proposals retain the professional's supplied business name and public license information with the time recorded, so later profile edits do not change that record. These records do not verify licensing; older unrecorded details remain unknown. Customers can upload job photos, and unfinished uploads may be stored temporarily before posting.

Professional profiles: business name, description, business phone, ZIP code, business address and coordinates, service categories and radius, website, years in business, profile status, reviews, and approval records. Work background and experience are self-reported; we do not obtain background reports from external sources in the current service. Professionals may submit private equipment images, optional license/exemption and insurance images, and application-support messages. Those documents may contain additional personal information; redact irrelevant identification, financial, and third-party details before uploading.

Community and support: reviews, ratings, reports, blocks, feedback, related account/job identifiers, in-app notifications, privacy requests, identity-verification activity, and operator responses. Another user may provide information about you in a job interaction, review, or report.

Technical information: cookies, request/security metadata such as IP address and user-agent information, and operational error records used by the application and configured infrastructure. Optional first-party visit summaries record start/last-seen time, broad page/device labels, form-progress/completion indicators, and validation/browser-error counts. A signed-in summary can be linked to an account; summaries exclude typed form values, raw URLs, addresses, passwords, and browser-error messages.

Information comes from you, your browser, other marketplace participants, authorized representatives, and configured authentication or infrastructure providers. Categories may overlap; credentials and precise location can be sensitive personal information under state law. We do not request Social Security numbers, payment-card details, biometric templates, or health information for normal marketplace use. Do not add them to messages or uploads.

The separate Consumer Health Data Privacy Policy explains health-related information that may reach us through submitted content or support, and how to request access, recipients, withdrawal or deletion.

2. Why we use information

We use information to authenticate and secure accounts; operate profiles, jobs, matching, quotes, scheduling, messaging, reviews, and notifications; review professional applications; provide support; prevent misuse; respond to requests and legal obligations; and maintain necessary marketplace history. Optional visit summaries help us improve the site. Matching uses job/service categories and location criteria. Current matching does not itself decide employment, credit, housing, or insurance eligibility.

Nearby matching uses verified service and business coordinates internally to compare straight-line distances. We send the entered street address and ZIP code to the U.S. Census Geocoder, or reuse a recent successful verification. Customers confirm a matching address before posting a job or changing its address. A match does not guarantee that a building or unit exists or establish ownership. Successful address checks, including returned coordinates, are cached in encrypted form for up to 30 days, as configured. Internal numeric search columns retain precise coordinates with the related job/profile so the database can filter nearby work. These numeric columns and the service address itself are not encrypted by the verification cache. Before quote acceptance, professional browsing receives public job details and ZIP codes, not exact customer addresses or coordinates. The exact service address is released to the accepted professional through the authorized workflow.

3. Disclosures and who can see information

Application and database hosting: Pavel Karabitski has selected OVHcloud's US-EAST-VA region in Virginia for the website and database. OVHcloud processes the information held on a VPS deployed there to provide infrastructure and its necessary security and support functions. This host-region selection is not a promise that all storage, email, support or other provider processing occurs in Virginia or only in the United States.

Other marketplace participants: eligible professionals receive non-private job details, such as description, category, ZIP code, timeframe, and budget. Exact customer service-address fields are hidden until that company's quote is accepted. The accepted professional can then access the exact address and customer contact information allowed by the workflow. Authorized conversation participants can see their messages. Company profiles and reviews are visible through the site's profile features; private verification images are restricted to authorized application-review/evidence access and are not displayed to customers.

Service and infrastructure providers: Pavel Karabitski uses hosting/database, private file storage, account/service email delivery, security, support-inbox and monitoring providers for those functions. The U.S. Census Geocoder receives job and business addresses and ZIP codes submitted for address confirmation, together with the server's request information. Automated account and service email is handled through the configured Brevo integration. Cloudflare Turnstile receives security signals when its challenge is displayed. Google sign-in is enabled; Google supplies account identifiers and authentication information when you choose it. Providers may receive connection/device information directly when their resources load. Third-party sites you visit through profile or advertisement links follow their own policies.

Files, backups and support: Private files are held in protected server storage in this installation. Cloudflare R2 is the selected provider for cloud file storage when activated. Backblaze B2 is the selected backup storage provider; it processes recovery copies sent to it. The support and privacy inbox is pavelksupport@gmail.com, hosted by Google Gmail. Optional visit analytics runs within this application. Pavel Karabitski limits provider access to the relevant purposes and handles requests about actual disclosure recipients through the request methods below.

Security checks: when Turnstile loads, Cloudflare receives connection and browser signals, including IP address and browser information. Its Turnstile privacy notice explains processing to secure this site and Cloudflare's separate processing to improve bot detection. These security checks are separate from optional visit analytics.

Safety, legal, and business purposes: authorized administrators can review reports, applications, requests, and relevant records. Information may be disclosed when necessary to comply with law, protect rights or safety, investigate misuse, or support a lawful business transfer with applicable privacy safeguards. Disclosure of private communications and account records requires applicable lawful authority; a routine information request does not by itself authorize disclosure.

Pavel Karabitski does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. This service has no SMS delivery or payment checkout. No financial incentive is offered for providing personal information. Ordinary workflow disclosures to a professional you select are distinct from advertising sharing.

Ad display is off in this installation. These ads are selected by page placement and administrator order. The ad feature adds no ad cookies, click or impression counters, behavioral targeting, third-party ad scripts or remote advertiser images. Advertisers do not receive private job information through ad display. Their websites have their own practices when you follow a link. See the Advertising Policy.

There is no subscription billing or promotional-email program at this release. Account-verification, security and service emails support your requested account and work coordination. A future change in billing or marketing practices requires advance disclosures and any legally required separate consent or opt-out controls. This Policy does not authorize unrelated new uses of information.

4. Cookies, signals, and browser drafts

If enabled by the operator and expressly allowed by your current analytics choice, Google Analytics measures selected public acquisition pages. Google receives browser/device and connection information and a pseudonymous browser identifier. Our integration supplies public page labels and sanitized page/referrer addresses, without account identifiers or form values, and excludes private marketplace pages. Analytics cookies are configured for up to 30 days. We disable advertising personalization and Google signals. This third-party measurement requires a new choice version; permission previously given only for first-party summaries is insufficient. See the Cookie Policy and how Google uses information from partner sites. Browser GPC and account/browser analytics opt-out prevent the integration from loading.

Essential cookies support sign-in, form protection, and preferences. Optional analytics starts only after you explicitly choose to allow it and is suppressed by an account/browser opt-out or Global Privacy Control (GPC) signal. Choosing essential cookies only never permits analytics, including job-posting and professional-registration summaries. The public Your Privacy Choices page lets you withdraw or change browser permission without creating an account. An explicit allowance can replace a previous browser refusal, but cannot override GPC or an account opt-out. Account privacy tools also disable account-linked analytics and remove existing account-linked summaries.

The application does not currently interpret the older Do Not Track (DNT) header. DNT and GPC are different signals. We do not use advertising trackers to follow activity across third-party websites; configured external authentication/security providers have their own disclosed practices.

An unfinished job draft, including its address, is saved in your browser's localStorage and expires for recovery after seven days; it is not a posted job. An expired draft is removed when the application next checks it. Browser storage can remain on a device that does not return to the site until you clear it; expiration is not a remote wipe. Use care on shared devices. See the Cookie and Browser Storage Policy for storage details and controls.

5. Retention and deletion

Retention depends on the record, its purpose, active work, and legal/dispute holds. The configured schedule removes visit summaries after 30 days, notifications after 90 days, geocoding cache entries after 30 days, and closed privacy cases/archived reports and feedback after 3 years, subject to holds and appeals. Browser drafts expire for recovery after seven days and are cleared when next checked or when you remove them.

Closed-job personal content is scheduled for removal 12 months after completion or cancellation: addresses, precise coordinates, descriptions, answers, message and quote text, review comments, and remaining job images/previews. Active jobs, unresolved related reports, and held records are excluded until reviewed. Full-size completed-job photos normally leave active picture storage after five days; smaller previews remain until the applicable content-removal rule. Cleanup runs in batches and files may require retries.

Current account/profile/evidence data is retained to support the account and reviewed for removal on approved deletion. Deletion removes eligible contact/profile/content data and credentials, revokes sessions, and queues private-file deletion. Minimal linked identifiers, statuses, amounts, dates, ratings, and justified security/audit history may remain; this is not complete anonymization. We retain those records only while needed for workflow integrity, dispute handling, security, or legal obligations, and review continued need.

Account deletion may require resolving active work, reports, or holds; Pavel Karabitski assesses legal requests individually and explains applicable exceptions. Deletion does not automatically cancel a service contract. The backup policy keeps seven daily, four weekly, and six monthly encrypted snapshots, subject to necessary preservation holds and shorter applicable deletion requirements. Deleted records may remain in restricted snapshots until expiration. Pavel Karabitski is responsible for applying required deletion and opt-out records before restored data is made available.

Specific legal preservation duties can require different retention periods and restricted access. Removing material from normal site access and disposing of lawfully retained evidence are separate decisions.

6. U.S. state privacy rights, including California

Depending on residence, applicable law, and exemptions, you may request access/confirmation, a portable copy, correction, deletion, information about disclosures, and opt-out of sale, targeted advertising, or qualifying profiling. California rights also include knowing categories/specific pieces, sources, purposes, and recipients, and limiting certain uses/disclosures of sensitive information. We use sensitive information for requested services, account security, and related permitted functions; we do not use it to infer sensitive characteristics or for advertising.

California residents should read the Notice at Collection for information categories, purposes, recipients and retention. You may request information about relevant prior collection and disclosures, including the preceding 12 months where applicable. California's CCPA/CPRA and other state comprehensive laws apply according to their own thresholds and exemptions. The rights below apply to the extent the relevant law covers your request.

We will not unlawfully discriminate or retaliate because you exercise a privacy right. You may use an authorized agent. Identity verification is proportionate to the request and is not required for the browser analytics choice. We may request proof of agency and, where lawful, your direct confirmation; do not send a password or unrequested identity document.

Where applicable law grants it, you may request the specific third parties that received personal data, including the lists required by Oregon, Minnesota, or Delaware law, rather than only categories of recipients. You may also ask for information about qualifying automated profiling, challenge a qualifying decision, and request the explanation, correction, or reevaluation the applicable law requires. Current marketplace matching is not a solely automated decision with legal or similarly significant effects. Maryland residents' rights, when the Maryland Online Data Privacy Act applies, include confirmation/access, correction, deletion, portability, and opting out of sale, targeted advertising, and qualifying profiling. Sensitive-data processing under that law must be strictly necessary for the requested service; consent does not authorize unnecessary processing or sale of sensitive data.

7. Requests, responses, and appeals

Use account privacy tools for downloads and requests, or the privacy contact below if you cannot sign in, have no account, or use an agent. You need not create an account to exercise a legal right. Self-service exports contain account-owned records and exclude credentials, other people's private information, and internal moderation notes; request additional records/files through an access request.

The portal records receipt and displays the request's deadline immediately.

• Access, correction and disclosure requests normally receive a response within 45 calendar days; an extension of up to 45 additional days requires a lawful reason and notice before the initial deadline.
• Deletion, including health-data deletion, has a 30-calendar-day service target. Opt-outs, sensitive-data limitations and health-data consent withdrawal/cessation are handled as soon as feasible within 15 calendar days. These requests cannot be extended through the account portal.
• Browser analytics refusal takes effect immediately. Appeals receive a response within 30 calendar days and cannot be extended. These are service deadlines; a shorter applicable legal deadline takes priority.
• For covered California requests to know, correct, or delete, receipt must be acknowledged within 10 business days, and sale/sharing opt-outs or sensitive-information limits must be honored as soon as feasible within 15 business days. Requests received through email require the same tracking and timely acknowledgment.

You do not need to repeat identity verification just to submit a portal request or appeal, or to disable analytics. Before disclosing or changing protected records, we may verify identity proportionately. We do not require identity verification for sale/sharing opt-outs. Requests are free unless an applicable law permits a fee and we explain it first. Denials include the reason and applicable appeal instructions. You may contact your state Attorney General or, for California, the California Privacy Protection Agency about unresolved concerns.

8. Security, U.S. operation, and children

Pavel Karabitski uses access restrictions, authentication, private-file controls, and other safeguards designed to protect information. No system can guarantee security. The service is intended for U.S. use. Providers may process information where they operate; this Policy makes no promise that every copy is stored or processed only in Maryland or the United States. Ask the privacy contact about relevant provider locations and recipients.

Customer and professional accounts are intended for adults at least 18 years old with the legal capacity described in the Terms. The site is not directed to children under 13, and Pavel Karabitski does not knowingly collect their information. If you believe a child has provided information, contact the privacy contact so Pavel Karabitski can investigate and remove it as required. Account registration records an adult declaration and does not independently verify date of birth.

9. Updates

We will post the revised version and effective date when this Policy changes, provide material-change notices as required, and obtain consent when a new use requires it. New purposes cannot be authorized simply by changing this page.