Privacy Policy

What this policy covers

Profinr is a directory where visitors search for service providers and business owners publish a profile. This policy explains what we collect, why, and who it is shared with.

It applies to this website and the API behind it. It does not cover the providers listed here — once you contact a provider directly, their own handling of your information is between you and them.

Information you give us

• Account details: your name, email address and a password. Passwords are stored only as a bcrypt hash and cannot be read back by us or anyone else.
• Business profile content, if you register as an owner: business name, description, services, pricing notes, availability, address, phone, WhatsApp number and website.
• Media you upload: cover images, gallery photos and video.
• Enquiries you send to a provider, including the phone number, service and message you enter.
• Identity and age-verification documents, where a category requires them.

Information collected automatically

• Profile view counts and interaction events (for example, whether a call or WhatsApp button was used), which owners see as aggregate numbers on their dashboard.
• Your IP address, used to apply rate limits that protect the site from abuse such as password guessing. It is held only for the length of the rate-limit window.
• Standard server logs generated by our hosting provider.

Cookies

We do not use advertising or third-party tracking cookies. The cookies we set are functional only:

• session_token and admin_token — keep you signed in. They are httpOnly, so scripts on the page cannot read them, marked Secure, and expire after 8 hours.
• signup_intent — a short-lived cookie that remembers you were part-way through adding a business profile, so the sign-up flow can send you back to the right place. It expires in 15 minutes.

Identity and age-verification documents

Some categories are age-restricted and require a government ID or an age-verification selfie before a profile can be published.

These documents are handled differently from ordinary images. They are stored in a private, access-controlled bucket separate from public media, are never served from a public URL, and can only be retrieved by an administrator through an authenticated request. They are used solely to confirm identity and age, and are never shown on a public profile.

Who we share information with

We do not sell your information. We share it only with the services needed to run the site:

• Supabase — hosts our database and the private storage used for verification documents.
• Hostinger — hosts the website and the API, and stores public gallery images.
• Our email provider — delivers verification and password-reset emails.
• Razorpay — processes payments, where online payment is enabled. Card details are handled by Razorpay and never reach our servers.
• Anything you choose to publish on a business profile is public by design, including to search engines.

How long we keep it

• Account and profile data: until you ask us to delete the account.
• Verification documents: while the profile is active, and removed when the account is deleted.
• Enquiries: retained so the provider and you both have a record of the exchange.
• Rate-limit records: minutes, then discarded.

Your choices

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and everything attached to it. Email support@profinr.com from the address on the account and we will action it.

Deleting your account removes your profile from the directory. Search engines may keep a cached copy for a while after that, which is outside our control.

Security

Traffic is served over HTTPS with HSTS. Passwords are hashed with bcrypt. Sessions are httpOnly cookies rather than tokens readable by page scripts. Administrative areas require an administrator account, and verification documents sit behind private storage.

No system is perfectly secure, but if you believe you have found a vulnerability we would genuinely like to hear about it — email us and we will look at it promptly.

Children

This site is not intended for anyone under 18. Age-restricted categories require age confirmation and, where applicable, verification documents. If you believe a minor has created an account, contact us and we will remove it.