Privacy Policy

1. Who we are

Havé (“Havé,” “the app,” “we,” “us,” or “our”) is a mobile app that connects two kinds of people:

• Owners — people who post projects and the jobs within them, browse and match with contractors, hire, message, and leave reviews; and
• Pros (contractors) — people who discover nearby open jobs, send proposals, get matched and hired, manage their work, message, and leave reviews.

The app is operated by Have Group LTD., with its registered/principal place of business at 1679 Kisber Avenue, Victoria, in British Columbia, Canada.

This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with, and the choices and rights you have. We are responsible for the personal information in our care, including information handled on our behalf by the service providers described in Section 5.

If you have questions about this policy or how we handle your information, contact our Privacy Officer (Section 13).

2. Scope

This policy applies to the Havé mobile app and the accounts and services available through it, for both Owners and Pros. It applies to personal information we collect through the app and through your use of its features (creating an account, building a profile, posting and discovering jobs, messaging, leaving reviews, and receiving notifications).

It does not cover the separate privacy practices of third parties whose own services you may use alongside Havé (for example, Apple or Google when you sign in, or your device’s operating system). Those are governed by their own privacy policies.

Geographic scope. Havé is currently available in British Columbia. This policy is designed to comply with Canadian federal and applicable provincial privacy law (PIPEDA). If you access the app from outside Canada, you do so at your own initiative and are responsible for compliance with your local laws. We do not represent that this app complies with the privacy laws of any jurisdiction outside Canada, and we do not actively target users where different privacy frameworks apply. If you are located outside Canada and have concerns about how your personal information is handled, contact our Privacy Officer (Section 13).

Background checks. Havé does not conduct or facilitate background checks on Owners or Pros. We do not verify identity documents, criminal history, or any credential beyond what Pros self-report on their profiles. Users are responsible for their own due diligence before engaging with other users through the app.

3. Information we collect

We collect only the personal information necessary to provide the app’s core features: account security, profile discovery, job matching, and communication. We do not request or require information that isn’t directly relevant to these functions. For each category below, we describe what we collect, why we collect it, and the source (where it comes from).

Account and identity

• Email address — the email tied to your account. Why: to create and secure your account, sign you in, recover access, and send you service-related messages. Source: you provide it at sign-up/login, or it comes from Apple or Google if you choose to sign in with them (Apple may provide a private relay address if you choose).
• Password — a password used to access your account, which we store only in a securely hashed (scrambled) form — we never see or store it in plain text. Why: to control access to your account. Source: you create it at sign-up. (If you sign in with Apple or Google, you may not set a password with us at all.)
• Account identifier — a unique internal ID assigned to your account. Why: to link your information together across the app and operate the service. Source: generated automatically when you create your account.
• Display name — the name you choose to show on your profile. Why: to identify you to other users. Source: you provide it during onboarding. (Note: when a Pro views a job listing, the Owner’s name is shown in a shortened “First L.” form to protect the Owner’s privacy.)

Profile

• Profile photo and cover/banner photo — images you choose for your profile. Why: to identify and present your profile. Source: you upload them (with your permission to access your photos).
• Bio / description, trades and skills, years of experience — a written description, the trades/skills you offer, and your experience. Why: to present your profile and help match you with relevant work. Source: you provide them during onboarding and profile editing. (Pro profiles.)
• Business information — company name, team size, certifications, social links, and insurance status (e.g., liability/WorkSafe). Why: to present your professional credentials and capabilities and to support filtering and quality signals. Source: you provide them. (Pro profiles.) Havé displays certifications, insurance status, and WorkSafe status as reported by Pros. We do not independently verify the accuracy of this information. Owners should conduct their own due diligence before hiring, and Havé is not responsible for the accuracy of credentials displayed on any profile.
• Pricing — your rate type and rate amounts (including any minimum/maximum). Why: to support proposals and matching. Source: you provide them. (Pro profiles.)
• Postal code — your postal code. Why: to display your general service area; it is shown as text and is not used for precise matching. Source: you provide it.
• Work photos / portfolio — images of your previous work. Why: to demonstrate your capabilities. Source: you upload them. (Pro profiles.)
• Rating and review count — an average star rating (0–5) and the number of reviews you’ve received. Why: to provide a public reputation/trust signal. Source: calculated by us from reviews other users leave about you.

Location

• Precise location (latitude/longitude) — the exact coordinates of a project (for Owners) or of a Pro’s location. Why: to calculate distances and match jobs with Pros by proximity. Source: you set it on a map (with your permission to access your location). Your exact location is not shown to the other side of the marketplace. When a Pro views a job, the Owner’s location is shown as an offset/approximate map position (deliberately shifted by roughly 500 metres so it can’t be used to pinpoint an address); when an Owner views a Pro, the Pro’s location is likewise shown as an approximate area, not an exact point. Your exact coordinates are stored in our database and are accessible to our authorized personnel and to the service providers that host and operate the app on our behalf (see Sections 5 and 11), but they are not exposed to other Owners or Pros.
• Approximate / coarse location (city or area) — a city- or area-level description derived from the address. Why: to show a human-readable location in listings without revealing exact coordinates. Source: derived from the address you enter.
• Service radius — the maximum distance you’re willing to travel for work. Why: to define your work availability geographically. Source: you set it. (Pro profiles.)

Photos and media

• Project photos — images of a job or job site. Why: to describe the work visually. Source: you upload them. Project photos are visible to users who can see the job.
• Chat images — images you send in messages. Why: visual communication between an Owner and a Pro. Source: you upload them. Chat images are visible only to the two people in that conversation.
• Media details — file information such as file name, type, size, and image dimensions. Why: to store, display, and cache your images efficiently. Source: collected automatically when you upload an image.

Messages

• Message content — the text you send in conversations. Why: to let an Owner and a Pro communicate. Source: you write it. Messages are visible only to the two people in the conversation.
• Reactions, read receipts, and message status — emoji reactions, “read” timestamps, and unsend/delete markers. Why: to support normal messaging features (reacting, knowing when a message was read, retracting a message). Source: generated when you use these features. Visible only to the two people in the conversation.
• Conversation details — the latest message preview and time, unread counts, and your archive/mute settings. Why: to display your conversation list and manage notifications. Source: generated automatically as you message. Visible only to the two participants.

Reviews

• Reviews you write or receive — a star rating (1–5) and a written description, left after a job. Owners review Pros and Pros review Owners. Why: to provide reputation and quality feedback to the community. Source: you write them. Reviews and the resulting average rating are public to other users on the reviewed person’s profile and in discovery results. The reviewer’s identity is associated with the review.

Jobs, proposals, and matching

• Projects and jobs — project/job details such as name, address, description, budget, timeline, notes, photos, status, and agreed price/dates. Why: to post and manage work. Source: Owners create them. Open jobs are visible to Pros; full details are visible to the Owner and the hired Pro.
• Proposals — a Pro’s quoted price, proposed dates, message, and any counter-offer. Why: to negotiate work terms. Source: Pros submit them. Visible only to the Owner and the Pro involved.
• Interests and matches — interest flags from each side and a match timestamp. Why: to enable two-sided discovery and matching. Source: generated when you express interest. Visible only to the Owner and Pro involved.

Device and push notifications

• Push token, device identifier, and platform — a token used to deliver notifications to your device, a device identifier, and whether you’re on iOS or Android. Why: to send you push notifications and route them correctly. Source: generated by your device/the app when you enable notifications.
• Notification preferences — your per-category notification toggles (messages, proposals, reviews, job updates, matches). Why: to respect your choices about what notifications to receive. Source: you set them in settings.

Safety and moderation

• Message reports — when you report a message, our team may review that message and a reasonable amount of surrounding context (such as recent messages in the same conversation) to investigate the report and take appropriate action. Outside of safety investigations triggered by a report, we do not proactively monitor or read message content. Why: to review and act on abuse or harmful content. Source: you submit a report.
• User blocks — which users you’ve blocked. Why: to prevent unwanted contact and hide blocked users’ content from you. Source: you choose to block.

Diagnostics

• Error and crash diagnostics — technical error reports (such as crash details and the context in which an error occurred). These reports can sometimes include identifiers like your account ID or email if an error happens while you’re signed in. Why: to detect, diagnose, and fix problems so the app works reliably. Source: generated automatically by the app when an error occurs, and sent to our error-reporting provider (Section 5). We do not use this to track you or measure your behaviour for marketing.

Consent records

• Communication-consent timestamp — a record of when you agreed to receive communications from us. Why: to keep proof of your consent as required by Canada’s anti-spam law (CASL). Source: recorded when you give consent at sign-up.

Payments

Havé does not currently process payments between Owners and Pros through the app. No payment card, bank account, or other financial information is collected by us at this time. When we introduce payment processing in the future, we will update this policy before doing so to describe: what financial information is collected, why it is collected, who processes it on our behalf, what security standards apply (including applicable PCI DSS obligations), and how long it is retained. At that time, payment data will be handled by a third-party payment processor; Havé will not store raw payment card numbers.

4. How we use your information

We use your personal information for these purposes:

• To provide the app’s core features — create and secure your account; build your profile; post, discover, and match jobs; send proposals; message; and leave and display reviews.
• To match Owners and Pros — use location (distance) and trades/skills to surface relevant jobs and Pros (see Section 10).
• To communicate with you — send service messages (e.g., about your account, matches, proposals, and messages) and, where you’ve consented, other communications.
• To keep the community safe — handle reports and blocks, and protect against abuse and misuse.
• To maintain and improve reliability — diagnose and fix errors and crashes.
• To meet legal obligations — keep records (such as consent records) and respond to lawful requests.

Consent basis. We rely on your consent to collect and use your personal information for these purposes. Some consent is express — for example, allowing the app to access your location or photos (your device asks you, and you can decline or change it later in your device settings), and agreeing to receive communications from us. Other consent is implied through your use of a feature that obviously requires the information (for example, the text of a message you choose to send so we can deliver it). We identify our purposes at or before the time we collect your information, and we limit our collection to what is necessary for these purposes. We use your information only for the purposes described here or as otherwise permitted or required by applicable law.

Legitimate interests. In limited circumstances, we may also process personal information where we have a legitimate interest in doing so and that interest is not overridden by your privacy rights — for example, to maintain the security and integrity of the app, to detect and prevent fraud and abuse, and to enforce our terms. We may also process personal information where we are required or permitted to do so by law. Where we rely on legitimate interests, we apply a balancing test and will not use your information in ways that are disproportionate to those interests.

5. How we share information

We do not sell your personal information. We share it only as described here.

With other users of the app

Havé is a marketplace, so some information is meant to be seen by others:

• Public to other signed-in users — your display name, profile and cover photos, bio, trades/skills, business info, work photos/portfolio, pricing, postal code (as text), and your average rating and review count. Reviews you write or receive are public on the reviewed person’s profile.
• Owners and Pros see different things about each other. An Owner’s exact location is never shown to Pros — Pros see an approximate, offset map position and a shortened “First L.” name on job listings. A Pro’s exact location is likewise not shown to Owners — Owners see an approximate area. Open job details are visible to Pros; full job, proposal, interest/match, and message details are visible only to the specific Owner and Pro involved.
• Private to the two participants — message content, chat images, reactions, read receipts, conversation details, proposals, and interests/matches.
• Internal only (not shown to other users) — your reports and blocks, notification preferences, push token and device details, password, and consent records.

With service providers (processors) who act on our behalf

We use a small number of trusted service providers to run the app. Each is contractually obligated to use your personal information only to provide its service to Havé, for no other purpose — they do not use your data for their own marketing or any secondary purpose — and to apply protections that are equal to or greater than those described in this policy. They are:

• Hosting and database (Supabase) — stores and manages app data (your account, profile, jobs, messages, reviews, etc.) and powers real-time features. (Supabase, in turn, relies on cloud infrastructure providers.)
• Sign-in providers (Apple and Google) — if you choose “Sign in with Apple” or “Sign in with Google,” that provider authenticates you and shares basic information such as your email (and, depending on the provider and your choices, name) with us. With Apple, you can choose to hide your real email behind a private relay address. These providers handle the information you share with them during sign-in under their own privacy policies, which we don’t control.
• Error and diagnostics reporting (Sentry) — receives crash and error reports to help us keep the app reliable. These reports can occasionally contain identifiers (such as your account ID or email) when an error happens in a signed-in context.
• Push notification delivery (Apple Push Notification service and Google Firebase Cloud Messaging, via Expo) — delivers push notifications to your iOS and Android devices respectively. We send the notification content and your device’s push token to Expo’s push service, which routes it to Apple’s or Google’s notification infrastructure depending on your device.

For legal and safety reasons

We may disclose personal information if required by law, to respond to lawful requests, to enforce our terms, or to protect the rights, safety, and property of our users, the public, or us.

6. Where your information is stored (cross-border transfers)

Your personal information may be stored and processed outside your province and outside Canada — including in the United States — by us and by the service providers listed in Section 5. In particular, the following service providers may store or process your information in the United States:

• Supabase (hosting and database) — your account, profile, jobs, messages, reviews, and related data;
• Sentry (error and crash diagnostics) — error reports, which can include identifiers such as your account ID or email in a signed-in context; and
• Expo (push notification delivery) — the notification content and your device’s push token.

These transfers are governed by data processing agreements that require comparable safeguards to those under Canadian law, including encryption, access controls, and contractual limits on how the providers may use the information.

When personal information is stored or processed in another country, it is subject to the laws of that country. This means foreign courts, law enforcement, and government authorities may be able to access it under the laws that apply where it is held, even though we and our providers apply contractual and technical safeguards intended to protect it.

By using Havé, you understand that your information may be transferred to, and stored and processed in, jurisdictions outside Canada as described above. If you have questions about cross-border handling, contact our Privacy Officer (Section 13).

7. Push notifications and electronic messages (CASL)

We send push notifications and may send other electronic messages (such as emails) related to the app. We send these with your consent, and we keep a record of when you consented.

Transactional vs. marketing messages. Some messages are transactional — essential service communications needed to operate your account, such as account and security alerts, messages from other users, match and proposal notifications, and job updates. These are sent as part of providing the app and do not require separate marketing opt-in. Marketing or promotional messages (for example, news, tips, or offers) are sent only with your express consent, which you can withdraw at any time.

How we record consent. When you agree to receive communications at sign-up, we record the fact and the date/time of your consent. As required by CASL, we retain proof of consent for 3 years following the end of our business relationship with you.

You can control or turn these messages off at any time:

• In the app — open notification settings and adjust the per-category toggles (for example, messages, proposals, reviews, job updates, and matches).
• On your device — turn off notifications for Havé in your device’s system settings.
• For emails — use the unsubscribe option in the message, or contact us (Section 13).

Unsubscribe is simple. Email unsubscribe links are clear, prominent, and do not require you to log in. As required by CASL, we honour all opt-out requests promptly and in no case more than 10 business days after we receive them.

Turning off marketing or optional messages won’t stop essential transactional service messages needed to operate your account.

8. Data retention and deletion

We keep your personal information only as long as needed for the purposes described in this policy, to provide the app to you, and to meet our legal obligations. The table below sets out our standard retention periods for each category of personal information. When the retention period expires, we delete or de-identify the information securely.

Revoking consent for specific uses. You can revoke your consent for individual data uses at any time:

• Location and photos — change the permission in your device’s system settings — the app stops accessing that data going forward.
• Communications — opt out using the in-app notification toggles or the email unsubscribe link (Section 7).

Withdrawing consent may limit or end your ability to use parts of the app that depend on that information.

Reviews. Reviews you have written are linked to the reviewed person’s profile and contribute to their reputation on the app. When you delete your account, we may retain reviews you wrote, because removing them would deprive the reviewed person of their reputation record and disrupt the integrity of the marketplace. The reviewer’s identity (your display name) remains associated with retained reviews. If you believe a review you wrote or received contains inaccurate information, or was submitted in violation of our terms, you may request its correction or removal by contacting our Privacy Officer (Section 13). We will assess such requests and respond within 30 days.

Legal holds. Notwithstanding the retention periods above, if personal information becomes relevant to a dispute, legal proceeding, regulatory inquiry, or internal investigation, we may be required or permitted by law to retain it beyond those periods until the matter is resolved and any applicable limitation period has expired.

Deleting your account. You can delete your account yourself, directly in the app: Settings → Delete Account. This erases your personal information from our active systems — your profile, your projects and jobs and their proposals, your messages, your notifications, your saved device push tokens, and your blocks are removed automatically when you confirm deletion. Reviews you wrote may be retained as noted above. Information held in backups, or that we are required or permitted by law to keep (for example, consent records), is removed or expires according to our backup and legal-retention practices; backup copies are overwritten on our regular backup cycle.

Because Havé is a two-sided marketplace, note that content you shared with another user during your use of the app — for example, the messages in a conversation — may remain visible to that other user even after you delete your account or unsend an individual message on your side, except where the law requires us to remove it. If you need such content removed, contact our Privacy Officer (Section 13).

If you’d prefer, you can also ask us to delete your information by contacting our Privacy Officer (Section 13). We may need to verify your identity first, and we may keep limited information where the law requires or permits it (for example, consent records).

9. Your privacy rights

Subject to the law, you have the right to:

• Access — the personal information we hold about you and learn how it has been used and to whom it has been disclosed;
• Correct — information that is inaccurate or incomplete;
• Withdraw your consent — (for example, by turning off location or photo access in your device settings, opting out of communications, or asking us to stop a particular use) — note that withdrawing consent may limit or end your ability to use parts of the app;
• Delete — your information (see Section 8); and
• Data portability — request a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format (for example, CSV or JSON). We will provide this within 30 days of receiving your request.

To exercise any of these rights, contact our Privacy Officer (Section 13). We may ask you to verify your identity. We will respond within the timeframe required by applicable law — generally within 30 days of receiving your request. Access is provided at little or no cost; if a fee could apply, we’ll tell you in advance. If we can’t fulfil a request (for example, where the law allows us to refuse), we’ll explain why and how you can respond.

10. Matching and automated decision-making

Havé uses automated matching to help connect Owners and Pros. In particular, the app uses distance (how close a job is to a Pro, based on location) and trades/skills to decide which jobs to show which Pros, and which Pros to surface to Owners. This affects what you see in discovery and which matches are suggested.

No profiling beyond distance and skills. Our matching does not currently build a behavioural profile of you or use predictive scoring (for example, predicting your reliability or your likelihood to accept certain jobs) beyond distance-to-job and trades/skills relevance. If we add profiling or predictive features in the future, we will update this policy and, where required, obtain your consent.

Not a binding decision. This matching helps you find relevant work and contractors — it does not by itself hire anyone, set a price, or make a binding decision about you. People on both sides decide whether to express interest, send proposals, and hire.

Right to information and human review. Where the law gives you the right to be informed about a decision based exclusively on automated processing, or to request a human review of it, we will honour that right. If you’d like more information about how matching uses your information, or you believe a matching result is wrong or unfair, contact our Privacy Officer (Section 13). We will review the relevant logic and context and respond within the timeframe required by applicable law (generally within 30 days).

11. Security and breaches

We use security safeguards appropriate to the sensitivity of the information, including:

• —encryption of personal information in transit;
• —authentication and access controls — including row-level access rules in our database so each user can reach only the data they’re permitted to, and limits on which of our personnel and which systems can access personal information;
• —private storage with short-lived, signed links for sensitive images (such as project photos and chat images), so they aren’t openly accessible; and
• —contractual safeguards with our service providers (Section 5).

Some information is more sensitive — for example, your exact location, your photos, and your messages. We apply the access controls and private-storage measures above to that information specifically, and we restrict access to authorized personnel and processors who need it to operate the app.

No method of storage or transmission is completely secure, so we can’t guarantee absolute security. If a privacy breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada promptly after we determine that the breach creates a real risk of significant harm — the Office of the Privacy Commissioner of Canada expects this to happen as soon as reasonably possible after the breach is confirmed. We will keep records of all breaches (whether or not they meet the notification threshold) for a minimum of 24 months, as required by PIPEDA’s Breach of Security Safeguards Regulations.

12. Children

Havé is not directed to, or intended for use by, anyone under 18. We do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact our Privacy Officer (Section 13) and we will take appropriate steps to delete it.

13. Privacy Officer and how to contact us

Our Privacy Officer is responsible for our compliance with this policy and applicable privacy laws, and is your contact for questions, access or correction requests, withdrawal of consent, complaints, and challenges to our privacy practices:

For general support questions (not privacy-specific), you can reach us at hello@haveexpert.com.

We’ll work with you to resolve any concern, and we aim to respond to privacy requests within 30 days. If you’re not satisfied with how we’ve handled your privacy concern, you have the right to complain to a privacy regulator:

• ⚖All Canadian residents — may contact the Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• ⚖British Columbia residents — may also contact the Office of the Information and Privacy Commissioner for BC — www.oipc.bc.ca
• ⚖Alberta residents — may also contact the Office of the Information and Privacy Commissioner of Alberta — www.oipc.ab.ca

14. Business transfers

If Have Group LTD. is involved in a merger, acquisition, amalgamation, asset sale, reorganization, or insolvency or bankruptcy proceeding, your personal information may be transferred to or reviewed by the successor entity, acquirer, investor, creditor, or administrator as part of that transaction or process.

We will notify you — by updating the effective date and relevant sections of this policy and, where reasonably practicable, by notice in the app or by email — before your personal information is transferred and becomes subject to a materially different privacy policy or practice.

Any successor who receives your personal information as part of such a transaction will be required to honour the commitments made in this policy or to obtain your fresh consent if they wish to use your information for materially different purposes. If a transaction does not complete, we will require the other party to return or securely destroy any personal information shared for due diligence purposes.

15. Changes to this policy

We may update this policy from time to time. If we make a material change (for example, to the information we collect, how we use it, or who we share it with), we’ll update the effective date above and, where appropriate, notify you in the app or by other reasonable means. Your continued use of Havé after a change takes effect means you’ve reviewed the updated policy. We encourage you to review it periodically.