Privacy Policy
Version 2.0 | Effective Date: June 15, 2026 | Last Updated: June 15, 2026
1. Data controller
This policy describes how DiasporaBuild [LEGAL FORM TO BE COMPLETED], registered under number [REGISTRATION NO. TO BE COMPLETED], registered office [ADDRESS TO BE COMPLETED] ("DiasporaBuild", "we"), processes your personal data when you use the diasporabuild.com platform and its related services (construction matchmaking, Escrow, FUNDI Studio, Community, Directory, materials marketplace).
We process your data in accordance with the General Data Protection Regulation (GDPR — Regulation EU 2016/679) and the French Data Protection Act.
Data protection contact (DPO): privacy@diasporabuild.com
2. Data we collect
2.1 Data you provide
- Identity and account: name, email, phone (including WhatsApp number where applicable), password (hashed), language, country, profile photo.
- Professional profile (Contractors, Inspectors, Suppliers, Architects): company name, trade, specialties, service area, verification documents (ID, professional liability / structural warranty insurance certificates, licences, references), portfolio.
- Project data: site location, budget, plans, site photos and videos (potentially geotagged), progress reports, quotes, contracts, messaging exchanges.
- Community content: stories, photos, comments, reviews and ratings.
- Payment data: transaction history, milestones, invoices. Card and mobile-money data are collected directly by our payment providers (Stripe, pawaPay) and never pass through our servers.
- Support: content of your support requests.
2.2 Data collected automatically
- Connection and usage data (IP address, device and browser type, pages visited, timestamps);
- Cookies and similar technologies, managed through our consent tool (see Section 8);
- Technical security logs.
2.3 Data from third parties
- Google sign-in (name, email, photo) if you choose Google authentication;
- Publicly available professional data for the Directory (see Section 9).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and management, provision of services (projects, Escrow, matchmaking, FUNDI Studio) | Performance of the contract |
| Professional verification (KYC, insurance, licences) | Performance of the contract / legitimate interest (trust and fraud prevention) |
| Payment processing and fraud prevention | Performance of the contract / legal obligation |
| Plan generation and AI features | Performance of the contract |
| Community, reviews and Directory | Performance of the contract / legitimate interest |
| Transactional emails (verification, milestones, project notifications) | Performance of the contract |
| Nurturing emails, newsletters, reminders | Consent / legitimate interest (marketing to existing customers), with right to object at any time |
| Service improvement, statistics, security | Legitimate interest |
| Accounting and tax obligations | Legal obligation |
| Responding to requests from authorities | Legal obligation |
4. Recipients and processors
Your data is accessible to our authorised staff and, to the extent strictly necessary, to our processors:
- Stripe — card payments (PCI-DSS certified);
- pawaPay — mobile-money payments in Africa;
- Resend — transactional emails and notifications;
- Cloudflare R2 — file storage (site photos, plans, documents);
- MongoDB — application database;
- OpenAI / Google (Gemini) — AI features (plan generation, assistants). Content submitted to AI is limited to what is necessary;
- Google — social sign-in (if used);
- Cloud hosting and infrastructure: [HOSTING PROVIDER TO BE COMPLETED].
The complete, up-to-date list of processors is set out in our DPA.
Your project data is also shared with the professionals working on your project (and vice versa), to the extent necessary for the project.
We never sell your personal data.
5. Transfers outside the European Union
The very nature of DiasporaBuild (diaspora building in Africa) involves data transfers outside the EU/EEA:
- To professionals located in the countries of construction (Côte d'Ivoire, Senegal, Cameroon, Nigeria, Kenya, etc.), limited to data necessary for the project;
- To our processors located in the United States or other third countries.
These transfers are governed by appropriate safeguards: European Commission Standard Contractual Clauses (SCCs), adequacy decisions (including the EU-US Data Privacy Framework for certified providers), and supplementary measures. You may obtain a copy of the applicable safeguards by writing to privacy@diasporabuild.com.
6. Retention periods
| Data | Retention |
|---|---|
| Account and profile | Life of the account + 3 years after last activity |
| Project data (plans, reports, photos) | Project duration + 5 years (contractual evidence) |
| Professional verification documents | Duration of partnership + 5 years |
| Invoices and transaction data | 10 years (accounting obligation) |
| Legal document acceptances (timestamp, IP) | 5 years after end of relationship |
| Public Community content | Until deleted by the author or account closure (may be anonymised) |
| Technical and security logs | 12 months |
| Marketing (emails) | 3 years after last contact, or until consent withdrawal |
At the end of these periods, data is deleted or anonymised.
7. Your rights
Under the GDPR, you have the following rights: access, rectification, erasure, restriction, portability, objection (in particular to marketing), the right to set post-mortem directives and to withdraw your consent at any time.
To exercise your rights: privacy@diasporabuild.com or from your account settings. We respond within one (1) month. Proof of identity may be requested in case of reasonable doubt.
You may lodge a complaint with the CNIL (www.cnil.fr) or the supervisory authority of your country of residence.
8. Cookies
We use cookies:
- Essential (authentication, security, language preferences) — exempt from consent;
- Analytics and improvement — subject to your consent;
- Marketing — subject to your consent.
You can change your choices at any time via the "Cookies" link in the footer.
9. Professional Directory and public data
The DiasporaBuild Directory lists construction professionals from publicly available sources (websites, public registers and directories), based on our legitimate interest in facilitating connections in the African construction sector.
Data concerned: business name, trade, specialties, city/country, public professional contact details.
Any listed professional may at any time: claim their listing, correct it, or request its removal (opt-out) via the listing itself or by writing to privacy@diasporabuild.com. Removal is carried out without undue delay.
10. Security
We implement appropriate technical and organisational measures: TLS encryption in transit, password hashing (bcrypt), secure token authentication (httpOnly cookies), role-based access control, environment segregation, backups, logging and monitoring. Details are available on our Security & Insurance page.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you and the CNIL under the conditions of Articles 33 and 34 GDPR.
11. Minors
The Platform is reserved for persons aged 18 and over. We do not knowingly collect data from minors.
12. Changes
We may update this policy. In the event of a material change, you will be informed by email or notification at least thirty (30) days before it takes effect.
13. Contact
- Data Protection Officer: privacy@diasporabuild.com
- General support: support@diasporabuild.com
- Address: DiasporaBuild, [ADDRESS TO BE COMPLETED]
Related documents: Terms of Service · DPA · Refund Policy · Security & Insurance