Privacy Policy
Draft. This policy is under legal review and may change.
Last updated: [EFFECTIVE_DATE] Version 1.0
In short: CSI collects the information you give us (such as your account details, job posts, messages, documents and orders), some information automatically (such as your IP address and, if you allow it, your location), and information from partners such as PayPal and our identity-check provider. We use it to run the platform, keep it safe, process payments and meet legal duties. We share it with other users only as the platform needs (for example, your profile or your job post), and with service providers who work for us. We do not sell your personal data, and we do not use advertising cookies. We also record how a Pro found CSI, such as a salesperson's promo code, so we can attribute the sign-up and pay commission. For sellers, our provider Veriff checks your ID and a selfie, which involves biometric data, only with your consent. You have rights to access, correct, delete and more, depending on where you live. Email info@csieliteservices.com to use them. This summary is not part of the policy below.
1. Who we are
1.1. The controller of your personal data is CSI ELITE SERVICES, LLC, a Florida limited liability company, 604 Banyan Trl, Boca Raton, FL 33481, USA (mailing: PO Box 812332), email info@csieliteservices.com, telephone (833) 274-3425 ("CSI", "we", "us").
1.2. EU representative. Our representative in the European Union under Article 27 of the General Data Protection Regulation (GDPR) is [EU_REPRESENTATIVE]. You may contact our representative instead of, or as well as, us about any data protection matter.
1.3. This Privacy Policy explains how we handle personal data when you use csieliteservices.com and related services (the "Platform"). Words defined in the Terms of Service have the same meaning here.
1.4. Other users are separate controllers. When a Pro or Seller receives your personal data through the Platform (for example, your address for a Job, or your shipping details for an order), they decide how to use it for their own business and are responsible for it under data protection law. Our Pro Terms and Seller Terms limit how they may use it.
2. The personal data we collect
2.1. Data you give us
| Category | Examples |
|---|---|
| Account data | Name, email, password (stored hashed), phone number, role (Homeowner or Pro), language, account settings |
| Pro profile data | Business name, photo, cover image, description, website, public phone and email, years in business, languages, categories, service area (cities, base location and travel radius), availability and meeting types |
| Verification documents | Licence, insurance and identity documents, document numbers, issuers and expiry dates, evidence of third-party background checks |
| Seller verification data | Business registration number and certificate, connected PayPal account details, and the result of the identity check (see Section 4) |
| Lead source (Pros) | How you told us you found CSI when you registered: a salesperson's promo code, search engine, social media, online advertisement, friend or family, or other (free text) |
| Job and booking data | Job posts, category, description, location, address (if you choose to share it), photos and videos (we remove embedded location metadata from photos), preferred timing, Bids, comments, booking details and notes |
| Communications | Chat messages and attachments, Q&A, contact-form messages, emails to us |
| Reviews and ratings | Reviews, star ratings, photos, replies, ratings that Pros give Homeowners |
| Orders and payments | Items bought, shipping and billing address, pickup choice, order history, invoices, gift card details (including recipient name, email and message), points, credit and referral records. Card or bank details are handled by PayPal; we receive confirmation of payment, your PayPal payer ID and email, and limited transaction details |
| Feedback | "Rate us" survey answers, blog comments and likes |
2.2. Data we collect automatically
| Category | Examples |
|---|---|
| Device and log data | IP address, browser and device type, operating system, pages viewed, dates and times, referring page, error logs |
| Cookies | Essential cookies, the rewards referral cookie and the lead-source cookie described in the Cookie Policy |
| Referral and attribution data | A promo code you followed or entered, UTM source, medium and campaign parameters, the landing page you arrived on, and the date and time of your first visit, kept for 90 days as described in the Cookie Policy |
| Location | Approximate location from your IP address. Precise location from your device's GPS only if you click "Use my location" and your browser asks for and receives your permission. We use it to find your nearest city and store the point with your search or Job |
| Acceptance records | The version of each legal document you accepted, with date, time, IP address, browser and language |
| Notifications | Web push subscription details if you turn on push notifications |
2.3. Data we receive from others
| Source | Data |
|---|---|
| Google or Facebook (if you sign in with them) | Name, email address, profile picture and account identifier, as allowed by your settings with them |
| PayPal | Payment status, payer ID, name, email, shipping address you choose in PayPal, subscription status, refunds and disputes; for Sellers, whether your PayPal account is verified and its name |
| Veriff (identity checks) | The result of the check (approved, declined, resubmission needed), the reason, the session identifier and date |
| Shipping carriers and our dropshipping supplier | Shipping status and tracking information |
| Other users | Information about you in reviews, ratings, messages, Bids, Job posts or reports |
| Public records | Licence and business registration status that our staff look up to check documents |
3. Sensitive personal data
3.1. Some data we process is "sensitive" or "special category" data under some laws:
(a) identity documents and government identification numbers (Pro and Seller verification); (b) biometric data, processed by Veriff during Seller identity checks (Section 4); (c) precise geolocation, if you use "Use my location"; and (d) background check information that Pros choose to give us.
3.2. We process sensitive data only for the purposes described in this policy, with your consent where the law requires consent, and we do not use it to infer characteristics about you or for advertising. We do not sell or share it for advertising.
4. Biometric data (Seller identity checks)
4.1. What. When a Pro applies to open a shop, our provider Veriff asks the Pro to photograph an identity document and take a live selfie video or photo. Veriff uses facial recognition technology to compare the face in the selfie with the photo on the document, to check that the person is live and present, and to check the document's authenticity. This involves creating and using biometric identifiers and biometric information (such as face geometry).
4.2. Why. The only purpose is to confirm the identity of Sellers and to prevent fraud in pro shops, including screening against watchlists.
4.3. Consent. Before the check starts, we show this notice and ask for your separate, explicit written consent by an unticked box that you must tick. If you do not consent, you cannot open a shop, but you can still use the rest of the Platform.
4.4. Who holds it. Veriff processes the biometric data on our behalf. CSI receives and stores only the result of the check, the reason, the session identifier and the date. CSI does not receive or keep your face geometry.
4.5. Retention and destruction. Biometric data is permanently destroyed by Veriff, on our instructions, within [VERIFF_RETENTION_PERIOD] after the check is completed, and in any case at the earliest of: (a) when the purpose of collecting it has been satisfied; (b) one year after the check is completed; or (c) any earlier date required by law. We publish this retention schedule here as required by law.
4.6. No sale or profit. We do not and will not sell, lease, trade or otherwise profit from biometric data. We disclose it only to Veriff as our processor, or where required by law or valid legal process.
4.7. Security. Biometric data is stored and transmitted using a reasonable standard of care, at least as protective as the way we protect other confidential and sensitive data.
5. How we use personal data, and our legal bases
The GDPR (and similar laws) require a legal basis for each use. The table shows our purposes and legal bases.
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, and sign you in (including via Google or Facebook) | Contract |
| Show Pro profiles, match Jobs with Pros by category and location, deliver comments, Bids, chat and Bookings | Contract |
| Review Job posts, profiles, documents and products before publication, and show Verification Badges | Legitimate interests (keeping the Platform safe and trustworthy); for identity documents, also contract |
| Seller identity checks including biometric data | Explicit consent (Article 9(2)(a)); legitimate interests in fraud prevention for the non-biometric parts |
| Use your precise location to find your nearest city | Consent (you can refuse in your browser) |
| Take payments, run subscriptions, send invoices, process orders, shipping, pickup, returns and refunds | Contract; legal obligation (tax and accounting records) |
| Gift cards, rewards points and referrals | Contract |
| Record how a Pro found CSI, attribute a registration to a salesperson or marketing channel, and pay salesperson commission | Legitimate interests (running our salesperson programme and business administration); contract |
| Send service messages (account, security, booking reminders, renewal reminders, order updates) | Contract; legal obligation (renewal notices) |
| Send notifications you choose (email, on-site, web push) | Contract; consent for web push |
| Send news and offers about CSI | Consent, or legitimate interests where the law allows email marketing to existing customers (you can opt out at any time) |
| Publish reviews, replies, Q&A; show Pros' ratings of Homeowners to Pros | Legitimate interests (helping users make informed choices) |
| Detect and prevent fraud, abuse, spam and security incidents; enforce our terms; review reports and messages for safety and disputes | Legitimate interests; legal obligation |
| Keep records of your acceptance of legal documents | Legitimate interests; legal obligation |
| Answer questions, complaints and requests | Contract; legitimate interests |
| Improve and fix the Platform | Legitimate interests |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
5.1. Messages. We do not read your private messages in the normal course of business. Authorised staff may review messages and related records when a message is reported, when needed to investigate fraud, safety issues or a dispute, or when required by law.
5.2. Automated decisions. Some decisions are made automatically: matching Jobs to Pros, removing a badge when a document's expiry date passes, the identity check result, and pausing a shop when report or dispute thresholds are reached. A failed identity check can be retried once and is then reviewed by a person, and any shop pause can be reviewed by a person on request. You can ask for human review, express your view and contest an automated decision by emailing info@csieliteservices.com.
6. How we share personal data
6.1. With other users, as the Platform needs.
(a) Pro profiles, reviews, replies, Q&A and Seller product listings are public. (b) Job posts are visible only to the Homeowner who posted them and to matching approved Pros on Pro Elite. Pros see the Homeowner's first name and city. (c) A Homeowner's phone number and email are shown to a Pro only after the Homeowner accepts that Pro's Bid or makes a Booking with that Pro. A Homeowner's address is shared with a Pro only when the Homeowner chooses. (d) Ratings that Pros give Homeowners are shown to Pros only, as an average. (e) When you buy from a Seller, the Seller receives your name, shipping address, order details and messages. (f) Bids are visible only to the Homeowner and the Pro who placed them. (g) If a salesperson's promo code is linked to your registration, that salesperson sees in their own dashboard only your business name, city and status (such as whether your registration fee was paid and your documents were approved). They do not see your documents, contact details or any other personal data.
6.2. With service providers (processors) who act on our instructions under contracts that protect your data (Section 7).
6.3. With PayPal to process payments, subscriptions, refunds and disputes. When you pay a Seller, PayPal processes the payment for the Seller.
6.4. With authorities and others where required: to comply with law, a court order or lawful request; to protect the rights, property or safety of CSI, users or the public; or to prevent fraud.
6.5. Business transfers: in connection with a merger, sale of assets, financing or reorganisation, under confidentiality obligations, with notice to you where the law requires.
6.6. With your consent or at your direction.
6.7. We do not sell personal data, and we do not share personal data for cross-context behavioural advertising or targeted advertising. We have not done so in the last 12 months.
7. Our service providers
| Provider | What they do | Data involved |
|---|---|---|
| PayPal | Payments, subscriptions, refunds, Seller payouts, Seller PayPal verification | Payment, identity and contact data |
| Veriff | Seller identity and liveness checks, watchlist screening | Identity document, selfie, biometric data, result |
| CJ Dropshipping | Fulfilment of supplier-shipped orders | Name, shipping address, phone, order details |
| EasyPost | Shipping rates and labels (United States) | Name, address, phone, parcel details |
| Aramex, DHL, FedEx | Shipping rates, labels and delivery | Name, address, phone, parcel details |
| Google and Facebook | Sign-in, if you choose it | Account identifier, name, email |
| Jitsi (meet.jit.si) | Video meetings, when you join a meeting link | Name you enter, IP address, audio and video during the call |
| Google Fonts | Web fonts | IP address and browser details, if fonts are loaded from Google's servers |
| [EMAIL_PROVIDER] | Sending emails | Name, email, email content |
| [HOSTING_PROVIDER] | Hosting the Platform and storing data | All data stored on the Platform |
We may change providers. We will update this list when we do.
8. International transfers
8.1. CSI is based in the United States, and the Platform is hosted in [HOSTING_LOCATION]. Your data is processed in the United States and in the countries where our providers operate, which may have data protection laws different from those of your country.
8.2. When we transfer personal data from the European Union to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, or rely on a provider's certification under the EU-US Data Privacy Framework, or another lawful mechanism. When we transfer data from the United Arab Emirates, Qatar or Jordan, we use the safeguards those laws require, such as contractual protections, or rely on your consent where the law allows. You can ask us for a copy of the relevant safeguards.
9. How long we keep data
| Data | How long |
|---|---|
| Account and profile data | While your account is open. When you delete your account, we delete or anonymise it within [ACCOUNT_DELETION_PERIOD], except as below |
| Jobs, Bookings, reviews, messages | While either party's account is open, because they form the other party's history. When you delete your account, your name is replaced with "Former member" and reviews are anonymised |
| Pro verification documents | While your Pro account is open, then for [DOCUMENT_RETENTION_PERIOD] |
| Identity check results (no biometric data) | While your shop is open, then for [DOCUMENT_RETENTION_PERIOD] |
| Biometric data (held by Veriff) | See Section 4.5 |
| Orders, payments, invoices, tax records | As long as tax and accounting laws require (generally up to 7 years in the United States and up to 10 years for some records in Germany) |
| Records of acceptance of legal documents and auto-renewal consent | For as long as the agreement lasts and for the limitation period afterwards, and at least 3 years after a plan ends |
| Precise location points | With the Job or search they relate to; deleted or anonymised when the account is deleted |
| Logs and security records | [LOG_RETENTION_PERIOD] |
| Backups | Overwritten within [BACKUP_RETENTION_PERIOD] |
| Data needed for a legal claim or investigation | Until it is resolved |
10. Security
We use reasonable technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, private storage for documents with access limited to authorised staff, role-based access controls and rate limits. No system is completely secure. If a breach affects your data, we will notify you and the authorities as the law requires.
11. Children
The Platform is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Your choices
12.1. You can update most account data in your settings, choose which notifications you get and by which channel, and unsubscribe from marketing emails using the link in each email.
12.2. You can refuse or withdraw location permission in your browser. You can turn off push notifications in your browser or device.
12.3. You can delete your account in your settings.
13. Your rights
13.1. Everyone
You can ask us to access, correct or delete your personal data. We will respond as required by the law that applies to you. We may need to keep some data for the reasons in Section 9.
13.2. Residents of US states with privacy laws
Depending on the state where you live (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), and subject to the thresholds and exceptions in those laws, you may have the right to:
(a) know what personal data we collect, use and disclose, and access a copy in a portable format; (b) correct inaccurate personal data; (c) delete personal data; (d) opt out of the sale of personal data, targeted advertising and profiling that produces legal or similarly significant effects (we do not do any of these); (e) limit the use of sensitive personal data (we use it only for purposes allowed without this right); (f) not be discriminated against for exercising your rights; and (g) appeal our decision on your request.
California notice at collection. In the last 12 months we have collected the categories of personal information described in Section 2: identifiers; customer records; commercial information; internet and network activity; geolocation data; audio and visual information (photos, videos and meeting audio and video, which passes through Jitsi); professional information (licences and business details); and sensitive personal information (government identifiers, biometric information for Sellers, precise geolocation). We collect it from the sources in Section 2 for the purposes in Section 5, disclose it to the categories of recipients in Sections 6 and 7, and keep it for the periods in Section 9. We do not sell or share it.
Global Privacy Control. We treat a browser Global Privacy Control signal as a request to opt out of sale and sharing. Because we do not sell or share personal data, this does not change how the Platform works.
13.3. European Union and Germany
Under the GDPR you have the right to: access your data; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests (including profiling) and to direct marketing at any time; withdraw consent at any time, without affecting earlier processing; and not be subject to a decision based solely on automated processing that significantly affects you, with the right to human review. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you live or work or where an alleged breach occurred.
13.4. United Arab Emirates
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may have the right to: obtain information about the processing of your data; receive a copy (data portability); correct or delete your data; restrict or stop processing; object to automated processing that has legal or serious consequences for you; and withdraw consent. You may complain to the UAE Data Office.
13.5. Qatar
Under Law No. 13 of 2016 on Personal Data Privacy Protection, you may have the right to: withdraw consent; object to processing that is not necessary or is excessive, discriminatory or unlawful; ask to remove or correct your data; be notified of processing and of disclosures of inaccurate data; and access your data. You may complain to the competent authority in Qatar.
13.6. Jordan
Under the Personal Data Protection Law No. 24 of 2023, you may have the right to: know about and access your data; correct, complete or update it; ask for erasure; restrict or object to processing; withdraw consent; be informed of a breach affecting your data; and ask for your data to be transferred. You may complain to the Personal Data Protection Council.
14. How to exercise your rights
14.1. Email info@csieliteservices.com with the subject "Privacy request", or write to us at 604 Banyan Trl, Boca Raton, FL 33481, USA (mailing: PO Box 812332). Say which right you want to use.
14.2. We will verify your identity, usually by asking you to confirm from your account email, and may ask for more information if needed. An authorised agent may make a request for you with your signed permission, and we may ask you to confirm your identity directly.
14.3. We will respond within the time the law that applies to you requires (for example, one month under the GDPR, which may be extended by two months for complex requests, and 45 days under most US state laws, which may be extended once by 45 days).
14.4. Appeals (US). If we decline your request, you may appeal by replying to our decision with the subject "Privacy appeal". We will respond within the time required by your state's law. If you are not satisfied, you may contact your state Attorney General.
14.5. We do not charge for requests unless they are manifestly unfounded or excessive, where the law allows a fee.
15. Third-party sites and services
Links to other websites and services (including PayPal, Jitsi, Google and Facebook) are governed by their own privacy policies.
16. Changes to this policy
We may update this policy. We will post the new version with a new date and version number, and for material changes we will notify you by email or on the Platform before they take effect.
17. Contact
CSI ELITE SERVICES, LLC, 604 Banyan Trl, Boca Raton, FL 33481, USA (mailing: PO Box 812332). Email: info@csieliteservices.com. Telephone: (833) 274-3425. EU representative: [EU_REPRESENTATIVE].