Privacy Policy

1 Who We Are

SkillLink (skilllinkmw.com) is a Malawi-based online marketplace connecting buyers with verified local service providers. Our privacy contact is privacy@skilllinkmw.com. This policy applies to our website, web application, and all associated tools (collectively, "the Platform").

2 Data We Collect

From Sellers (Service Providers)

• Account Data: Full name, business name, email, phone/WhatsApp number, hashed password, registration date.
• Profile Data: Service category, bio, skills, experience, pricing, location (city/area), profile photo, and portfolio images.
• Google Account Data (if using Google Sign-In): Name, email, and profile picture via Google OAuth 2.0. We access only email, profile, and openid scopes. We do not access Gmail, Drive, Calendar, Contacts, or any other Google services.
• WhatsApp Verification: Link-based phone verification delivered on WhatsApp to award a verified badge. We store verification status only, not the links.
• Subscription & Payment Data: Subscription status, payment dates, and transaction references via PayChangu. We never store raw card or banking credentials.
• Performance Data: Profile views, WhatsApp button clicks, enquiry counts, and review scores — used in your seller dashboard and weekly email reports.
• How You Found Us: When you register, we ask how you heard about Skill Link (e.g. Facebook, TikTok, word of mouth). This is used only for internal marketing analysis.

From Buyers

• Location Data: The city or district you select when browsing, logged to show you relevant local providers and to help us understand audience geography.
• Browsing Behaviour: Service categories you view, seller profiles you browse, search queries you type, time spent on pages, and listings you save. This data is used to personalise your experience, suggest relevant listings, and improve the platform.
• WhatsApp Contact Clicks: When you click a seller's WhatsApp button, we log that event against the seller's profile. This is not tied to your personal identity — it lets sellers see how many people expressed interest in them.
• Device & Technical Data: Browser type, anonymised IP address, operating system, and referring URL (e.g. Facebook, TikTok, Google) — used for security, performance, and understanding which marketing channels bring buyers to the platform.
• Optional Account Data: Name and email if you create a buyer account. A buyer account is not required to browse, but is required to view WhatsApp contact details.

3 How We Use Your Data

• Platform operation: Managing accounts, processing payments, verifying sellers, and enabling buyer-seller connections.
• Personalisation: Your location, browsing history, and saved listings are used to recommend relevant local providers and surface listings most likely to match your needs.
• Suggested listings: We use categories you have browsed and profiles you have viewed to surface similar providers you may not have found yet.
• Seller analytics: Sellers see their profile views, WhatsApp click counts, buyer geography, and review scores in their dashboard and weekly email reports.
• Platform reporting: Aggregated, anonymised browsing signals (category demand, district activity, device type, traffic sources) power our monthly admin intelligence reports used to improve the platform.
• AI chatbot: Your questions are processed by Google Gemini API to generate answers. Questions are logged anonymously to improve FAQ content. No personal account data is sent to Gemini.
• Marketing: Aggregated, anonymised audience data may inform our own Facebook or TikTok advertising campaigns. No personally identifiable data is shared with any ad platform.
• Legal and safety: Fraud detection, Terms enforcement, and compliance with applicable Malawian law.

4 Buyer Behaviour & Personalisation

To improve your experience and help you find the right service provider faster, we collect the following browsing signals:

• District / location: The city or district you select in the browse filter.
• Categories and search queries: The service categories you browse and any search terms you type — used to surface better results and suggest similar providers.
• Profile views: Which seller profiles you view. We use this to recommend similar providers in the same category and location, and to show sellers aggregate audience interest data (never identifying individual buyers).
• WhatsApp click events: Whether you clicked a seller's WhatsApp contact button, logged at the platform level to give sellers visibility of their enquiry volume.
• Saved listings: Providers you have saved, used to personalise your browse experience and allow you to revisit shortlisted providers.
• Engagement signals: Whether you stayed on a page for 30 or more seconds, used as a signal of genuine interest to improve recommendation quality (not to identify you personally).
• Device type: Whether you are on a mobile phone, tablet, or desktop — detected automatically from your browser.
• Referral source: The channel that brought you to Skill Link (e.g. a TikTok link, a Facebook post, a Google search, or a direct visit) — used to understand which marketing channels are working and to improve our campaigns.

All browsing data is linked to an anonymous session identifier (not your name or email), unless you create an account. This data is used in aggregate and is never sold or shared with advertisers. You can clear your browser cookies at any time to reset session tracking.

5 Seller Analytics & Performance Data

Sellers have access to a live dashboard and weekly email reports showing how their profile is performing. The following data points are tracked and shown to sellers:

• Profile views: How many times your profile page was visited, broken down over time.
• WhatsApp click-throughs: How many visitors clicked your WhatsApp contact button, and the conversion rate from view to contact.
• Buyer geography: The districts your profile visitors are coming from — shown in aggregate to help you understand your audience and service area demand.
• Category rankings: How your profile compares within your service category in your location.
• Review scores: Your average star rating and total review count.
• Weekly summary emails: A digest of your performance metrics delivered to your registered email every week.

This data is used by Skill Link's admin to run aggregate platform intelligence reports that inform product improvements and marketing strategy. Individual seller data is never shared with other sellers or third parties.

6 AI Chatbot Data

Skill Link operates an AI-powered assistant on the FAQ page, powered by Google Gemini API. When you use the chatbot:

• The text of your question is sent to Google Gemini to generate a relevant answer.
• No personally identifiable data (name, email, phone number, account details) is included in what we send to Gemini.
• Questions are anonymously logged on our servers to help us identify gaps in the FAQ and improve the chatbot's usefulness over time.
• Chatbot logs are retained in anonymised form and are not linked to any user account or session identity.
• Google's handling of Gemini API data is governed by Google's Gemini API Terms of Service.

7 Google User Data: Specific Disclosure

This section addresses Google's API Services User Data Policy requirements.

• Scopes accessed: openid, email, profile only. No access to any other Google service.
• What we receive: Your Google account name, email address, and profile photo URL.
• How we use it: Solely to create or authenticate your Skill Link account. Your Google email becomes your login identifier.
• Storage: Stored securely in our Namecheap-hosted database. Not shared with advertisers or unrelated third parties.
• Revoke access: Visit myaccount.google.com/permissions to remove Skill Link's access at any time.
• Compliance: Skill Link's use of Google data complies with the Google API Services User Data Policy, including Limited Use requirements. Google user data is never sold, transferred to, or used by any third party for advertising or unrelated purposes.
• Policy updates: If we change how we use Google user data, this page will be updated and users notified by email before any change takes effect.

8 Data Sharing & Third Parties

We do not sell your personal data. We share only as needed to operate the platform:

• PayChangu: payment processing for seller subscriptions. Their privacy policy governs payment data.
• Google Gemini API: chatbot question text only. No names, emails, or account data included. See Section 6.
• Google OAuth: sign-in authentication only, as described in Section 7.
• Namecheap: infrastructure hosting. They do not access application-level user data.
• Legal requirements: if required by a valid court order or applicable Malawian law.

9 Seller Profile Visibility

Sellers' public profile data — business name, category, bio, location, portfolio images, review scores, and WhatsApp number — is visible to all visitors. By registering as a seller, you consent to this public visibility. You may update or remove your profile data via your dashboard at any time.

10 Cookies & Local Storage

• Session cookies: Required to maintain login state. Expire when you close your browser.
• Preferences: Browser localStorage stores minor UI preferences (e.g. dismissed banners). No personal data is stored here.
• Analytics: Server-side only. We do not use Facebook Pixel, Google Tag Manager, or third-party advertising cookies on your browser. Buyer behaviour data collected on our servers may be used in aggregate to inform our own advertising campaigns. No personally identifiable data is shared with any advertising platform.

11 Data Retention

• Active seller accounts: retained while the account is active.
• Inactive seller accounts: data deleted 12 months after inactivity, or immediately upon written request.
• Buyer session data: anonymised after 90 days.
• Payment records: retained for 7 years for legal and tax compliance.
• Chatbot logs: stored anonymously; no personally identifiable context is retained.
• Review data: retained indefinitely to preserve the integrity of the ratings system, even after account deletion.

12 Your Rights

You have the right to: access, correct, delete, and export your personal data; withdraw consent for Google Sign-In at any time via your Google account; and opt out of email reports. Contact privacy@skilllinkmw.com to exercise any of these rights. We will respond within 14 days.

13 Security

We use HTTPS encryption, hashed and salted passwords, rate limiting on login and review submissions, and access controls. We review our security practices regularly. While no system is completely secure, we take every reasonable precaution to protect your data.

14 Children's Privacy

SkillLink is not intended for users under 18. We do not knowingly collect data from children. Contact privacy@skilllinkmw.com immediately if you believe a minor has registered.

15 Changes to This Policy

Material changes — especially to Google user data handling — will be notified by email to all registered users and reflected in the "Last updated" date above before taking effect. Continued use of Skill Link after notification constitutes acceptance of the updated policy.

16 Contact

• Privacy email: privacy@skilllinkmw.com
• General contact: skilllinkmw.com/contact.php
• This policy URL: skilllinkmw.com/privacy