Legal

Privacy policy

Last updated 25 July 2026

The short version

Running an escrow marketplace means holding real identity and payment data: a verified phone number, a payout number, and — if you are paid through a remittance provider — your bank account number and a photograph of a government ID. It also means sending some of it elsewhere. The most important part of this page is section 4, which names every outside service that receives your data and exactly what it gets, and section 7, which sets out exactly who can open an uploaded file — including your ID document and any dispute evidence.

We do not sell your data, we do not run advertising trackers, and the app sets no cookies at all.

No advertising trackersNo cookies set by the appAI processing disclosed in full

This document is a working draft

It was written by reading the platform's own source code and describing what it actually does, and it has not yet been reviewed by a lawyer or a data-protection specialist. Amber markers show where a decision still has to be made rather than guessed. No claim of compliance with any privacy regime, certification or standard is made anywhere on this page.

Section 1

Who is responsible

NepalCanWork is operated by Skarsys Global Pvt. Ltd., Harisiddhi-29, Lalitpur, Nepal. That company decides what personal data the platform collects and why, and is the point of contact for questions about it.

[REVIEW: which privacy laws NepalCanWork asserts it is subject to, and whether a representative or data-protection contact must be designated for users outside Nepal]

Section 2

What we collect

Everything below exists as a real field or record in the platform's database. Nothing is collected from third-party data brokers, and there is no advertising or behavioural tracking.

Category	What it is	Where it comes from
Account	Name, username, email address, a bcrypt hash of your password, avatar, bio, skills, languages, location, social links, and for company accounts a logo, description, website and team size.	You, at signup and in settings.
Identity phone	The Nepali mobile number a freelancer verifies by SMS, and when it was verified. One-time codes are stored hashed, never in the clear.	You, during freelancer verification.
Payout details	Your Hamro Pay payout number and the list of numbers the gateway has verified.	You, in payout settings.
Remittance payout details	If you are paid through a remittance provider (Western Union, Remitly, MoneyGram, Ria or WorldRemit): which provider, your receiver legal name, country, city, an optional contact phone number, an uploaded government ID document, and — the part worth reading twice — your bank name, branch, account holder name and full bank account number, plus the staff review status of all of it. A snapshot of these details is also copied onto each payout request so it records where the money was actually sent.	You, in payout settings.
Money records	Orders and their amounts, the gateway's merchant transaction IDs, your wallet balance, every wallet ledger entry, and every payout request with its gross, fee, net, channel and timeline.	Generated as you transact.
Work content	Requirements you submit, the numbered scope contract and its hash, delivery messages and delivered files, revision requests, reviews and ratings.	You and the other party on an order.
Messages	Chat messages and their attachments, plus a flag and category when a message looks like an attempt to move the conversation off the platform.	You, in order and gig conversations.
Disputes	Written statements, uploaded evidence files, text extracted from evidence PDFs, and the AI analysis produced from all of it.	You, when you open or respond to a dispute.
Derived data	Numeric embeddings of your profile and of posted requests, used for matching; your trust score and the ledger of trust events it is derived from; your rating average and count.	Computed by the platform.
Search	Every search: the normalised query, exactly what you typed, your account ID (or nothing if you are signed out), how many results came back, which result you clicked and at what position, and whether the search led you to post a request.	Recorded as you search.
Technical	The IP address that requested an emailed sign-in code, and the IP address recorded against staff actions. Server logs of requests and errors.	Your connection.
Staff actions	An append-only audit log of privileged actions: who did it, their email address, the action, what it targeted, a mandatory note and the IP address.	Staff and administrators.

A public profile shows only the safe subset: name, username, avatar, bio, skills, languages, location, portfolio, ratings and whether you are phone-verified. Your phone numbers, email address and payout details are never on it.

How your bank account number is handled

It is stored so that a member of staff can read it back and send your money — it is not encrypted at the application level, and we are not going to describe it as though it were. What we do instead:

Everywhere it is displayed it is masked to the last four digits. That includes your own settings page, the staff account browser, and the list of your own past payouts.
The full number is returned by exactly two paths: to you, when you press Reveal on your own settings page, and to the staff member working the payout desk at the moment your money is being sent.
It is never written to a log line, never included in an error message, and never sent to our operations chat — outgoing alerts have long digit runs masked before they leave the server.
Changing it puts your payout method back into staff review and holds payouts for 24 hours, so someone who got into your account cannot quietly redirect your earnings.

Section 3

Why we hold it

Purpose	What it needs
Running your account	Email and password hash to sign you in; profile fields to show you to the other side of a deal.
Performing the contract	Orders, requirements, scope contracts, deliveries, messages and reviews — this is the service you asked for.
Holding and moving money	Amounts, gateway transaction IDs, wallet ledger entries and payout details. Without a verified payout number, or a verified bank account for the remittance rail, we cannot pay a freelancer at all.
Checking a payout destination is really yours	Your government ID, your declared legal name and your bank account holder name, compared by a member of staff. This is what stops someone who has taken over an account from repointing the earnings to their own bank.
Deciding disputes	The scope contract, the chat log, deliveries and uploaded evidence. A dispute cannot be decided fairly on less.
Preventing fraud and abuse	Phone uniqueness checks, off-platform contact flags, the trust event ledger, rate-limit records and the staff audit log.
Improving the marketplace	Search queries — particularly searches that returned nothing, which tell us which skills the marketplace is missing.

Most of this is held because it is necessary to provide the service you signed up for, or because we have a genuine interest in keeping the marketplace safe from fraud that would otherwise fall on other users.[REVIEW: the formal legal basis framing to state for each purpose, which depends on which privacy regime applies — see section 1]

Section 4

Who else receives your data

These are every outside service the platform sends data to. Each one is named in the source code, and the middle column says what it actually receives — not what it could theoretically receive.

Service	What it receives	Why
Hamro Pay	For a payment: the amount and a merchant transaction ID generated by us, plus a product title derived from the order or gig name. For a payout: the freelancer's payout phone number, the amount and an idempotency key. For payout-number verification: the phone number and account type. We do not send your name, email address or order content.	Collecting payments and wallet top-ups, verifying payout numbers, and sending payouts.
DeepSeek	All of the written AI work. Assistive features (drafting a request, refining it, budget suggestions, bid review, request analysis) send request and gig text with email addresses, Nepali and international phone numbers and long digit runs replaced by placeholders first. Dispute analysis sends the case file, with the conversation and both written statements put through that same replacement step and with message senders reduced to “client” and “freelancer”. Files and links a party deliberately submitted as evidence are left readable, because a contact detail inside them is often the thing being argued about. Bank account numbers are removed everywhere — see section 5. DeepSeek is a company based in China, so this text is processed outside Nepal and outside the EU.[REVIEW: whether a transfer mechanism or additional disclosure is required for processing dispute material outside Nepal and the EU, and what DeepSeek's retention terms are]	Scope drafting; advisory analysis of dispute evidence.
OpenAI	One narrow job: turning text into the numeric vectors behind search and matching. It receives gig, request and profile text — with the same identifier replacement applied — and returns a list of numbers. It is not used for any written output, and it never receives dispute material.	Semantic search and matching freelancers to requests.
SpellCPaaS	Your mobile number and the text of the SMS being sent to it, which contains a one-time verification code.	Delivering freelancer verification codes by SMS.
Discord	Operational alert messages posted to two webhooks: amounts, internal order, dispute, payout and account identifiers, gateway transaction IDs, masked phone numbers on manual transfers, and — on staff actions such as changing an account's status — the affected account's email address. No order content, no chat messages, no uploaded files, and no bank account numbers: every message is scrubbed of long digit runs before it is sent.	Alerting the operations team to money events, payout failures, new disputes and reconciliation problems.
MongoDB Atlas	The database itself — every record described in section 2 is stored there.	Hosting the platform's database.
Our email relay	Your email address and the content of the message: payment confirmations, payout notices, deadline and auto-approval warnings, sign-in codes and password reset links.	Sending transactional email over SMTP.
Nepal Rastra Bank rate feed	Nothing about you. The platform reads the published USD/NPR reference rate; no request carries user data.	Locking a rupee amount for dollar-priced gigs.
Remittance providers	Not an integration. Western Union, Remitly, MoneyGram, Ria and WorldRemit receive nothing from this platform automatically — there is no connection to any of them in our code. When you are paid on this rail, a member of our payouts team reads your details from an internal screen and enters them into the provider's own service by hand: your legal name, the destination city and country, and your bank name, account holder name and account number. Whatever that provider then does with it is governed by the provider's own privacy policy, not this one.	Sending remittance payouts to freelancers.

Remittance payouts are made by a person, not a system

We list the providers above for completeness, because your details do end up with one of them — but they get there through a staff member, not an API. That has two consequences worth stating: the people on our payouts team see your bank account number and your government ID, and we cannot tell you what a provider does with your data once it is in their system.[REVIEW: whether a data-processing or data-sharing agreement is required with each remittance provider given that the transfer is initiated manually, and what the freelancer must be told before their details are entered into a provider's system]

Document text extraction happens on our own server

PDFs attached to deliveries and dispute evidence are converted to text locally, using OpenDataLoader PDF with a built-in fallback reader. Neither is a network service and neither sends your file anywhere. The extracted text may then go to DeepSeek as part of dispute analysis, as described above.

[REVIEW: data-processing agreements, retention commitments and hosting regions for each service above — in particular the MongoDB Atlas region and the OpenAI data-retention terms in force]

We may also disclose data where we are legally required to, or where it is necessary to investigate fraud or protect someone's safety. We do not sell personal data and we do not share it for advertising.

Section 5

AI processing, stated plainly

NepalCanWork uses AI in two places, through two different providers. They behave very differently with your data, and the difference matters more than anything else on this page.

Assistive features

Personal identifiers are removed first

Before any brief, gig text or profile text is sent — including the text used to build matching embeddings — the platform replaces email addresses, Nepali mobile numbers, international-format phone numbers and runs of ten or more digits (the shape of an account or card number) with placeholders. Budget figures are deliberately kept, because a budget is the point of the tool. Your text is also wrapped in a marked block with an instruction to the model never to treat its contents as commands.

Dispute analysis

The case file is sent, with the conversation stripped of identifiers

When the evidence window on a formal dispute closes, the platform sends the case to DeepSeek for an advisory reading. That case file includes the order title and amount, the scope contract, the requirements, delivery messages, text extracted from delivered PDFs, both sides' written statements, text extracted from uploaded evidence PDFs, evidence images sent as image data, the Resolution Center negotiation history, and the chat log for the order, up to the most recent 500 messages. Email addresses, phone numbers and long digit runs are replaced across the conversation and the statements, and senders appear only as “client” or “freelancer” rather than by name.

Evidence you attach is deliberately left readable

Identifiers are removed from the conversation, but files and links a party submits as evidence are sent as they are — because in an off-platform-payment dispute the phone number is the proof, and removing it would hand the argument to whoever broke the rule. Bank account numbers are the exception and are removed everywhere. So: personal details in the files you attach can reach the model, and if that matters to you, attach only what the case actually needs.

Other things that are true of the AI layer: the model names are configuration, not fixed; the analysis is stored on the dispute record and shown to the dispute desk only, never to either party; it is advisory and cannot execute a verdict; there is an administrator kill-switch that disables every AI endpoint; there is a per-user daily call cap; and content extracted from uploads is treated as untrusted, with hidden, off-page and tiny text filtered out during extraction and any embedded instructions reported as a manipulation flag.[REVIEW: whether users should be able to object to AI analysis of their dispute, and what the alternative review path would be]

Section 6

Cookies and browser storage

The app sets no cookies. There is no analytics script, no advertising pixel and no third-party tag on any page. What it does use is your browser's local storage, which stays on your device and is never sent anywhere except as described:

Key	What it holds	Why
ab_token	Your access token.	Attached to API requests so you stay signed in. Cleared on sign-out, and cleared automatically if the server rejects it.
ab_mode	Either "selling" or "buying".	Remembers which side of the marketplace you were last using.
ab_recent_searches	Your recent search terms.	Shown as suggestions in the search box. Stays on your device.
ab_announce_dismissed_v1	A flag that you closed the announcement bar.	Stops it reappearing on every page.
ab_pending_txn	The merchant transaction ID of a payment you just started.	Lets the app find and confirm your payment when you come back from the gateway. Removed once the payment resolves.

Clearing your browser storage signs you out and forgets those preferences. It does not delete anything from your account.

Section 7

How uploaded files are stored

Everything you upload — portfolio pieces, chat attachments, delivered files, dispute evidence and the government ID document required for remittance payouts — is stored in a private object-storage bucket, organised by purpose and by the account or order it belongs to. Uploads are capped at 25 MB and limited to images, PDFs, ZIP archives, MP4 video, plain text and Word documents. Each file is renamed on upload to a millisecond timestamp plus eight random bytes.

The bucket is not publicly readable. Files are never served from a public address: every read goes through the platform, which checks that the signed-in account is actually entitled to that specific file before it issues a short-lived link. Those links are generated per request and are not stored anywhere. Who may read what depends on the kind of file:

Kind of file	Who can read it
Gig images, portfolio pieces, profile photos	Anyone — these are the images on public listings and profiles.
Chat attachments	The two people in that conversation.
Delivered work	The client and the freelancer on that order. The client's access to the files opens when the escrow payment is released.
Dispute evidence	The two parties to the dispute, and staff reviewing it.
Government ID for remittance payouts	You, and the staff who verify payout details. Nobody else, including the other side of any order you work on.

The random filename still exists, but it is now a second layer rather than the only one — a request for a file you are not entitled to is refused whether or not you know its address. Anything that does not match one of the categories above is refused by default rather than served.

Two honest caveats. A short-lived link, while it is valid, works for whoever holds it — so treat a file link from an order or a dispute as a secret and do not forward it. And bank account numbers are stored in readable form rather than one-way scrambled, because a person has to read them back to send your money; see section 2 for how they are masked everywhere else.

[REVIEW: retention periods for uploaded files, in particular government ID documents and dispute evidence, and whether a deleted gig or portfolio item should also delete the underlying file rather than only the record]

Section 8

How long we keep things

What the platform does today, stated exactly:

Record	Current behaviour
One-time codes	Email and SMS verification codes are stored hashed, are valid for minutes, and their records are deleted automatically an hour after they expire.
Wallet ledger	Append-only. Entries are never edited or removed; corrections are posted as new entries.
Staff audit log	Append-only. Nothing in the application ever updates or deletes a row.
Orders, disputes, messages, uploads, search records	Retained indefinitely. There is no scheduled deletion and no automatic expiry for any of these today.
Bank account details and government ID documents	Retained indefinitely. Replacing your bank account overwrites the old number; it is not kept as a version history. Nothing deletes a government ID document, and nothing deletes a bank account number when a payout method is no longer used. [REVIEW: how long bank account numbers and government ID documents may be kept after a payout method stops being used or an account closes, and what obligation to retain financial records applies. No period is asserted here because none has been decided]
Deleted items	Removing a gig or a portfolio item deletes that record. Files already written to disk are not removed with it.

[REVIEW: retention periods for each record type above, and a deletion routine to enforce them. “Indefinitely” is a description of current behaviour, not a policy we are asserting]

Section 9

Your rights

Available in the product right now:

See and correct your profile, skills, portfolio and payout settings from your settings page.
See every order, delivery, message and dispute you are a party to.
See every entry in your wallet ledger and every payout request, with its fees and status.
Change your payout number, which re-verifies it, emails you, and makes the new number unusable for 24 hours.
Reveal your own saved bank account number, and change it — which sends the payout method back for a staff check and holds payouts for 24 hours.

Not available in the product yet: a self-service export of your data, and self-service deletion of an account.[REVIEW: the process for access, export, correction and deletion requests, including how a user makes one and the response time we commit to]

Some records cannot simply be erased on request without breaking something else — the wallet ledger has to balance, and the staff audit log exists precisely so that privileged actions cannot be quietly removed.[REVIEW: how erasure requests interact with the append-only financial ledger and audit log]

Section 10

Children

NepalCanWork is built for people old enough to enter a binding contract and to be paid for work. The platform does not collect a date of birth and does not verify anyone's age at signup.[REVIEW: minimum age for an account, and what happens when we learn an account holder is below it]

If you believe a child has created an account, contact us and we will look into it.

Section 11

Changes and contact

We will update this page when what the platform does changes. The date at the top is the date of the current version.[REVIEW: whether users are notified of material changes to this policy, and how]

Skarsys Global Pvt. Ltd.
Harisiddhi-29, Lalitpur, Nepal

[REVIEW: privacy contact address — no public privacy or support contact is defined anywhere in the product today]

The rest of the legal set