Privacy Policy

How FindGeeks collects, uses, stores, and protects your personal data under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).

1. Your Privacy

Profex International (Hong Kong) Limited ("we," "us," "our") operates the FindGeeks app and platform (the "App"). We are committed to protecting your privacy when collecting, using, storing, or processing Personal Data, in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Our staff and contractors adhere to strict security and confidentiality standards.

Please review this statement to understand how your Personal Data will be handled. By creating an account, by signing in as an Engineer ("Geek"), or by using the App in any other way, you consent to the collection, use, transfer, storage, and processing of your data as described in this policy.

If you are under 18, a parent or legal guardian must accept this policy on your behalf. The FindGeeks App is not directed at children under 13 and we do not knowingly collect personal data from children under 13. If you believe we have collected such data, please contact us so we can remove it.

In case of discrepancies between language versions, the English version of this Privacy Policy prevails.

2. Roles on the FindGeeks App

FindGeeks is a Hong Kong on-demand marketplace that matches Customers needing IT help (PC / laptop repair, network setup, smart home installation, office IT support, and similar service categories) with vetted independent Engineers ("Geeks"). The same mobile app supports two roles, chosen at sign-in:

• Customer — creates job requests, pays via in-app wallet, confirms job completion.
• Engineer (Geek) — accepts jobs, travels to the job site, performs the work, receives payouts.

Some data (e.g. address, photos, name) is shared between the Customer and the assigned Engineer for the duration of an active job. Other data (e.g. wallet balance, bank account, government-issued IDs) is never shared with the counterparty and is visible only to the user themselves and to our authorised admin team.

3. Personal Data We Collect

Depending on which role you use and which features you exercise, we may collect the following Personal Data:

3.1 Account & identity

• Mobile phone number (Hong Kong format) — used for SMS one-time-password ("OTP") sign-in via our authentication provider, verified at registration.
• Email address — required at registration and verified by a 6-digit code we send before your account is created. Used to deliver job receipts, payment and withdrawal records, account-recovery codes, and other transactional notifications. We do not use your email for marketing.
• Display name (first name + last name) — shown to your counterparty when a job is matched.
• Profile photo (optional).

3.2 Job-related data (Customers)

• Hong Kong address(es) — street, building, unit/apartment, district, region, and approximate latitude/longitude. Required so the assigned Engineer can reach the job site.
• Job request photos — uploaded by you to scope the work (e.g. a photo of a broken cable, faulty router).
• Job description, category, and history.

3.3 Job-related data (Engineers)

• Identity / qualification documents — uploaded during onboarding for verification by our admin team (HKIE certification, vendor certifications, etc.).
• Proof-of-completion photos — uploaded at the end of a job.
• Mid-job extras photos — required when an Engineer adds a chargeable item over a small threshold during a job.
• Live location while travelling to / on site — broadcast to the Customer of an active job so they can see the Engineer en route. See section 4 for permission details.

3.4 Payment data

• Card details — Customers can top up their in-app wallet using a credit/debit card. Card details are entered on the hosted checkout page of our payment processor (BBMSL, a Hong Kong card services provider) and are never stored by FindGeeks. We retain only the BBMSL token, the card brand, and the last 4 digits — enough to display "Visa ending 1234" so you can recognise your saved card.
• Wallet balance + ledger — every top-up, hold, settlement, refund, and withdrawal is recorded in the wallet ledger.
• Bank account info (Engineers, for withdrawal) — bank name, HKICL 3-digit clearing code, account holder, account number. Stored encrypted at rest using AES-GCM and only decrypted by our admin team to process the bank transfer. To save you re-entering on each withdrawal we also pre-fill the form from your most recent submission — only the most recent set is retained for prefill, and you can edit any field before submitting again.

3.5 Device & technical data

• Device push notification token (Apple APNs / Google FCM, relayed via Expo Push Service) — to send job-status alerts.
• IP address + user agent — captured on sensitive actions (e.g. wallet withdrawal requests) for fraud-prevention audit trails.
• Device model, operating system version, app version — used for support and compatibility diagnostics.

3.6 Communications

• Support tickets, dispute messages, ratings, and reviews you submit.

3.7 Content moderation data

• Content reports you submit — when you tap the "Report" flag on a review, we record the rating you reported, the reason category you selected, any optional notes, your user ID, and a timestamp. Used by our moderation team to investigate and decide whether to keep the content hidden or restore it.
• Engineers you block (Customers) — when you block an Engineer from their profile, we record your user ID, the Engineer's user ID, an optional reason, and a timestamp. Used to filter that Engineer out of your search results, recommendations, and matched-job pushes.
• Automatic content filter — review text is checked against a small denylist of clearly profane terms at submission time. If a match is found, your review is rejected before it reaches our database; we do not store the rejected text.

4. Mobile Device Permissions

With your consent through your device's permission prompts, the FindGeeks App accesses the following hardware:

4.1 Camera

Used to take photos of the job site (Customers — scoping a request) and proof-of-work / extras evidence (Engineers). Photos are uploaded directly to our encrypted storage and tied to the relevant job. The camera is never accessed without an explicit user action (e.g. tapping "Take Photo").

4.2 Photo Library

Used to attach existing photos from your device to a job. Only the photos you select are uploaded — the App does not enumerate or read other media on your device.

4.3 Location (while the app is in use)

Customers — used to suggest your current location as the job site address and to compute distance to recommended Engineers. Engineers — used to match you with nearby jobs.

4.4 Location (background, Engineers only, during an active job)

When you have accepted a job and are in the "Travelling" or "On Site" status, the App uses background location to broadcast your live position to the Customer of that active job (so they can see you en route). Background location is automatically released when the job is marked complete or cancelled. Customers do not have any background-location permission requested. Live-location pings older than 30 days are automatically deleted.

4.5 Push Notifications

Used to deliver time-sensitive updates: job accepted, Engineer on the way, work completed, payment processed, dispute responses, and account-related notices. You can disable push notifications at any time through your device settings or the App's notification settings. Doing so will not disable other features.

The FindGeeks App does not request access to your contacts, microphone, calendar, health data, Face ID/Touch ID for biometric auth, SMS reading, or call logs.

5. Purposes for Which We Use Your Personal Data

We use your Personal Data to: (a) operate the FindGeeks platform — match Customers and Engineers, route jobs, calculate prices, hold and release wallet funds, process payouts, prevent fraud; (b) communicate with you — job updates, payment receipts, support replies, and (with your consent) service-related announcements; (c) verify Engineer credentials before approving them onto the platform; (d) investigate and resolve disputes or chargebacks; (e) comply with legal obligations including tax, anti-money-laundering, and data-access requests from law enforcement; and (f) improve the App through aggregated, de-identified analytics on usage and reliability.

If you do not provide the Personal Data we ask for, we may be unable to deliver the requested services to you.

6. Disclosure and Transfer of Personal Data

We will keep your Personal Data confidential, but we may share it with the following recipients:

• The other party to your transaction — for example, the Engineer assigned to your job will see your name, contact information, and the job address; the Customer of an active job will see the Engineer's name, profile photo, and live location while travelling.
• Our service providers and processors who help operate the App (see section 7).
• Anyone who is a real or potential buyer, transferee, or successor if we sell, merge, or reorganise any part of our business.
• Government authorities, courts, regulators, or law enforcement when we are legally required to disclose information or when it is necessary to protect our rights, property, or the safety of others.

Some recipients may be located outside Hong Kong, where data protection laws may not be as comprehensive as those under the Personal Data (Privacy) Ordinance.

7. Third-Party Service Providers

FindGeeks relies on the following third-party processors. Each is contractually bound to use your data only as needed to provide their service to us:

• Supabase — primary database, authentication, file storage. Servers located in the Asia-Pacific region.
• Cloudflare — API hosting (Cloudflare Workers), website hosting (Cloudflare Pages), bot/abuse protection (Cloudflare Turnstile), and rate-limit storage (Cloudflare KV).
• BBMSL (a Hong Kong licensed payment gateway) — hosted credit/debit card checkout for wallet top-ups, card tokenisation. Handles your card PAN; we never see or store it.
• Twilio (via our authentication provider) — SMS delivery for one-time passwords.
• Resend — transactional email delivery (receipts, password reset, dispute updates) sent from mail.profexint.com.
• Expo Push Service — relays push notifications to Apple Push Notification Service (APNs) and Google Firebase Cloud Messaging (FCM).
• Google Maps Platform — map display, geocoding, distance calculations.

8. Cookies and Web Tracking

This website (and our admin web portal at app.findgeeks.profexint.com) uses only strictly necessary cookies — primarily to maintain your authenticated session and to remember your language preference. We do not use third-party advertising or marketing cookies. The mobile App does not use web cookies; it uses secure on-device storage for your authenticated session token.

9. Security and Storage

Your Personal Data is accessed only by employees and contractors who are authorised to do so. Personal Data is kept on secured Supabase Postgres servers; data in transit is protected by TLS 1.2 or higher. Sensitive fields — bank account details, payment tokens — are encrypted at rest using AES-GCM with keys held outside the database.

Photos are stored in private Supabase Storage buckets behind Row-Level Security policies that restrict each photo to the assigned Customer + Engineer of the related job, plus our admin team for dispute review.

In the rare event of a data breach affecting your Personal Data, we will notify you and the Office of the Privacy Commissioner for Personal Data, Hong Kong without undue delay.

10. Data Retention

We keep your Personal Data only as long as needed for the purposes set out in this policy:

• Active accounts — for the lifetime of the account.
• Job photos (extras evidence) — 90 days after the job is completed or cancelled, unless retained for an active dispute.
• Engineer live-location history — 30 days, after which pings are automatically deleted.
• Transaction records, invoices, wallet ledger — minimum 7 years to comply with Hong Kong tax / accounting / anti-money-laundering requirements.
• Deleted accounts — see section 11.

11. Your Rights — Access, Correct, and Delete Your Data

Under the Personal Data (Privacy) Ordinance, you are entitled to: (a) request a copy of the Personal Data we hold about you; (b) request correction of inaccurate Personal Data; (c) ask about our data-handling policies and practices; and (d) submit complaints about how your Personal Data has been handled. You can exercise these rights by contacting us using the details in section 13. We will respond within 40 days and may charge a reasonable processing fee.

11.1 Deleting your account from within the App

You can permanently delete your FindGeeks account at any time directly from the App: go to Profile → Delete Account and follow the confirmation steps. When you submit a deletion request:

• Your account is immediately deactivated — no new jobs can be created or accepted.
• A deletion request is recorded with a 30-day grace window in case you change your mind.
• Within 30 days, your account and associated Personal Data are anonymised or removed from our systems. Specifically: identifying fields (name, email, phone number, payment-method tokens, bank account details) are removed; your authentication record is permanently deleted so the account cannot be recovered or signed into; Personal Data held by our processors (payment provider, push-notification relay, email provider) is purged according to their retention schedules.
• If you have any pending wallet withdrawal in requested or processing state, the deletion is paused until our admin team resolves it (usually within 48 business hours).

Data we are legally required to retain for tax, audit, anti-fraud, or regulatory purposes (transaction records, invoices) is kept for the minimum period required by law, separated from your identity wherever possible.

11.2 Assisted deletion

If you have lost access to your account, email findgeeks@profexint.com from the address registered to the account with the subject line "Delete My Account". We will verify your identity and process the request under the same 30-day timeline. See our dedicated Delete Account page for full instructions.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be notified to you in-app or by email. Your continued use of the App after such updates means you accept the revised policy.

13. Contact Us