1. Who we are
Mohamad Asfour, trading as Callout, is the data controller for this website and the Callout app.
Address: 82A James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom
Email: hello@joincallout.co.uk
This policy covers people who join our waitlist, and customers and tradespeople using the Callout app.
2. What we collect
Not every category applies to every person.
You give us:
- Account details — your name, email address and phone number.
- Sign-in details — your email address and a salted hash of your password. We never store the password itself.
- Waitlist details — name, email address, whether you're a customer or a tradesperson, and your general area or postcode.
- Job details — the description, category and service area; the specific address for a job; and any photo you attach.
- Tradesperson details — trade categories, service areas, experience, employment type, insurance and right-to-work confirmations, and business and VAT details for invoicing. Identity documents and bank details go directly to Stripe and are never received or stored by us.
- Messages — text sent through a job's in-app chat, and anything you send us about a dispute.
Collected automatically:
- Tradesperson location — while a job they have accepted is marked “en route”, so the customer can see them approaching.
- Your location — only if you allow it in your browser, to suggest your service area. You can decline and type it instead.
- Technical data — IP address and request details recorded in security and administrative logs.
- Session data — sign-in sessions, when they were last active, and which sign-in methods are linked to your account.
3. Why we use it, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Waitlist signups and launch emails | To tell you when we launch | Consent — Art. 6(1)(a) |
| Waitlist administration and security | Managing capacity, blocking automated signups | Legitimate interests — Art. 6(1)(f) |
| Accounts and job matching | Creating profiles, signing you in, matching jobs | Contract — Art. 6(1)(b) |
| AI photo description | Suggesting a description from a photo you attach | Contract — Art. 6(1)(b) |
| Live “en route” tracking | Showing a customer their tradesperson approaching | Contract — Art. 6(1)(b) |
| Suggesting your service area | Pre-filling your area from your device | Consent — Art. 6(1)(a) |
| Payments and payouts | Taking payment and paying tradespeople, via Stripe | Contract — Art. 6(1)(b) |
| Security and abuse prevention | Password breach checks, session security, audit logs | Legitimate interests — Art. 6(1)(f) |
| Account emails | Verification, password resets, booking notifications | Contract — Art. 6(1)(b) |
| Invoices and financial records | Keeping records HMRC requires | Legal obligation — Art. 6(1)(c) |
A note on live tracking. Sharing location while “en route” is built into accepting a job through Callout and cannot be switched off separately while a job is in that state. Because it cannot be freely refused or withdrawn, we do not treat it as consent — consent has to be something you can decline without penalty. We rely on performance of the contract instead. It stops automatically as described in section 6.
4. AI photo analysis
If you attach a photo when describing a job, we can send it to Anthropic's Claude AI to suggest a description of the problem.
- Only the photo and a short category label are sent — for example “plumbing”. Your name, contact details, address and the job description are not.
- You can always write the description yourself instead.
- Anthropic does not use data sent through its commercial API to train its models.
- The AI only suggests wording. It makes no decision about you, your job, its price, or which tradesperson attends.
5. Who we share it with
- The other party to your job. A tradesperson assigned to your job sees the address, description, photos and your messages for that job — and you see the equivalent about them. This is how the marketplace works, not an optional extra.
- Supabase — our database, sign-in system and file storage. Holds most of the data above.
- Stripe — card payments and tradesperson payouts, including Stripe's own identity checks on tradespeople. Your card details go from your browser straight to Stripe and never reach our systems.
- Anthropic — AI photo analysis, limited to section 4.
- Google — “Sign in with Google” if you use it, and Maps and Directions for maps and routes. Because maps are drawn in your own browser, Google receives your IP address directly whenever a map is shown, as well as the coordinates used for routing.
- Resend — sending account emails such as verification links and password resets.
- Have I Been Pwned — checking new passwords against known breaches. Only the first five characters of an irreversible hash are sent, never the password and never the full hash. The comparison happens on our own server.
- Cloudflare — security and content delivery for joincallout.co.uk.
We do not sell personal data and we do not share it for advertising.
6. Live location tracking
- Starts only when a tradesperson marks an accepted job “en route”.
- Stops automatically as soon as the job reaches “arrived”, is completed, or is cancelled — and the coordinates are erased at that point, not just hidden.
- No background tracking. Callout runs in your browser, so location is only collected while the page is open and the job is actively en route.
- Seen by the customer waiting for that specific job, and by administrators reviewing a dispute.
- No journey history is kept. Only a current position is stored, and each update overwrites the last.
7. Sending data outside the UK
Some providers (Supabase, Anthropic, Google, Stripe, Resend, Cloudflare) operate infrastructure or have parent companies outside the UK and EEA, mainly in the United States.
Where data is transferred, we rely on UK adequacy regulations, the UK International Data Transfer Addendum, or approved Standard Contractual Clauses.
8. How long we keep it
| What | How long |
|---|---|
| Your account | For as long as it is active |
| Waitlist records | Until launch, or on request to unsubscribe |
| Jobs, messages, photos and location | Kept with the job record, so a dispute or warranty question can still be answered |
| Invoices and payment records | Six years after the end of the relevant tax year, as HMRC requires |
| Security and audit logs | Kept for security and incident investigation |
If you delete your account: where you have no job, invoice or dispute history, everything is removed. Where you do, we have to keep those records — but we remove your name, phone number and profile details, and permanently block the account from signing in. This happens as soon as you confirm, with no waiting period.
9. Your rights
You have the right to access your data, have it corrected, have it erased, restrict or object to how we use it, receive a portable copy, and withdraw consent where we rely on it.
How to use them:
- Download your data — Settings → “Download my data” gives you your account, sign-in methods, sessions, jobs, invoices, disputes and preferences in one file, any time. It does not include full message threads or our internal notes; email us for those.
- Correct your details — edit your name and phone number on your account page.
- Delete your account — Settings → “Delete account”. You'll need your password.
- Anything else — email hello@joincallout.co.uk with the subject “Data Subject Request”.
We reply to verified requests within one month. If a request is complex we may take up to two months more, and we'll tell you within the first month if so.
10. Security
- Traffic is encrypted with TLS/HTTPS.
- Database access is restricted by role and row-level security.
- Passwords are stored only as salted hashes, and new ones are checked against known breach lists.
- The sign-in cookie is HttpOnly, so page scripts cannot read it, and is not used for tracking.
11. Cookies and browser storage
We use one cookie to keep you signed in. It is HttpOnly and is not used for tracking, analytics or advertising.
Cloudflare sets a security cookie on joincallout.co.uk for bot and DDoS protection. Where a map is shown, Google's mapping scripts also store data in your browser to draw and cache it.
We do not use advertising or analytics cookies.
12. Children
Callout is for people aged 18 and over, and creating an account requires confirming that. We do not knowingly collect data from anyone under 18 and will delete it promptly if we find it.
13. If Callout becomes a company
Callout is currently run by Mohamad Asfour as a sole trader. If it is incorporated as a limited company, that company becomes the data controller in place of the individual, and your data passes to it as part of the same service continuing. We will tell you through an updated version of this policy, with the company's name, registered office and registration number.
Nothing about how your data is used, who it is shared with, or how long it is kept changes — only who is legally responsible for it.
14. Changes
We may update this policy from time to time. This version was last updated on the date at the top.
15. Complaints
Email hello@joincallout.co.uk and we'll try to sort it out. You don't have to come to us first — you can complain directly to the UK regulator:
Information Commissioner's Office
ico.org.uk · 0303 123 1113
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF