Information We Collect
We collect only what's needed to run the marketplace, verify identities, process payments, and keep the platform secure.
- Account info — name, email, phone, password (hashed), country, language.
- Profile info — photo, bio, skills, experience, education, certifications, social links.
- Verification documents — government ID, proof of address, references. Encrypted and used only for verification.
- Transaction data — project briefs, proposals, contracts, milestones, payments, amounts, recipient/payer IDs.
- Communications — platform messages, support tickets, video call metadata.
- Technical data — IP address, browser, device, pages visited, referral source, timestamps.
- Cookies — see our Cookie Policy for the full list and purposes.
How We Use Your Information
Every use of your data maps to one of the operational, legal, or product purposes below.
- Operate the marketplace — matching, communications, payments, dispute resolution.
- Verify identity & credentials of consultants applying to join the network.
- Process payments and payouts via Stripe Connect.
- Detect fraud and abuse across the platform.
- Communicate updates, security alerts, and platform changes.
- Marketing — only with your consent; you can unsubscribe in every email.
- Aggregate analytics to improve the product. Always de-identified.
Data Retention
We keep data only as long as needed for the purpose we collected it — or as the law requires.
- Account & profile — active period plus 7 years post-closure for legal, tax, and dispute purposes.
- Payment records — 7 years, per US tax law.
- Verification documents — 2 years after revocation or expiry, then deleted.
- Marketing data — retained until you unsubscribe.
- Logs — 12 months, unless longer retention is required for a security investigation.
Your Rights
You have full rights over your data — including access, correction, deletion, and portability.
- Access — request a copy of the data we hold about you.
- Correction — fix any inaccuracies.
- Deletion — request account deletion. We keep only what we must for legal and tax obligations.
- Portability — export your data in machine-readable JSON.
- Opt-out of marketing — unsubscribe anytime.
- California residents (CCPA) — right to know, right to delete, right to opt out of sale (we don't sell), and the right to non-discrimination for exercising these rights.
- EU / UK residents (GDPR) — right to object, right to restrict processing, and the right to lodge a complaint with your supervisory authority.
To exercise any right, email privacy@idharma.us. We respond within 30 days.
Security
We use industry-standard encryption in transit (TLS 1.3) and at rest (AES-256). Verification documents are encrypted with separate keys. We conduct an annual security review, and SOC 2 readiness is in progress with a target completion of Q3 2026.
Found a vulnerability? Report it to security@idharma.us under our Vulnerability Disclosure policy. We acknowledge reports within 72 hours.
Children
iDharma is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has registered, email privacy@idharma.us and we will delete the account promptly.
International Data Transfers
iDharma operates from the United States. If you access the service from outside the US, your data is transferred to the US under Standard Contractual Clauses or equivalent safeguards recognized under applicable data protection law.
Changes to This Policy
We will notify you of material changes via email and in-platform notice at least 30 days before they take effect. Continued use after the effective date means acceptance. Past versions are archived at /privacy-policy/changelog.
Contact Us
Privacy questions, requests, or concerns? Reach the team directly.
United States