Privacy Policy
Last updated: July 6, 2026
1. Introduction & Scope
Vidfer ('we', 'our', 'us') is committed to protecting your privacy and handling your personal data with transparency and care. This Privacy Policy explains how we collect, use, store, process, share, and safeguard your personal information when you access or use our platform, website, and related services ('Platform'). This policy applies to all users worldwide, including visitors, registered users, Buyers, Sellers, and anyone who interacts with the Platform. Please read this policy carefully. By using the Platform, you consent to the data practices described herein. If you do not agree with any part of this policy, you must discontinue use of the Platform immediately.
2. Information We Collect
We collect the following categories of personal information: (a) Account Information — name, email address, username, password, profile photo, date of birth; (b) Identity Verification Information — government-issued ID, passport, driver's license, proof of address, and selfie/facial verification images for KYC/AML compliance; (c) Financial Information — payment card details (processed directly by our PCI-compliant payment processors, not stored by us), bank account details, withdrawal preferences, transaction history; (d) Contact Information — postal address, phone number, social media handles; (e) Technical Information — IP address, browser type and version, operating system, device type, unique device identifiers, screen resolution, language preferences; (f) Usage Information — pages visited, time spent, features used, tasks completed, search queries, clickstream data, referring URLs; (g) Communication Information — messages sent through the Platform, support tickets, email correspondence, feedback, survey responses; (h) Location Information — approximate location derived from IP address; and (i) Cookies & Tracking Data — as described in our Cookies section.
3. Legal Basis for Processing (GDPR & UK GDPR)
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds: (a) Contractual Necessity — processing necessary to perform our contract with you, including account management, task facilitation, and payment processing; (b) Legitimate Interests — processing for our legitimate business interests such as fraud prevention, platform security, analytics, and service improvement, provided your rights do not override these interests; (c) Legal Obligation — processing required to comply with applicable laws, regulatory requirements, court orders, or government requests; (d) Consent — processing for marketing communications, cookies (where required), and other purposes where we specifically request your consent. You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
4. How We Use Your Information
We use your personal information for the following purposes: (a) To provide, maintain, and improve the Platform and its features; (b) To create and manage your account, verify your identity, and authenticate your access; (c) To process transactions, including payments, withdrawals, and refunds; (d) To facilitate communication between Buyers and Sellers for task completion; (e) To comply with KYC, AML, and counter-terrorism financing obligations; (f) To detect, prevent, and investigate fraud, abuse, security incidents, and illegal activities; (g) To enforce our Terms & Conditions and other policies; (h) To send service-related notifications, including account updates, security alerts, and policy changes; (i) To send marketing communications (with your consent where required by law); (j) To analyze usage patterns, conduct research, and improve user experience; (k) To personalize content, recommendations, and advertising; (l) To respond to your inquiries, support requests, and complaints; (m) To comply with legal obligations, court orders, and regulatory requests; (n) To protect our rights, property, and safety, and those of our users and the public; and (o) For any other purpose disclosed at the time of collection or with your consent.
5. Information Sharing & Disclosure
We do not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising. We may share your information in the following circumstances: (a) With Other Users — information necessary for Platform functionality is visible to users you interact with (e.g., your username, profile, task submissions); (b) With Service Providers — trusted third parties who assist in Platform operations including payment processors, cloud hosting, identity verification, analytics, customer support, email delivery, and fraud detection services, all bound by strict data processing agreements; (c) With Legal Authorities — when required by law, court order, subpoena, legal process, or government request, or to establish, exercise, or defend legal claims; (d) In Business Transfers — in connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as a business asset; (e) With Professional Advisors — lawyers, auditors, insurers, and consultants as reasonably necessary; (f) With Your Consent — when you give us explicit consent to share your information for a specific purpose; and (g) In Aggregated Form — anonymized, de-identified data that cannot reasonably identify you may be shared for research, analytics, or marketing.
6. Social Media & Public Information
Our Platform may include public profiles, reviews, ratings, discussion areas, and other interactive features where you can post information, comments, or materials. Any information you post in these public areas may be viewed, collected, and used by other users and the public. We are not responsible for the information you choose to submit publicly. You should exercise caution and not disclose personal information in public areas. If you connect your account with social media platforms (such as Facebook, Google, or Twitter), we may receive information from those platforms in accordance with their privacy policies and your privacy settings. We are not responsible for the privacy practices of any social media platforms you choose to connect with.
7. International Data Transfers
Your personal information may be transferred to, stored, and processed in countries other than your country of residence, including Pakistan (where our servers are located), the United States, and other jurisdictions where our service providers operate. These countries may have data protection laws different from your jurisdiction. We ensure appropriate safeguards are in place for international transfers in compliance with applicable laws, including: (a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) UK International Data Transfer Agreement (IDTA); (c) adequacy decisions by relevant authorities; (d) binding corporate rules; and (e) other legally recognized transfer mechanisms. By using the Platform, you consent to the transfer of your information as described in this policy. To obtain a copy of applicable safeguards, contact us at privacy@vidfer.com.
8. Data Retention
We retain your personal information for as long as your account is active, as long as needed to provide services, and as required by applicable law. Specific retention periods: (a) Account Data — retained for the duration of your account plus 3 years after account closure for legal, tax, and audit purposes; (b) Financial Records — retained for 7 years as required by tax and financial regulations; (c) KYC/Identity Documents — retained for 5 years after account closure or as required by AML regulations; (d) Communications — retained for 3 years; (e) Usage Logs — retained for 12 months; (f) Marketing Data — retained until you opt out or 2 years after last interaction; (g) Data Subject to Legal Hold — retained until the hold is lifted. After the applicable retention period, data is securely deleted or anonymized. You can request earlier deletion of your data, subject to legal retention obligations.
9. Data Security
We implement comprehensive technical, organizational, and administrative security measures to protect your personal information, including: (a) Encryption — data encrypted in transit (TLS 1.3) and at rest (AES-256); (b) Access Controls — strict role-based access, multi-factor authentication, and regular access reviews; (c) Network Security — firewalls, intrusion detection/prevention systems, and regular penetration testing; (d) Monitoring — 24/7 security monitoring, logging, and anomaly detection; (e) Employee Training — mandatory data protection and security awareness training; (f) Vendor Assessment — rigorous security review of all third-party service providers; (g) Incident Response — documented incident response plan for data breaches; (h) Backups — encrypted, geographically distributed backups with tested restoration procedures. Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you of any data breach affecting your information in accordance with applicable legal requirements.
10. Vulnerability Disclosure & Security Research
Vidfer encourages responsible security research and disclosure of vulnerabilities. If you discover a security vulnerability on the Platform, please report it immediately to security@vidfer.com. We ask that you: (a) provide detailed information about the vulnerability, including steps to reproduce; (b) allow us reasonable time to investigate and address the issue before public disclosure; (c) act in good faith and avoid privacy violations, data destruction, or service disruption; (d) not exploit the vulnerability beyond what is necessary to demonstrate it. We will: (i) acknowledge receipt within 5 business days; (ii) investigate and keep you informed of progress; (iii) take appropriate remediation steps; and (iv) publicly acknowledge your contribution if you wish. We will not pursue legal action against researchers who comply with this policy. This program does not offer financial rewards unless otherwise specified.
11. Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will: (a) notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by applicable law); (b) notify affected users without undue delay; (c) provide information about the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed to mitigate harm; (d) cooperate fully with regulatory authorities and law enforcement; and (e) take immediate steps to contain and remediate the breach. Notifications will be sent via email and/or in-app notification using the contact information we have on file. You are responsible for keeping your contact information current.
12. Your Rights (GDPR, UK GDPR, & International)
If you are located in the EEA, UK, or other jurisdictions with similar data protection laws, you have the following rights: (a) Right of Access — request a copy of the personal data we hold about you; (b) Right to Rectification — request correction of inaccurate or incomplete data; (c) Right to Erasure ('Right to be Forgotten') — request deletion of your personal data, subject to legal exceptions; (d) Right to Restriction of Processing — request restriction of processing in certain circumstances; (e) Right to Data Portability — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller; (f) Right to Object — object to processing based on legitimate interests or direct marketing; (g) Right to Withdraw Consent — withdraw consent at any time where processing is based on consent; (h) Right to Complain — lodge a complaint with your local data protection supervisory authority; (i) Rights Related to Automated Decision-Making — not be subject to decisions based solely on automated processing where such decisions have legal or significant effects. To exercise any of these rights, contact us at privacy@vidfer.com. We will respond within 30 days (extendable by 60 days for complex requests). We may require identity verification before processing your request.
13. Data Subject Access Request (DSAR) Verification Process
To protect your privacy and security, we take reasonable steps to verify your identity before fulfilling a data subject access request or any other privacy rights request. Our verification process may include: (a) matching information you provide against our records (name, email, account details); (b) requesting additional identification documents (such as a government-issued ID) for sensitive or complex requests; (c) contacting you through the email address on file to confirm the request; (d) requiring notarized verification for high-risk requests involving financial or sensitive data; (e) if you use an authorized agent, requiring proof of your signed authorization and verification of the agent's identity. We will not discriminate against you for exercising your rights. We reserve the right to refuse requests that are manifestly unfounded, excessive, or repetitive in accordance with applicable law. We will inform you of the reason for any refusal and your right to complain to a supervisory authority.
14. California Privacy Rights (CCPA & CPRA)
For residents of California, USA, this section supplements our Privacy Policy. Vidfer does not sell your personal information and does not share it for cross-context behavioral advertising. Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), you have the following additional rights: (a) Right to Know — request disclosure of categories and specific pieces of personal information collected, sources, business purpose, and categories of third parties with whom it is shared; (b) Right to Delete — request deletion of personal information we have collected, subject to exceptions; (c) Right to Correct — request correction of inaccurate personal information; (d) Right to Opt-Out — opt out of the sale or sharing of personal information for cross-context behavioral advertising (we do not sell personal information); (e) Right to Limit Use of Sensitive Personal Information — limit use of sensitive personal information (we do not use sensitive information beyond what is necessary for service provision); (f) Right to Non-Discrimination — you will not receive discriminatory treatment for exercising your CCPA rights. In the preceding 12 months, we have collected the categories of personal information listed in Section 2 and disclosed them for business purposes as described in Section 5. To exercise your California rights, contact us at privacy@vidfer.com. We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf.
15. Brazil Privacy Rights (LGPD)
For users in Brazil, under the Lei Geral de Proteção de Dados (LGPD), you have the following rights: (a) confirmation of the existence of processing; (b) access to your data; (c) correction of incomplete, inaccurate, or outdated data; (d) anonymization, blocking, or deletion of unnecessary or excessive data; (e) portability of data to another service provider; (f) deletion of data processed with your consent; (g) information about public and private entities with which we shared data; (h) information about the possibility of denying consent and consequences; (i) revocation of consent; and (j) complaint to the ANPD (Autoridade Nacional de Proteção de Dados). To exercise your LGPD rights, contact privacy@vidfer.com.
16. Pakistan Privacy Rights
For users in Pakistan, under the Prevention of Electronic Crimes Act 2016 (PECA) and applicable data protection regulations, you have the right to: (a) request access to your personal information held by us; (b) request correction of inaccurate information; (c) request deletion of information where legally permissible; (d) withdraw consent for processing; and (e) lodge complaints with relevant authorities. We process your data in accordance with Pakistani law and ensure appropriate safeguards for your information.
17. Cookies & Similar Technologies
We use cookies, web beacons, pixel tags, and similar tracking technologies to enhance your experience, analyze usage, and personalize content. Below is a detailed list of the cookies we use: Essential/Strictly Necessary Cookies — session cookie (expires at end of session, used for authentication and session management), XSRF-TOKEN (expires at end of session, used for CSRF protection), cookie consent (expires after 1 year, stores your cookie preferences). Functional Cookies — language preference (expires after 1 year, remembers your language selection), theme preference (expires after 1 year, remembers your display theme). Analytics Cookies — _ga (Google Analytics, expires after 2 years, used to distinguish users), _gid (Google Analytics, expires after 24 hours, used to distinguish users), _gat (Google Analytics, expires after 1 minute, used to throttle request rate). Performance Cookies — _ga_* (Google Analytics, expires after 2 years, used to maintain session state). You can control cookies through your browser settings. Disabling certain cookies may affect Platform functionality. For EEA/UK users, we request consent for non-essential cookies before setting them. For questions about specific cookies, contact privacy@vidfer.com.
18. Do Not Track (DNT)
Some browsers have 'Do Not Track' (DNT) signals that communicate your privacy preferences. The Platform currently does not respond to DNT signals because no uniform standard for DNT has been adopted. However, you can control tracking through browser settings, cookie preferences, and our opt-out mechanisms. We will update this policy if a standard for DNT is established.
19. Children's Privacy
The Platform is strictly for individuals aged 18 or older (or the age of majority in their jurisdiction, whichever is higher). We do not knowingly collect, use, or solicit personal information from children under 18. If we discover that a child under 18 has provided us with personal data without verifiable parental consent, we will immediately delete such information and terminate the associated account. If you believe a child has provided us with personal data, please contact us immediately at privacy@vidfer.com. We encourage parents and guardians to monitor their children's online activities.
20. Sensitive Personal Data
We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification, health information, or sexual orientation. If we are required to process such data for legal compliance (such as identity verification), we will seek your explicit consent and process it in accordance with applicable laws. Users should not submit sensitive personal data through the Platform unless specifically requested.
21. Automated Decision-Making & Profiling
We may use automated decision-making and profiling in limited circumstances: (a) Fraud Detection — automated analysis of user behavior patterns to identify potential fraud; (b) KYC Verification — automated identity document verification; (c) Account Suspension — automated flags for Terms violations; (d) Recommendations — automated content and task recommendations. Where automated decisions have legal or significant effects on you, we will: (i) inform you that the decision is automated; (ii) allow you to request human review; (iii) enable you to contest the decision; and (iv) provide an explanation of the decision logic. You have the right not to be subject to decisions based solely on automated processing where such decisions produce legal effects concerning you or similarly significantly affect you.
22. Marketing Communications & Opt-Out
With your consent (where required by law), we may send you marketing communications about Platform features, promotions, and updates. You have the right to opt out of marketing communications at any time by: (a) clicking the 'unsubscribe' link in any marketing email; (b) adjusting your notification preferences in account settings; (c) contacting us at privacy@vidfer.com. We will process opt-out requests within 10 business days. Please note that even if you opt out of marketing, we will still send you service-related communications (e.g., account updates, security alerts, transaction confirmations, policy changes) which are necessary for your use of the Platform.
23. Third-Party Data Processors & Service Providers
We engage trusted third-party data processors who process your personal information on our behalf. Current processors and their locations: (a) Cloud Infrastructure — Hostinger (Pakistan/Lithuania); (b) Payment Processing — Stripe (USA), PayPal (USA); (c) Identity Verification — to be selected KYC provider; (d) Analytics — Google Analytics (USA); (e) Email Services — to be selected email provider; (f) Database — MySQL hosted on Hostinger (Pakistan). All processors are subject to strict contractual obligations regarding data protection, security, and confidentiality. They are permitted to process your data only for specified purposes and in accordance with our instructions. International transfers to these processors are safeguarded by Standard Contractual Clauses or other approved mechanisms. We maintain an up-to-date list of all data processors. Contact privacy@vidfer.com for a complete list or copies of data processing agreements.
24. Data Protection Officer (DPO)
We have appointed a Data Protection Officer (DPO) to oversee compliance with data protection laws and address your privacy concerns. Our DPO can be reached at: Email: dpo@vidfer.com. The DPO is responsible for: (a) monitoring compliance with data protection laws and internal policies; (b) advising on data protection impact assessments; (c) serving as a contact point for supervisory authorities; (d) handling data subject requests; and (e) conducting staff training on data protection. Please direct all privacy-related inquiries to the DPO.
25. Supervisory Authority Complaints
If you are unsatisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection supervisory authority. Relevant authorities include: (a) EEA — your local Data Protection Authority (DPA) under GDPR; (b) UK — Information Commissioner's Office (ICO): https://ico.org.uk; (c) California — California Attorney General: https://oag.ca.gov/privacy; (d) Brazil — ANPD: https://www.gov.br/anpd; (e) Pakistan — relevant authority under PECA. We encourage you to contact us first at privacy@vidfer.com so we can attempt to resolve your concern before you file a complaint with a supervisory authority.
26. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will notify you of material changes by: (a) posting the updated policy on this page with a revised 'Last updated' date; (b) sending an email notification to the address associated with your account; (c) displaying an in-app notification. Changes become effective immediately upon posting. For material changes that reduce your rights or require additional consent, we will obtain your consent before implementing such changes. We encourage you to review this policy periodically. Your continued use of the Platform after changes constitute acceptance of the updated policy.
27. Contact Information
If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us using the following channels: Data Protection Officer: dpo@vidfer.com; Privacy Inquiries: privacy@vidfer.com; General Support: support@vidfer.com; Legal Notices: legal@vidfer.com; Security Reports: security@vidfer.com. We will respond to all legitimate requests within the timeframes required by applicable law. For urgent privacy matters, please mark your communication as 'URGENT — PRIVACY' in the subject line.