Privacy Policy

1. Scope and controller

2HELP INC. is the controller or business responsible for personal information processed for the Platform, except where another company independently determines how it handles information under its own privacy policy. This Policy applies to account holders, visitors, people communicating with support, and other individuals whose information is submitted through the Platform.

This Policy does not govern the independent handling of information by other users or third-party services. Users must handle information obtained through 2Help lawfully and in accordance with the Terms of Service and Community Guidelines.

The Identity Verification Privacy Notice supplements this Policy when you use identity verification powered by Didit. It explains the verification data flow, biometric processing, your choices, and retention and deletion. Read it before starting a verification.

2. Personal information we collect

Account and identity information

Telephone number, email address, authentication and verification status, account identifier, password hash where password login is used, linked Apple or Google account identifiers, account creation and login dates, and account status. We do not store your plain-text password.

Identity verification through Didit

When you start a Didit verification, the verification flow processes the identity document you submit, information extracted from it, selfie or liveness captures, and facial-comparison data, which can constitute biometric information. Technical session and security information is also processed. These materials are not public profile content.

2Help links the attempt to your account using a non-readable reference and retains a limited record: verification status, whether document, liveness, and face-match checks passed, service identifiers, dates, and limited failure and audit information. Our verification database does not store document images, extracted identity attributes, selfies, videos, biometric templates, or face-match scores. Provider responses are processed to obtain the limited result, not retained as raw evidence. Didit handles the underlying verification materials; the Identity Verification Privacy Notice explains the distinction.

Profile and public content

Name, profile photo and gallery files, date of birth where requested, biography, interests and tags, whether you request or offer help, business status, business description and website, ratings, and other information you choose to add. Depending on your settings and product flow, profile information and submitted content may be visible to other users.

Location information

A location you enter or select on a map; location labels; map place identifiers; and approximate or precise latitude and longitude when you grant device permission or select a point. The Platform may display location or distance information according to your selection and visibility settings. You can choose a location manually instead of granting device location permission.

Interactions and User Content

Requests, offers, selections, matches, relationship choices, messages, message attachments, reviews, ratings, blocks, reports, moderation records, and related timestamps and status information. Messages may be processed to deliver chat, prevent fraud and abuse, investigate reports, and enforce our policies.

Transaction and commercial information

If payment or subscription features are enabled: selected plan or product, store and product identifiers, price and currency shown by the store, transaction and subscription status, purchase and expiration dates, verification environment, provider transaction identifiers, refunds or revocations, and records required for accounting, fraud prevention, and legal compliance. Apple App Store and Google Play process your store account and payment instrument. 2Help receives the limited purchase information needed to verify the transaction and provide or restore the paid feature; we do not receive your Apple or Google password or full payment-card or bank credentials.

Device, network, and usage information

IP address, device and installation identifiers, operating system, app version, language, country, browser or user-agent information, push-notification token, session and security events, screens viewed, feature interactions, diagnostics, crash information, and server logs. Analytics data may be associated with an internal user identifier but must not intentionally include telephone numbers, email addresses, names, or precise location in analytics event fields.

Communications and support

Support requests, legal and privacy requests, survey responses, attachments you send, service messages, delivery status for email, SMS, or push notifications, and our response history.

Device permissions

With your permission, the app may access location to let you select what to share, photos or files that you choose to upload, the camera for identity-document and selfie or liveness capture, and notification capability to deliver service updates. A device permission is not a substitute for any separate consent required for biometric processing. We do not access your address book or device contacts as part of the current Platform functionality described by this Policy.

3. Sources of information

We collect information:

• directly from you when you register, create a profile, communicate, upload content, change settings, transact, or contact support;
• automatically from your device and use of the Platform;
• from Apple or Google when you choose their sign-in services, subject to your provider settings;
• from Didit when it returns the result of an identity verification you start;
• from payment, communications, mapping, analytics, security, and cloud providers that support the Platform;
• from other users who interact with, review, block, or report you; and
• from authorities or public sources where necessary to protect safety, investigate suspected illegality, or comply with law.

4. How we use personal information

• Provide the Platform: create and secure accounts, authenticate users, build profiles, support discovery and matching, display appropriate location information, deliver messages and files, maintain preferences, and provide support.
• Communicate: send one-time verification codes, security alerts, account notices, message and match notifications, support responses, policy updates, and product communications consistent with your preferences.
• Safety and integrity: prevent fraud, spam, harassment, abuse, unauthorized access, and policy violations; review reports; moderate content; enforce restrictions; protect users and the public; and preserve evidence.
• Identity verification: associate a verification with the correct account, confirm completion of the required identity checks, maintain an accurate verification status, address failed or disputed attempts, and reduce impersonation. A verified status is not a background check or a guarantee that a user is safe or trustworthy.
• Operate and improve: troubleshoot, analyze performance and feature use, improve reliability and matching, develop new features, conduct quality assurance, and maintain business records.
• Payments and compliance: facilitate enabled payment features, maintain transaction records, resolve payment issues, satisfy tax and accounting duties, respond to lawful requests, and establish, exercise, or defend legal claims.
• With consent: use information for another clearly disclosed purpose when you give valid consent and may withdraw it.

We do not use registration telephone numbers or email addresses for third-party advertising, and we do not allow other users to search for or view them merely because they have a 2Help account.

5. Legal bases for processing

Where data-protection law requires a legal basis, we rely on:

For identity verification, the basis for ordinary session and result data depends on the purpose: providing the requested verification feature, our legitimate interest in preventing impersonation and protecting accounts, or a specific legal obligation where one applies. Where biometric data is used to uniquely identify you and the GDPR or UK GDPR applies, the verification flow requires a separate special-category condition, normally your explicit consent under Article 9(2)(a), in addition to an Article 6 basis. Accepting general terms or allowing camera access does not supply that consent. See verification choices and consent.

6. What other users can see

Depending on your settings and use, other users may see your name, profile and gallery content, business information, interests, help preferences, rating information, approximate or selected location and distance, requests, offers, and messages you send to them.

A verification status or badge may also be visible where the product displays it. Other users do not receive your identity document, document number, date of birth extracted from that document, selfie or liveness capture, or biometric verification data.

7. How we disclose personal information

We disclose only what is reasonably necessary for the relevant purpose:

• Other users: information described above when you make it visible or communicate through the Platform.
• Cloud and communications providers: Amazon Web Services supports infrastructure, storage, SMS, push delivery, messaging, and safety or fraud-prevention functions.
• Identity and platform providers: Apple and Google support optional sign-in, app distribution, device services, and related authentication.
• Identity verification provider: Didit processes verification materials and returns verification results. We send a non-readable account reference and attempt metadata rather than registration contact details to create the session. Information you submit within the verification flow is processed by Didit as described in the Identity Verification Privacy Notice.
• Analytics and diagnostics: Google Firebase supports app analytics and performance measurement. We do not authorize analytics providers to use registration contact details for their own marketing.
• Website anti-spam: Google reCAPTCHA evaluates technical and interaction signals when a visitor submits the website contact form and returns a validity result, action, hostname, and risk score. We use that result only to prevent automated spam and abuse, not for advertising.
• Mapping providers: OpenStreetMap/Nominatim and, where enabled, map-platform providers process location queries or coordinates needed to provide place search, map display, and reverse geocoding.
• App stores and payment providers: Apple App Store, Google Play, or another payment provider named in the flow processes payment details and returns the product, transaction or subscription status, applicable dates, provider identifiers, and other limited information needed to verify and manage the purchase.
• Professional advisers and vendors: auditors, legal advisers, insurers, security specialists, and support vendors subject to appropriate duties.
• Legal, safety, and rights protection: authorities, courts, regulators, affected persons, or others when we reasonably believe disclosure is required by law or necessary to prevent serious harm, investigate fraud or illegality, enforce agreements, or protect rights and security.
• Business transfers: a prospective or actual acquirer, investor, lender, successor, or restructuring participant, subject to confidentiality and applicable notice or choice rights.
• At your direction: a recipient you select or another disclosure you expressly authorize.

When acting on our behalf, service providers are restricted to contracted purposes and must provide protections appropriate to the information and applicable law. A provider may separately act as an independent controller for specified processing. Didit's independent purposes, including certain security and model-improvement uses, and the related choices are explained in the Identity Verification Privacy Notice and Didit's own notices.

8. No sale or cross-context behavioral advertising

2Help does not sell personal information for money and does not share personal information for cross-context behavioral advertising or targeted advertising as those terms are defined by applicable U.S. state privacy laws. We have not done so in the preceding 12 months. We do not use sensitive personal information to infer characteristics for advertising, and we do not offer a financial incentive in exchange for personal information.

Where legally required, we treat a recognized browser-based opt-out signal, such as Global Privacy Control, as a request to opt out for that browser or device. Because we do not currently sell or share personal information for targeted advertising, there is no separate advertising opt-out necessary for current practices.

9. Sensitive information

Precise location, private messages, payment information, government identifiers, biometric information used for identification, and content revealing health, disability, religion, ethnicity, sexual orientation, or other protected characteristics may be sensitive under applicable law. We process sensitive information only when necessary for requested features, security, legal compliance, or another disclosed purpose, and with consent where required. The Identity Verification Privacy Notice includes specific biometric disclosures.

Do not submit sensitive information unless it is necessary. Interest selections may indirectly reveal sensitive characteristics; we use them for user-selected profile and matching functions, not to deny essential services or target third-party advertising.

10. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy. Retention depends on the type of information, account status, sensitivity, user expectations, operational need, legal requirements, dispute and limitation periods, fraud and safety risk, and whether information can be securely deleted or de-identified.

• Account, profile, and content information is generally retained while the account is active.
• Authentication challenges, session records, security logs, and device records are retained for limited periods appropriate to authentication, troubleshooting, and fraud prevention.
• Messages, reports, moderation records, and safety evidence may be retained after account deletion where necessary to protect users, investigate abuse, enforce policies, resolve disputes, or comply with law.
• Transaction, tax, accounting, and legal records may be retained for statutory periods.
• Backups are protected and deleted or overwritten through normal backup cycles; information is not restored to active use except for continuity, security, or legal reasons.

When retention is no longer justified, we delete or de-identify the information. De-identified information may be retained if we take reasonable measures to prevent re-identification.

Verification materials held for 2Help by Didit, including identity documents, selfies, liveness recordings, and associated biometric data, are subject to a maximum retention period of one year after completion of the attempt, or after its last activity if it is not completed, with earlier deletion when required. Limited status and audit records held by 2Help have a separate purpose-based retention period. Completing or closing a verification does not itself erase the provider's records. See the verification retention and destruction provisions, including stricter requirements where biometric privacy law applies.

11. Account deletion and data export

You can initiate permanent account deletion in the app from Profile → Settings → Delete account. The app shows affected information before confirmation and signs out active devices when deletion completes. Deleting the app alone does not delete your account.

If you cannot access the app, follow the external instructions in the Help Center or email support@2help.app from the registration email or identify the registration telephone number without sending authentication codes.

You may request an account data export from Profile → Support & legal → Request account data. We may need to verify identity before fulfilling an external request.

Deletion removes or de-identifies account-associated data from active use, subject to the limited retention grounds described above. Information other users independently copied or lawfully retained is outside our control. We may preserve a minimal record of a deletion request and enforcement status to demonstrate compliance and prevent abuse.

A local account or verification-record deletion is not, by itself, confirmation that Didit has erased its copies. To request erasure of identity-verification materials, contact support@2help.app. We will assess your request and coordinate the required provider-side action, including any separately retained biometric data within its scope. Do not email a copy of your identity document or selfie.

12. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to:

• know whether we process your information and access a copy;
• correct inaccurate information;
• delete information;
• receive portable information you provided;
• object to or restrict certain processing;
• withdraw consent;
• opt out of sale, targeted advertising, or qualifying profiling;
• appeal a refusal of a privacy request; and
• receive equal service and not be discriminated against for exercising a privacy right.

Exercise rights in the app where available or email support@2help.app. Describe the right and the account concerned. We will verify identity proportionately and respond within the period required by applicable law. An authorized agent may submit a request where permitted, but we may require proof of authority and direct identity confirmation.

If we deny a request, our response will explain available appeal options. You may appeal by replying with the subject “Privacy Appeal.” You may also complain to the data-protection, privacy, or consumer-protection authority with jurisdiction over you.

13. Additional U.S. state disclosures

For applicable U.S. state privacy laws, the categories collected during the preceding 12 months are identifiers; customer records; protected classification information if voluntarily provided or inferred from selected interests; commercial and transaction information; internet or network activity; approximate and precise geolocation; audio, electronic, visual, and similar content; professional or business information; sensitive personal information; and inferences used for matching, safety, and service operation.

We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them to the recipient categories in Section 7. We do not sell them or share them for cross-context behavioral advertising. These statements apply where the relevant law covers 2Help; we may voluntarily honor equivalent requests more broadly.

When you use Didit verification, the categories additionally include government-issued identifiers, document and face images or video, biometric information used for identification, and verification inferences and results. This is notice of that verification processing, not a statement that every user has supplied these categories or that they were all collected throughout the preceding 12 months.

14. International processing and transfers

2Help and its providers may process information in the United States, Israel, and other countries where privacy laws may differ from those in your location. Where required, we use recognized transfer mechanisms and safeguards, such as contractual protections, transfer assessments, adequacy mechanisms, and supplementary security measures.

Users in the European Economic Area, United Kingdom, or Switzerland may contact us for information about applicable safeguards and may complain to their local supervisory authority.

Didit and its providers may also process verification information internationally. The Identity Verification Privacy Notice explains the applicable safeguards and how to request more information.

15. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, credential protection, encryption in transit, restricted production access, monitoring, backups, and vendor oversight appropriate to risk. No system is completely secure. You must protect your device and authentication methods and report suspected compromise promptly.

If a personal-data breach creates a legally recognized risk, we will investigate and notify affected individuals and authorities as required by applicable law.

16. Automated processing

We may use automated signals to support matching, recommendations, spam and fraud detection, content moderation, security, and feature analytics. These systems may use location, interests, account activity, content signals, and interaction history. Material enforcement decisions may be appealed for review as described in our Terms and Guidelines.

Didit also uses automated document, liveness, and facial-comparison checks. 2Help uses confirmed results to determine verification status; incomplete or failed checks may prevent verified status. You may request review of a disputed result by contacting support. The Identity Verification Privacy Notice describes these checks, their consequences, and applicable rights concerning solely automated decisions.

17. Children

The Platform is intended only for people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has created an account or provided personal information, contact us so we can investigate and delete it as appropriate.

18. Website security, cookies, and analytics

The contact form uses score-based Google reCAPTCHA to distinguish legitimate submissions from automated spam without requiring a checkbox or visual challenge. When you submit that form, Google may process device, browser, network, application, and interaction information and may use strictly necessary cookies or similar technologies to provide the security service. 2Help receives the verification result and risk score; we do not store the reCAPTCHA token or score in the contact inbox. A submission that cannot be verified or falls below our security threshold is rejected before its contact-form contents are stored or emailed.

We rely on our legitimate interests in protecting the Platform, our communications systems, and recipients from spam and abuse. reCAPTCHA is a security control, separate from optional website analytics, and is not used by 2Help for advertising. Google's processing is governed by the Google Privacy Policy and Google Terms of Service.

The public legal pages do not load reCAPTCHA and do not currently require non-essential advertising cookies. Web servers may still receive IP address, browser information, requested URL, and timestamps in standard security and access logs. If we introduce non-essential cookies or web analytics requiring consent, we will provide required notice and controls before using them.

19. Changes to this Policy

We may update this Policy to reflect product, security, legal, or operational changes. We will post the revised version and update the effective date. Where required or where changes materially affect your rights, we will provide additional notice and obtain consent if required.

20. Contact