Privacy Policy.

Identifying data: full name, email, country of residence. Optional: address, postal code, phone.

Payment data (only for paid roles): IBAN/SWIFT/PAN/crypto wallet — collected when you add a payment method. Stored encrypted with AES-256-GCM.

Operational data: applications you submit, payouts, chat messages, audit-log events, session metadata (user agent, IP, login times).

Identity and contact: to evaluate applications and reach you about payouts.

Payment data: to execute manual withdrawals through the rail you choose.

Audit log: to maintain an immutable trail of who did what, for safety and finance reconciliation.

PII (address, postal code, phone) — encrypted at rest with AES-256-GCM (PII key).

Payment data — encrypted at rest with AES-256-GCM (separate PAYMENT key). Reveal requires a written reason that's logged with actor, timestamp, IP.

Passwords — argon2id, OWASP 2024 baseline parameters.

Refresh tokens — SHA-256 hashes only.

Workers see their own data. Curators see chat threads for assigned workers and basic profile data. Finance can see payout-relevant data including masked payment-method details; reveal requires a reason.

Admins can see everything but every access to sensitive fields is logged with the reason given.

We do not sell, share, or trade personal data for marketing. We disclose data only when legally compelled (court order, regulator), and where possible we notify the affected user.

Operational service providers may process data on our behalf for hosting, email delivery, security monitoring, accounting, and payment execution.

You can request a copy of all data we hold on you, ask us to correct it, or close your account. Outstanding payouts must complete first; after that, sensitive data is deleted within 30 days unless retention is legally required.

For UK/EU-style privacy requests, contact help@phylex.net. We will verify the requester's identity before exporting or deleting data.

We use first-party cookies for authentication (access token, refresh token), theme preference, and 2FA challenges. No third-party tracking or advertising cookies.

Operator: ISPLABS LIMITED, Company number 16958848, 128 City Road, London, United Kingdom, EC1V 2NX.

Privacy questions: help@phylex.net. Security and abuse disclosures: abuse@phylex.net.