Privacy policy

1. Who is responsible

JamaicaBoard is operated by DaBits Jamaica Ltd, a company registered in Jamaica, which is the data controller for the personal data described in this policy. We follow the data protection standards of the DPA, which is overseen by the Office of the Information Commissioner of Jamaica. Our Data Protection Officer can be reached at the email address at the end of this page.

2. What we collect

• Advertisers: email address, name, business name, descriptions, categories, parishes and areas served, WhatsApp and contact numbers, years of experience, opening hours and photos. If you continue with Google, we also receive your Google name and profile picture.
• Verification (optional): documents you upload to apply for the Verified badge, and notes made by our team when reviewing them.
• Reviewers: the email address used to confirm your review (see section 3), your star rating and comment.
• Customers searching: you do not need an account. We record the service and parish searched and taps on WhatsApp, call or share buttons, together with the site language and campaign tags.
• Technical data: a sign-in session cookie for pros, a language preference cookie, and a one-way hashed version of your IP address used only to prevent abuse. Your unfinished ad draft is saved in your own browser, not on our servers.

3. Reviews and email hashing

When you leave a review, we confirm your email address with a 6-digit code. The review is then stored with a one-way cryptographic hash of your email (a keyed fingerprint), not the email itself.

The hash lets us enforce fair limits — such as one review per person per listing in a given period — and detect fake reviews, without showing your email to the advertiser or the public. A hash cannot be turned back into your email address.

4. Email verification codes

• Codes are 6 digits, valid for 10 minutes, and allow a maximum of 5 attempts.
• We never store the code itself — only a keyed hash of it, so no one at JamaicaBoard can read your code.
• A code is invalidated the moment it is used successfully and can never be used again. Codes that fail to send are deleted immediately.
• The remaining record (the email address it was sent to, the hashed code, timestamps, attempt count and hashed IP address) is kept only as long as needed to enforce rate limits and prevent fraud.
• JamaicaBoard staff will never ask you for a code.

5. Why we use your data

We only collect what we need for these purposes and do not use your data for purposes that are incompatible with them.

• To publish your ad and let customers find and contact you — because you asked us to (performing our agreement with you).
• To sign you in securely and keep accounts, reviews and the platform free from fraud and abuse — our legitimate interest in a safe service.
• To verify pros who apply for a badge — with your consent, which you can withdraw.
• To show pros their own statistics and to understand which services are in demand in each parish — using de-identified or aggregated data where possible.
• To comply with the law and respond to lawful requests from authorities.

6. What is public

Your ad is public: business name, description, trades, parishes, WhatsApp and contact number, photos, badges, reviews and your replies. The mobile number you sign in with is not shown unless you also use it as your contact number. Reviewers' phone numbers are never shown.

7. Who we share data with

We do not sell, rent or trade personal data — to anyone, ever. We share data only with service providers that process it on our instructions and under confidentiality and security obligations:

• Hosting and database providers that run JamaicaBoard.
• Cloudflare, which stores photos and files (verification documents are kept in private storage that only authorised staff can open).
• Email delivery providers, which receive your email address and the code to deliver it. Google, only if you choose "Continue with Google".
• AI providers (Anthropic or Google), which receive only the business details you type when you tap "Write it for me", to generate a suggested description.
• Analytics: we run our own Umami analytics, which does not use cookies. If advertising measurement is enabled, Meta and TikTok pixels receive information about page visits and actions on JamaicaBoard to measure our advertising campaigns.
• Authorities, courts or regulators when the law requires it, or to protect someone's safety.

8. Transfers outside Jamaica

Some of our providers store or process data outside Jamaica, for example in the United States. As required by the DPA, we only transfer personal data to countries or providers that ensure an adequate level of protection, using contractual and technical safeguards.

9. How long we keep data

• Your ad and account: while your account is active. When you ask us to delete it, your ad is removed from public view immediately and your data is deleted from our systems within 30 days, except where we must keep limited records by law or for an active dispute.
• Verification documents: only as long as needed to decide on and evidence the verification.
• Reviews: while the listing exists, unless removed through moderation or at your request.
• Sign-in sessions: expire after 30 days without use, or immediately when you log out.
• Search and contact statistics: kept in aggregated form to measure demand; they do not identify customers.
• Moderation and security logs: kept as long as needed to protect the platform and meet legal obligations.

10. How we protect data

We use encrypted connections (HTTPS), hashing for codes, reviewer emails and IP addresses, private storage for sensitive documents, two-factor authentication and audit logs for our admin team, and rate limits against abuse.

If a data breach affects your personal data, we will notify the Information Commissioner within 72 hours of becoming aware of it and inform you where required by the DPA.

11. Your rights under the Data Protection Act, 2020

You can exercise these rights free of charge by emailing our Data Protection Officer. We may need to confirm your identity (usually with a code sent to your email) and will respond within 30 days.

• Access: be told whether we process your data and receive a copy of it, with information about how it is used.
• Correction: have inaccurate or incomplete data corrected — you can edit most of your ad yourself in your dashboard.
• Erasure: ask us to delete your data where we no longer have a valid reason to keep it.
• Objection: ask us to stop processing that is likely to cause you substantial damage or distress.
• Direct marketing: tell us at any time to stop sending you marketing messages.
• Automated decisions: JamaicaBoard does not make decisions with legal or similarly significant effects about you based solely on automated processing.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time.
• Complain: you can complain to the Office of the Information Commissioner of Jamaica. We would appreciate the chance to resolve your concern first.

12. Cookies and local storage

• Session cookie (pros only): keeps you signed in. Essential.
• Language cookie: remembers English or Spanish for up to one year. Essential.
• Ad draft: saved in your browser's local storage on your own device so you don't lose your progress.
• Advertising pixels (Meta, TikTok), if enabled: you can limit them through your browser settings and your Meta and TikTok ad preferences.

13. Children

JamaicaBoard is not intended for people under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. We will show the date of the latest version at the top of this page and, for significant changes, tell you on the site or by email.