1. Introduction

This Privacy Policy explains how Urban Mechanics LTD (company number 10959925), trading as KidsHustle, collects, uses, stores, and shares your personal data when you use our Platform. Our registered address is 55 King William Street, London, EC4R 9AD. You can contact us at support@kidshustle.app.

KidsHustle is specifically designed for young people aged 13 to 17 and their parents or guardians. We take the protection of children's personal data extremely seriously and have designed our systems with privacy and safety as core principles.

2. Personal Data We Collect

2.1 At registration

When you create an account, we collect:

• Display name
• Email address
• Password (stored in a securely hashed format; we never store plaintext passwords)
• Authentication provider details (Google ID or Apple ID, if applicable)
• User type (Teen or Parent)

2.2 Date of birth

Teen accounts are asked for a date of birth immediately after registration, in a separate step, before the account can be used for anything other than browsing. We do not show your date of birth to other users and we do not include it in analytics. Where we need to report your age for product measurement, we send the age in years, not the date.

2.3 Identity verification

Identity verification is carried out by Stripe Identity and involves submitting a government-issued identity document. We never receive or store images of the document — Stripe processes it and returns only the verified name, and where relevant a confirmed date of birth.

This applies to Parent Users and Job Owners, who must verify before they can post jobs or move money. It also applies to Teen Users aged 16 or 17 who use the Platform independently, who verify their own age with their own identity document in order to do so.

Where a child submits their own identity document, that document is processed by Stripe under their own policy, is not retained by us, and is used only to confirm that the stated date of birth matches the document and falls in the permitted range.

2.4 Payment and financial information

Payment processing is handled entirely by Stripe. We store only the identifiers necessary to manage your relationship with the payment system (such as customer and account reference numbers). We do not store card numbers, bank account numbers, or other financial credentials.

2.5 Family data

When a Teen User joins a Family, we store the family identifier, parent user identifier, teen user identifiers, the Family Join Code, and job application records associated with the Family.

A Teen User who uses the Platform independently has no Family and no family identifier, and consequently has no parent approval, no parent message visibility and no parent location visibility.

2.6 Location data

When a Teen User begins an active job, we collect precise GPS real-time location data. This data is:

• Visible only to the Teen User's parent or guardian within their Family;
• Used to power a geofencing system that alerts the parent if the Teen leaves a defined radius around the job location;
• Stored as the most recent position for the job, rather than as a continuous movement history; and
• Accompanied by a record of geofence entry and exit events for the job, comprising the location, radius, accuracy and timestamp of each crossing.

Location data is retained for as long as the job record exists, and geofence event records are retained indefinitely. A 21-day deletion process for both is being implemented; until it is in place, this paragraph describes what currently happens.

No other users, including Job Owners, can access a Teen User's location data.

2.7 Content and communications

We collect and store job listings, job applications, reviews and ratings, profile pictures, in-app chat messages between Teen Users and Job Owners, and reports and support communications.

2.8 Device and technical data

We collect device and technical information including device model and operating system version, app version and build, IP address, crash reports, network request traces, and application logs.

We also use device attestation — Apple's DeviceCheck on iOS and Google's Play Integrity on Android — on authenticated requests, to confirm that requests come from a genuine, unmodified app on a genuine device. This is an anti-fraud and anti-abuse measure.

2.9 Analytics, session recordings and marketing measurement

We use PostHog for product analytics, feature flags and session recordings. Session recordings replay how a user moved through the app and are used only for debugging and quality assurance. Sensitive inputs are masked before a recording is stored, including dates of birth, passwords and location-sharing tokens.

Analytics events are linked to your user identifier. This is pseudonymised personal data, not anonymous data, and it remains subject to this policy and to your rights under it.

We use New Relic for application performance monitoring, crash reporting and automatic collection of application logs from both development and release builds of our mobile apps. We use Linkrunner on our iOS app to measure the effectiveness of our own marketing — specifically, which campaign or link led to an app install, and which actions followed it. This involves sending aggregated conversion signals to advertising platforms through Apple's SKAdNetwork framework. Marketing measurement is not applied to our Android app, which carries no attribution SDK.

To be precise about what this does and does not mean: we do not show you advertising inside KidsHustle; we do not build behavioural profiles of children, and we do not use your data to target advertising at you or at anyone else; and we do not sell your personal data. We do measure how well our own marketing works, which is a tracking technology, and we think you should be told that plainly rather than read that we use none.

2.10 Referral and creator programme

We operate a referral and creator programme under which third parties — including influencers and content creators — may promote KidsHustle using unique links and discount codes, and may be paid by us when their link or code leads to a signup or a completed job.

Where you arrive via such a link or code, we record the attribution so that we can pay the referrer correctly. The referrer receives aggregated performance statistics only — numbers of installs, signups and jobs. They never receive your identity, contact details or any other personal data. Promotional content published by creators under this programme is paid-for advertising and is required to be disclosed as such.

3. How We Use Your Data

3.1 Running the Platform

We use your data to create and manage your account, verify your identity (Parent Users), facilitate jobs, process payments, enable messaging, provide real-time location tracking to parents, and display your profile to other users where appropriate.

3.2 Safety and moderation

We use your data to moderate job listings and other text with AI-powered content analysis (Google Gemini), scan uploaded images for harmful content (Sightengine), filter chat messages through automated moderation, investigate reports and complaints, resolve disputes, detect and prevent fraud and abuse, and make safeguarding referrals where a child may be at risk.

3.3 Support

We use your data to answer your questions and resolve problems, through Intercom and its AI support agent, and through our own in-app support ticket system. Content you send to support may be processed by Google Gemini to draft or suggest a reply. A human handles anything involving a safety concern.

3.4 Analytics and improvement

We use analytics to understand how users interact with the Platform, identify and fix bugs, manage feature rollouts, and improve the overall user experience. We do not sell, rent, or share analytical data with any third party for advertising or marketing purposes.

3.5 Engagement features

We operate optional badges and challenges that recognise completed work — for example, a badge for a number of jobs completed, or for completing jobs consistently over a period. These use your job completion history. Our approach to these features, and why we consider them to be in a child's interests, is set out in our GDPR Compliance Statement.

4. Lawful Basis for Processing

Contract (Article 6(1)(b))

Processing your account data, payment information, job data and communications is necessary for the performance of our contract with you. For Teen Users we recognise the limitations on contracting with a minor: the contract is formed with the parent or guardian where one is linked, and we rely additionally on legitimate interests. For an independent Teen User aged 16 or 17, the contract is formed with the Teen User directly, which is one reason that route is limited to that age band and requires verified age.

Legitimate Interests (Article 6(1)(f))

We rely on legitimate interests for safety and moderation; fraud prevention and device attestation; analytics, session recordings and product improvement; marketing measurement; location tracking during jobs; and engagement features. We have completed a Legitimate Interests Assessment for each, and in every case the balancing test treats the best interests of the child as the primary consideration. You may object to any of these at any time.

Legal Obligation (Article 6(1)(c))

We may process data where required by law, such as for tax reporting, fraud prevention, safeguarding obligations, or to respond to valid legal requests from authorities.

Consent

Where we rely on consent, we will ask for it separately and clearly. Consent can be withdrawn at any time by contacting support@kidshustle.app.

This includes non-essential analytics technologies on our website, where consent is required under Regulation 6 of PECR. Withdrawing consent does not affect processing that relies on another basis.

Vital interests (Article 6(1)(d)). We may process data in an emergency where someone's life or physical safety is at risk.

5. Data Sharing and Third Parties

We share personal data with third-party processors who act on our documented instructions under a Data Processing Agreement. The categories are: payment processing and identity verification; cloud infrastructure; AI text moderation and AI support; image moderation; chat infrastructure; search infrastructure; product analytics and session recording; application performance monitoring and log collection; customer support; transactional email; push notification delivery; marketing automation; marketing attribution; and bot and abuse prevention.

A full, up-to-date list of our sub-processors is maintained at kidshustle.app/sub-processors. We do not sell your personal data to any third party and do not share it with advertisers.

6. International Data Transfers

Our core infrastructure and database are hosted in the European Union (Google Cloud, Belgium and Finland). Our product analytics (PostHog) and application monitoring (New Relic) are also EU-hosted. Some processors operate outside the UK and EU, including in the United States — Stripe, Intercom, Postmark, Apple Push Notification Service, Firebase Cloud Messaging, Cloudflare and Google Play Integrity. Where data is transferred to a country without a UK adequacy decision we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and we carry out a Transfer Risk Assessment for each transfer. The per-processor position is set out at kidshustle.app/sub-processors.

7. Data Retention

• Account data: Retained for the duration of your account, plus 30 days after deletion.
• Location data: Retained for as long as the job record exists; geofence event records are retained indefinitely. A 21-day deletion process is being implemented.
• Chat messages: Retained for 12 months after the job is completed or cancelled.
• Job records and payment history: Retained for 6 years after the end of the relevant tax year (HMRC requirements).
• Session recordings and analytics: Retained for up to 12 months.
• Identity verification records: Managed by our payment partner in accordance with their policy.

We also retain: date of birth, reviews and ratings for the life of the account; uploaded profile and job-evidence images for the life of the associated record, with images sent for moderation not retained by the moderation provider; support tickets and conversations for 3 years from closure; application logs and crash reports for 90 days; moderation and safeguarding records for 7 years where needed to evidence a safeguarding decision; and referral attribution records for 6 years, as they support payments to referrers. Where a period above is longer than you might expect, it is usually because the record is also financial or safeguarding evidence. When a retention period ends, the data is deleted or irreversibly anonymised.

8. Your Rights Under UK GDPR

You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests — including our analytics, our marketing measurement and our engagement features. You also have rights in relation to automated decision-making, which are set out in section 9. A parent or guardian may exercise these rights on behalf of a linked Teen User, and a Teen User may exercise them for themselves. To do either, contact us at support@kidshustle.app. We will respond within one month.

9. Automated Decision-Making

Some decisions on the Platform are made by automated systems. Where that is the case we set it out below, and you always have the right to ask a human to review the decision. To do so, contact support@kidshustle.app.

Job listing moderation. Listing text is analysed by Google Gemini against our content policy, and a listing may be refused publication. You can reply to the refusal or email support to have it looked at by a person.

Image moderation. Uploaded images are scored by Sightengine for nudity, offensive content and graphic violence against fixed thresholds, and an image may be refused. Email support to have a refusal reviewed.

Chat message filtering. Messages are screened automatically before delivery, and a message may be withheld from the recipient. At present the sender is not notified when this happens. We are changing this so that a sender is told when a message of theirs has been withheld and can ask for it to be reviewed.

Dispute resolution. Where a Job Owner rejects completed work and the Teen User escalates, an automated assessment produces a first decision, which may determine whether and how much a Teen User is paid. Either party may request human review, which we will carry out.

Account flagging. Reports accumulate against content and users, and a threshold escalates the matter for human review. The escalation is automated; suspension and termination are decided by a person.

Fraud and device checks. Device attestation and fraud signals may block a request, and a request may be refused. Email support if you believe a refusal is wrong.

No decision that is solely automated and has a legal or similarly significant effect is made about a child without a route to human review.

10. Children's Privacy

KidsHustle is designed for users aged 13 to 17, and is not intended for children under 13. Thirteen is the age at which a child in the UK can consent to processing by an information society service, under Art 8 UK GDPR and s.9 of the Data Protection Act 2018. If you believe a child under 13 has created an account, tell us at support@kidshustle.app and we will delete it and the associated data.

11. Cookies and Similar Technologies

Our Platform and website use strictly necessary cookies and similar technologies for authentication, session management and security. These do not require your consent. We also use non-essential analytics technologies. Consent is required for these under Regulation 6 of PECR; a consent mechanism is being implemented and is not yet in place. We do not use advertising or cross-site tracking cookies.

12. Security

We use technical and organisational measures appropriate to the risk, including password hashing, TLS in transit, encryption at rest, EU-hosted infrastructure, PCI-DSS compliant payment processing handled entirely by Stripe, role-based internal access control, device attestation on authenticated requests, and automated masking of sensitive data in analytics and session recordings.

No system is perfectly secure. If a personal data breach occurs we follow the breach procedure set out in our GDPR Compliance Statement.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect.

14. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). We would, however, appreciate the opportunity to address your concerns first at support@kidshustle.app.

15. Contact Us

1. Introduction and Acceptance

These Terms of Service ("Terms") govern your access to and use of the KidsHustle platform ("Platform"), operated by Urban Mechanics LTD, a company registered in England and Wales (company number 10959925), with a registered address at 55 King William Street, London, EC4R 9AD.

KidsHustle is a freelancing platform designed exclusively for young people aged 13 to 17 ("Teen Users") in the United Kingdom, connecting them with parents and guardians ("Parent Users") and local job opportunities.

By creating an account or using the Platform, you confirm that you have read, understood, and agree to be bound by these Terms. If you are a Teen User, your parent or guardian must also create an account and approve your use of the Platform. If you do not agree to these Terms, you must not use the Platform.

2. Definitions

• Platform: The KidsHustle mobile application, website, APIs, and all related services.
• Teen User: A registered user aged 13 to 17 who performs jobs posted on the Platform.
• Parent User: A registered user who is the parent or legal guardian of one or more Teen Users, or a Job Owner who posts jobs on the Platform.
• Family: A linked group consisting of one Parent User and one or more Teen Users, joined via a unique Family Join Code.
• Job: A task posted by a Parent User (Job Owner) for a Teen User to complete in person.
• Payment Hold: The mechanism by which the job amount is committed by the Job Owner before work begins, and released on completion. For most Job Owners this is an authorisation placed on their payment method, captured when the job is approved. Job Owners who still hold a balance from an earlier top-up instead have the job amount moved out of that balance and held by the Platform from the moment the job is posted until the job is completed or cancelled. This applies until their top-up balance is used up.
• Cooldown Period: The 14-day waiting period after funds are deposited before a Teen User can initiate a payout.
• Content: Any text, images, reviews, messages, profile information, or other material uploaded through the Platform.

3. Eligibility and Account Registration

3.1 Age Requirements

• Teen Users must be aged 13 to 17 at the time of registration.
• Parent Users must be aged 18 or over and must be the legal parent or guardian of any Teen User they add to their Family.
• Users outside the United Kingdom may not use the Platform.

3.2 Account Creation

To use the Platform, you must create an account with accurate and complete information. You may register via email, Google, or Apple. Parent Users are required to complete identity verification through our payment partner before they can post jobs or manage payments.

3.3 Family structure and independent accounts

Teen Users must join a Family by entering a Family Join Code provided by their parent or guardian. By joining, the parent or guardian confirms they consent to the Teen User's use of the Platform, have read and agree to these Terms on behalf of the Teen User, accept responsibility for overseeing the Teen User's activity, and consent to the processing of the Teen User's personal data as described in our Privacy Policy.

A Teen User aged 16 or 17 may instead use the Platform independently, without joining a Family, where they have verified their age with an identity document. An independent Teen User has no parent or guardian linked to their account, and accordingly there is no parent approval of applications, no parent visibility of messages and no parent visibility of location. This route is available only to 16 and 17 year olds.

3.4 Account Security

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Notify us immediately at support@kidshustle.app if you suspect unauthorised access.

4. How the Platform Works

4.1 Job Posting

Parent Users (Job Owners) may post in-person job opportunities on the Platform. All jobs must be for legitimate, lawful tasks suitable for young people aged 13 to 17 and must comply with UK child employment laws.

4.2 Job Application and Approval

When a Teen User wishes to apply for a job, the application is first sent to their parent or guardian for approval. If the parent approves, the application is submitted to the Job Owner, who may then accept or decline it.

4.3 Payments, fees and the Payment Hold

A 12.5% service fee is payable by the Job Owner in addition to the job amount.

When a Job Owner takes on a Teen User, the total is committed through a Payment Hold, before work begins, and the Teen User can see that the commitment has been made.

For most Job Owners the Payment Hold is an authorisation on their payment method: the amount is reserved against their card and taken when the job is approved. The Platform does not hold the money in the meantime. Job Owners who still have a balance from an earlier top-up instead have the job amount moved out of that balance and held by the Platform from the moment the job is posted until the job is completed or cancelled. That applies until their top-up balance is used up.

On completion and approval, the job amount is released to the Teen User's connected payment account. A 14-day Cooldown Period then applies before the Teen User may initiate a payout to their bank account, so that any dispute can be resolved first.

We take no fee from the Teen User. The service fee is paid by the Job Owner and is never deducted from a Teen User's earnings.

A Payment Hold is a commitment, not a guarantee against every eventuality: an authorisation can fail at the point of capture — for example if a card has expired or been cancelled. Where that happens we will tell both parties and work to resolve it, and the Teen User's completed work remains a debt owed by the Job Owner.

4.4 Fee waivers and discount codes

We may from time to time waive or discount the service fee, including through promotional or referral codes. Where a fee has been waived or discounted, nothing in section 8 requires us to charge it. Codes may carry eligibility conditions, usage limits and expiry dates, which are stated when the code is offered.

4.5 Messaging

In-app messaging between a Teen User and a Job Owner is available only in the context of an active job. The Teen User's parent or guardian has full visibility of all messages. Messaging is subject to automated moderation.

4.6 Location tracking

When a Teen User starts an active job, real-time location tracking is enabled. Only the Teen User's parent or guardian within their Family can view this location. A geofencing system alerts the parent if the Teen leaves a defined radius around the job location.

4.7 Reviews

Reviews and ratings may be left only by a party to a completed job, and must reflect genuine experience. We prohibit fake reviews, reviews written in exchange for payment or any other incentive without that incentive being disclosed, and reviews posted by anyone with an undisclosed connection to the party being reviewed. We take reasonable and proportionate steps to detect and remove such reviews. If you believe a review is fake or incentivised, report it to support@kidshustle.app and we will investigate and remove it where appropriate.

4.8 Dispute resolution

If a Job Owner declines the result of a completed job and the Teen User escalates the dispute, the matter is first reviewed by our automated dispute resolution system. If unsatisfied, either party may request human review.

The first assessment of a dispute may be produced by an automated system. Either party may request that the decision be reviewed by a person, and we will carry out that review. Section 9 of our Privacy Policy sets out the automated decisions we make and your rights in relation to them.

5. User Conduct

5.1 General Obligations

All users agree to provide accurate and truthful information, use the Platform only for its intended purpose, treat all other users with respect and courtesy, comply with all applicable UK laws and regulations, and not attempt to circumvent any safety or security features.

5.2 Prohibited Conduct

The following conduct is strictly prohibited:

• Creating a false or misleading account, including misrepresenting your age, identity, or relationship to a Teen User;
• Posting jobs that are unlawful, unsafe, exploitative, or inappropriate for young people;
• Contacting or attempting to contact a Teen User outside the Platform;
• Sharing, requesting, or exchanging personal contact information through Platform messaging;
• Uploading or transmitting content that is sexually explicit, violent, hateful, discriminatory, defamatory, or otherwise harmful;
• Harassing, bullying, threatening, or intimidating any user;
• Attempting to arrange meetings with Teen Users outside the context of an accepted job;
• Using the Platform for any form of money laundering, fraud, or financial crime; and
• Interfering with or disrupting the Platform's infrastructure or security systems.

6. Content and Intellectual Property

6.1 User Content

You retain ownership of Content you upload. By uploading Content, you grant us a worldwide, non-exclusive, royalty-free licence to use, display, reproduce, and distribute it within the Platform to provide our service. All Content is subject to automated moderation.

6.2 Platform Intellectual Property

The KidsHustle name, logo, design, software, and all associated intellectual property are owned by Urban Mechanics LTD. Nothing in these Terms grants you any right to use our intellectual property.

7. Working Hours and Child Employment

• Jobs may only be posted for times between 7:00 AM and 7:00 PM;
• Teen Users aged 13 to 15 who are still of compulsory school age are subject to additional working hour restrictions under local authority bylaws;
• Teen Users aged 16 to 17 must not work more than 8 hours per day or 40 hours per week under the Working Time Regulations 1998;
• Compliance with child employment law is primarily the responsibility of the Job Owner, as the person engaging the Teen User; and
• The Platform does not constitute an employer of any Teen User.

Work permits. Under the Children and Young Persons Act 1933 and local authority byelaws, where a child of compulsory school age is employed it is the employer who must obtain a local authority work permit, normally within seven days of the child starting work. If you are a Job Owner engaging a Teen User of compulsory school age, obtaining any required permit is your responsibility. Children under 13 may not be employed in any capacity. The occupations permitted for 13 year olds are set by each local authority and vary, and some authorities set a higher minimum age. The Platform does not obtain permits on your behalf and does not verify that one has been obtained.

8. Fees and Charges

The Platform charges a 12.5% service fee on top of the job amount, payable by the Job Owner. The fee may be waived or discounted as described in section 4.4. Once work has commenced the fee is non-refundable, except where you cancel under section 9 or where a refund is required by law. No fee is charged to Teen Users, and nothing is deducted from a Teen User's earnings.

9. Cancellation and Your Statutory Rights

Where you contract with us at a distance as a consumer, you have a statutory right to cancel within 14 days under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.

Where you ask us to begin providing the service during that 14-day period and the service is fully performed within it, the right to cancel ends once performance is complete. Where performance has begun but is not complete, you may still cancel, and you will be charged only for what has been provided up to that point.

A job that has been posted but not started may be cancelled, and the Payment Hold is released in full. Where a Teen User has already begun work, the Teen User is entitled to be paid for the work they have done. To cancel, contact support@kidshustle.app. Nothing in these Terms affects your statutory rights.

10. Limitation of Liability

To the fullest extent permitted by law, Urban Mechanics LTD is not liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Platform; we do not guarantee the quality, safety, or legality of any job posted; we are not responsible for the conduct of any user; and we do not act as an employer, employment agency, or recruitment service.

Our total aggregate liability to you shall not exceed the total fees paid by you to the Platform in the 12 months preceding the claim. Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, fraud, or any other liability that cannot lawfully be excluded.

11. Account Suspension and Termination

We may suspend or terminate your account if you breach these Terms, if we reasonably believe your account poses a risk to the safety of other users, if you fail to complete identity verification (Parent Users), or if required by law. Account deletion requests are subject to a 30-day grace period.

12. Modifications to the Terms

We may update these Terms from time to time. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect.

13. Complaints

Complaints about the Platform go to support@kidshustle.app. We aim to acknowledge a complaint within one working day and to resolve it within 14 days. Our reporting and complaints process, including reports about harmful or illegal content, is described in the Safety Notice.

14. Governing Law and Jurisdiction

These Terms are governed by and construed in accordance with the laws of England and Wales. Any disputes arising from these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact Us

1. Our Commitment to Safety

The safety and wellbeing of the young people who use KidsHustle is our highest priority. This Safety Notice explains the measures we have in place to protect Teen Users aged 13 to 17, the responsibilities of all parties, and what to do if something goes wrong.

2. Built-In Safety Features

2.1 Parental Oversight

Every Teen User must be part of a Family on the Platform. This means a parent or guardian must approve every job application, can view all in-app messages, can see their Teen's real-time GPS location during active jobs, receives alerts if their Teen leaves a defined area (geofencing), has visibility over earnings and completed jobs, and can remove their Teen from the Platform at any time.

2.2 Identity Verification

All Parent Users must complete identity verification before they can interact with Teen Users or post jobs. This involves verifying a government-issued identity document through our payment partner's verification service.

2.3 Content Moderation

We employ multiple layers of automated content moderation:

• Job listings are scanned by AI-powered safety systems to detect inappropriate, exploitative, or unsafe content.
• All images uploaded to the Platform are scanned for nudity, violence, hate symbols, weapons, drugs, and other harmful content.
• Chat messages are filtered through automated moderation. Messages flagged as inappropriate are shadow-blocked (hidden from the recipient without notifying the sender).

2.4 Working Hours Protection

Jobs can only be posted for times between 7:00 AM and 7:00 PM, in line with UK child employment regulations.

2.5 Financial Safeguards

The job amount is committed by the Job Owner before work begins, through a Payment Hold, and a Teen User can see that the commitment has been made before starting. On completion and approval it is released to the Teen User's own payment account, followed by a 14-day Cooldown Period during which a dispute can be raised.

Neither party ever sees the other's financial details. All payment handling is by Stripe.

What a Payment Hold is, and what it is not. For most Job Owners it is an authorisation against their card, taken when the job is approved — the Platform does not hold the money in between. It is a strong commitment, and it means a Teen User is not starting work on nothing but a promise. It is not an absolute guarantee: an authorisation can fail at the point of capture, for instance on a card that has expired or been cancelled.

If that happens we tell both parties straight away and work to resolve it, and the Teen User's completed work remains money owed to them by the Job Owner. We will not treat a failed capture as the teen's problem.

2.6 Communication Controls

Chat is only available within the context of an active job, parents can see all messages, automated moderation filters are applied, and sharing personal contact information through the chat is prohibited.

3. Reporting and Escalation

3.1 How to Report a Concern

• Report a user, job listing, or review directly through the app;
• Contact our support team at support@kidshustle.app; or
• In an emergency, always call 999 or contact your local police.

3.2 How We Handle Reports

When a report is made, the reported content or user is flagged in our system. Reports accumulating multiple flags are escalated for human review. We may suspend or terminate accounts. Where appropriate and legally required, we will report concerns to relevant authorities. We will not inform the reported party of the identity of the person who made the report.

3.3 Safeguarding Referrals

If we become aware of any concern regarding the safety or welfare of a child, we may suspend the relevant accounts immediately, report the concern to the relevant local authority children's services, and cooperate fully with any investigation by authorities.

4. Responsibilities of Parent Users

5. Responsibilities of Teen Users

6. Responsibilities of Job Owners

7. In-Person Job Safety

All jobs on the Platform are in-person. We strongly recommend:

• Parents accompany younger teens (aged 13–14) to and from job locations, especially for first-time jobs or unfamiliar Job Owners.
• Jobs take place in safe, accessible, and where possible, public or semi-public locations.
• Teens carry a charged mobile phone at all times during a job.
• Parents use the in-app location tracking and geofencing features to monitor their child's safety.

8. Emergency Contacts and Resources

• Childline: 0800 1111 (free, available 24/7)
• NSPCC Helpline: 0808 800 5000
• Police non-emergency: 101
• KidsHustle Support:support@kidshustle.app

9. Contact Us

1. Introduction

This GDPR Compliance Statement describes how Urban Mechanics LTD (company number 10959925), trading as KidsHustle, meets its obligations under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

KidsHustle is an online service specifically designed for children aged 13 to 17. As such, we are subject to the ICO's Age Appropriate Design Code (Children's Code) and apply enhanced protections to children's personal data throughout our systems and processes.

2. Data Controller Information

• Controller: Urban Mechanics LTD
• Company Number: 10959925
• Registered Address: 55 King William Street, London, EC4R 9AD
• Contact Email:support@kidshustle.app

Urban Mechanics LTD does not currently have a designated Data Protection Officer (DPO). For all data protection enquiries, please contact support@kidshustle.app.

3. Data Protection Principles

We adhere to the seven key principles of the UK GDPR:

Lawfulness, Fairness, and Transparency

We process personal data lawfully, fairly, and in a transparent manner. Our Privacy Policy clearly explains what data we collect, why we collect it, and how it is used. We communicate with Teen Users in plain, understandable language.

Purpose Limitation

We collect personal data only for specified, explicit, and legitimate purposes: operating the Platform, facilitating jobs, processing payments, ensuring safety, and improving the service. We do not use data for any other purpose, including advertising or profiling.

Data Minimisation

We collect only the personal data strictly necessary to operate the Platform and protect the safety of our users. We do not encourage Teen Users to provide unnecessary personal information.

Accuracy

We take reasonable steps to ensure that personal data is accurate and up to date. Users can update their information through the Platform at any time.

Storage Limitation

We retain personal data only for as long as necessary. Location data, for example, is deleted 21 days after job completion. Specific retention periods are set out in our Privacy Policy.

Integrity and Confidentiality (Security)

We implement appropriate technical and organisational measures, including:

• Passwords stored using industry-standard cryptographic hashing
• All data transmitted over HTTPS/TLS
• Server infrastructure hosted on EU-based cloud platforms
• PCI-DSS compliant payment processing
• Role-based access controls for internal data access
• Automated masking of sensitive data in analytics and session recordings

Accountability

We are responsible for, and able to demonstrate compliance with, the UK GDPR. This document, our Privacy Policy, and our internal records of processing activities form part of our accountability framework.

4. Lawful Bases for Processing

4.1 Contract (Article 6(1)(b))

Account management, job facilitation, payment processing, and communications are necessary for the performance of our contract with users. For Teen Users aged 13 to 17, we additionally rely on legitimate interests, noting that parental consent and oversight is required, we process only data strictly necessary for the service, enhanced safety and privacy protections are in place, and the Teen User's best interests are always the primary consideration.

4.2 Legitimate Interests (Article 6(1)(f))

We rely on legitimate interests for the following, having conducted a Legitimate Interests Assessment (LIA) for each:

• Safety and content moderation: Legitimate interest in maintaining a safe platform for minors.
• Analytics: Legitimate interest in maintaining a stable, functional platform. Sensitive data is automatically masked.
• Fraud prevention: Legitimate interest in protecting the Platform and its users from abuse.
• Location tracking during jobs: Legitimate interest in protecting the physical safety of Teen Users. Access is strictly limited to the Teen's parent or guardian.

4.3 Legal Obligation (Article 6(1)(c))

We process data where required by law, including financial record-keeping (HMRC requirements), responding to court orders, and safeguarding referrals.

5. Children's Data and the Age Appropriate Design Code

As an online service specifically designed for children, we conform to the ICO's Age Appropriate Design Code across all 15 standards:

Standard 1: Best Interests of the Child

The best interests of the child are a primary consideration in all our design decisions and data processing activities.

Standard 2: Data Protection Impact Assessment

We have undertaken a Data Protection Impact Assessment (DPIA) for our processing of children's personal data. This assessment is reviewed and updated periodically.

Standard 3: Age-Appropriate Application

We verify the age of users at registration through a date of birth picker. Users under 13 are not permitted to create accounts.

Standard 4: Transparency

Our Privacy Policy and Terms of Service are written in clear, accessible language. We provide an additional plain-language summary written specifically for Teen Users.

Standard 5: Detrimental Use of Data

We do not use children's data in any way that has been shown to be detrimental to their wellbeing. We do not build behavioural profiles, use nudge techniques, or serve advertising.

Standard 6–8: Policies, Default Settings, Data Minimisation

Our Terms set out standards of behaviour. All settings are high privacy by default — Teen Users' location is never shared beyond their parent or guardian. We collect only the minimum data necessary.

Standard 9: Data Sharing

We share data with third-party processors only where strictly necessary. A full list of sub-processors is maintained at kidshustle.app/sub-processors.

Standard 10: Geolocation

Geolocation tracking is active only during jobs and is visible only to the Teen's parent or guardian. Location data is deleted 21 days after job completion. No default "always-on" tracking exists.

Standard 11: Parental Controls

Parents have comprehensive controls: they approve job applications, view messages, monitor location, and can remove their child from the Platform at any time.

Standard 12: Profiling

We do not engage in profiling of children. Analytics data is used only in aggregate form for product improvement.

Standard 13–14: Nudge Techniques & Connected Devices

We do not use nudge techniques. The Platform does not interact with connected toys or devices.

Standard 15: Online Tools

We provide accessible tools for users to exercise their data rights, including account deletion and data access requests via support@kidshustle.app.

6. Data Processing Records

In accordance with Article 30 of the UK GDPR, we maintain a Record of Processing Activities (ROPA) which documents all categories of processing, lawful bases, data recipients, retention periods, and security measures.

7. Data Breach Procedures

In the event of a personal data breach, we will:

• Assess the breach within 24 hours of becoming aware of it;
• Where the breach is likely to result in a risk, report it to the ICO within 72 hours in accordance with Article 33;
• Where high risk to individuals, notify affected users without undue delay in accordance with Article 34;
• Take immediate steps to contain and mitigate the breach; and
• Document the breach, its effects, and the remedial action taken.

Given that our Platform processes children's data, we treat any breach involving Teen Users' data with the highest severity and priority.

8. Data Subject Access Requests (DSARs)

Users (or their parents on their behalf) may submit a DSAR by emailing support@kidshustle.app. We will verify the requester's identity, respond within one calendar month (extendable by two months for complex requests), provide data in a commonly used machine-readable format, and not charge a fee unless the request is manifestly unfounded or excessive.

9. International Transfers

Our primary data storage is in the EU. Where data is transferred to countries outside the UK without an adequacy decision, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or other appropriate safeguards. A Transfer Impact Assessment (TIA) is conducted for each international transfer.

10. Sub-Processor Management

A full list of our sub-processors is maintained and publicly available at kidshustle.app/sub-processors. All sub-processors are bound by Data Processing Agreements requiring them to process data only on our instructions.

11. Contact Us

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.