Privacy policy

1.Introduction

Cleaning Operator Ltd ("Cleaning Operator", "we", "us" or "our") operates the Cleaning Operator platform. That includes cleaningoperator.com, app.cleaningoperator.com, company subdomains such as <yourcompany>.cleaningoperator.com, any other domain we control under cleaningoperator.com, and our iOS and Android apps (together, the "Services").

This policy explains how we collect, use, disclose and protect personal data when you use the Services. It also sets out your rights under the privacy laws that apply in the United Kingdom, the European Economic Area (EEA), the United States and anywhere else we provide the Services, including the UK GDPR, the EU GDPR and the Data Protection Act 2018.

2.Who we are

Cleaning Operator Ltd is the data controller for personal data processed through the Services, except where we process data as a processor on behalf of a customer (a "Controller Customer"). Our details are:

• Company name: Cleaning Operator Ltd
• Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Company number: 16694366 (registered in England and Wales)
• Data protection contact: hello@cleaningoperator.com

3.Scope of this policy

This policy covers personal data processed when you:

• Visit cleaningoperator.com or any subdomain we operate.
• Create an account or sign in at app.cleaningoperator.com.
• Use a company workspace at <yourcompany>.cleaningoperator.com.
• Use our iOS or Android apps.
• Interact with our communications, marketing content or customer support.
• Connect Cleaning Operator to third-party tools and services.

4.Personal data we collect

The data we collect depends on how you use the Services and which features you use:

• Account data: name, job title, business name, email address, phone number, password (stored hashed), time zone, preferred language and user role permissions.
• Workspace settings: company names, subdomain addresses, industry, branding, custom forms and settings.
• Booking and scheduling data: customer contact details, service addresses, appointment history, job notes, checklists, photos, signatures and messages submitted through the Services.
• Team member data: staff names, working hours, availability, GPS location snapshots (for features such as GPS clock-in and time logs) and performance metrics, where the company using the Services turns these features on.
• Financial data: billing contact details, subscription plan, payment method tokens, invoicing information and transaction history, collected through our payment processors (for example, Stripe).
• Support and communications: support tickets, chat transcripts, emails, recorded calls (where permitted) and feedback forms.
• Website and marketing interactions: IP address, device identifiers, browser type, referring URLs, pages visited, actions taken, marketing preferences and email engagement.
• Integration data: API keys, configuration settings and data sent to or from third-party integrations at your direction (for example, Stripe or Twilio).
• Mobile app data: device identifiers, push notification tokens, crash diagnostics, app usage analytics and, with your permission, access to device features such as the camera, photo library and location services.

5.How we use personal data

We use personal data for the purposes below. The legal basis for each is shown in brackets.

• Providing the Services: to create and manage accounts, authenticate users, and provide scheduling, customer records, invoicing, messaging and reporting features (contract).
• Running the platform: to operate, maintain and improve the Services, including troubleshooting, performance monitoring and security (legitimate interests; contract).
• Customer support: to answer enquiries, resolve technical issues and provide training (contract; legitimate interests).
• Billing and subscriptions: to take payments, manage free trials, handle chargebacks and send invoices through our payment processors (contract; legal obligation).
• Communications and marketing: to send product updates, newsletters, surveys, event invitations and offers in line with your communication preferences, PECR and CAN-SPAM (consent; legitimate interests).
• Security and fraud prevention: to detect and prevent fraudulent, abusive or unauthorised use of the Services (legitimate interests; legal obligation).
• Legal compliance: to comply with laws, regulations, court orders and requests from public authorities (legal obligation).
• Analytics and product development: to analyse usage trends, measure feature adoption and develop new products and services (legitimate interests).
• Testimonials and case studies: to publish customer stories and testimonials, only with your consent.

6.Lawful bases (UK and EEA)

Where the UK GDPR or EU GDPR applies, we rely on these lawful bases:

• Consent (Article 6(1)(a)): for optional marketing communications, analytics cookies and any data sharing that needs your explicit agreement.
• Contract (Article 6(1)(b)): to provide the Services you ask for and meet our obligations to customers and their users.
• Legal obligation (Article 6(1)(c)): to meet tax, anti-money laundering and regulatory requirements.
• Legitimate interests (Article 6(1)(f)): to run and improve our business, keep the platform secure and prevent misuse.

7.Cookies and tracking technologies

We use local storage and similar technologies to keep you signed in, remember small preferences (such as the currency you choose) and understand how the Services are used. They are needed for the Services to work properly.

On our marketing website we also set one optional cookie, and only if you accept it in our cookie notice. If you arrive through a referral link, it remembers the referral code (and any campaign details in the link) for 7 days, so a sign-up can be credited to whoever referred you. If you decline, nothing is stored on your device for this purpose, although the code is held in your browser for that visit only.

You can change your choice at any time with "Cookie choices" in the footer of any page, or clear cookies and site data in your browser settings. Parts of the Services may stop working if you block the storage they need.

8.How we share personal data

We may share personal data with:

• Service providers and subprocessors: hosting and infrastructure providers, payment processors (for example, Stripe), messaging and email providers (for example, Twilio), push notification services, AI service providers that power the assistant, analytics tools and other vendors that help us deliver the Services. They agree to data protection obligations consistent with this policy.
• Controller Customers: when you use the Services under a company's account (for example, your employer or your cleaning company), that company controls your personal data. We process it on their behalf and share it with them as needed to provide the Services.
• Professional advisers: auditors, accountants, lawyers, bankers, insurers and consultants who help us run our business.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to appropriate safeguards.
• Legal and regulatory authorities: where required by law, regulation or legal process, or to protect the rights, property or safety of Cleaning Operator, our users or others.
• Anyone else, with your consent: where you have explicitly told us or allowed us to share it, for example with a third-party integration or for a testimonial.

9.International data transfers

We may transfer personal data to countries outside the UK or EEA, including the United States. When we do, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs) or another approved transfer mechanism.

Where applicable, we also carry out transfer risk assessments and apply extra safeguards, such as encryption and access controls.

10.Data security

We use technical and organisational measures to protect personal data, including encryption in transit and at rest, role-based access controls, network monitoring, secure coding practices and staff training.

No security measure is perfect, and you acknowledge that sending data over the internet carries some risk.

11.Data retention

We keep personal data only for as long as we need it for the purposes in this policy, to comply with legal obligations, resolve disputes and enforce agreements. Retention periods depend on the type of data and our commitments to Controller Customers.

Customers can ask for their data to be deleted or exported through in-app tools or by contacting us. Once data is no longer needed in identifiable form, we may anonymise it for analytics and product development.

12.Closing your account

If you use Cleaning Operator as a cleaner, staff member or administrator of a company, you can ask for your account to be closed from your profile in the app (Profile, then Delete my account), or by asking your employer. The company is the controller of its own team's data and we process it on its behalf, so the request goes to the company's administrators, who close the account. If you are the only administrator, the request comes to us. We aim to deal with requests within 30 days.

When an account is closed, we mark it inactive, remove your sign-in, your devices and your push notification tokens, and remove your email address, phone numbers, address, profile photo, availability, tax number and access permissions. Your name is shortened to your first name and last initial (for example, "Sarah J.").

We keep the business records of the work you did, shown under that shortened name: jobs and assignments, time logs and clock-in locations, job photos, messages in conversations, payroll and payslips, invoices and the history of changes. Companies need these records to meet legal duties (for example tax, payroll and employment record-keeping) and to deal with disputes, and removing them would change the company's accounts. Documents a company must keep by law, such as right-to-work checks, are kept for as long as the law requires. These records are kept only for those purposes, and a first name and last initial on them is still personal data.

A closed account cannot be reopened. If you return to the company, it creates a new account for you. Your rights over the data that remains continue: you can contact hello@cleaningoperator.com, or the company you worked for, to ask about it.

13.Your rights

Depending on where you live and the laws that apply, you may have the right to:

• Access: find out whether we process your personal data and get a copy of it.
• Rectification: correct inaccurate or incomplete personal data.
• Erasure: ask us to delete your personal data, subject to legal exceptions.
• Restriction: limit how we process your personal data in certain circumstances.
• Portability: receive your personal data in a structured, commonly used format.
• Objection: object to processing based on legitimate interests, or to direct marketing.
• Withdraw consent: withdraw your consent at any time where we rely on it.
• Non-discrimination: in the United States, not be treated differently for exercising your privacy rights.

14.How to exercise your rights

To exercise your rights or ask a privacy question, email hello@cleaningoperator.com. We may need to verify your identity before we act on a request. If we process your data on behalf of a Controller Customer, we will pass your request to that company.

You may also have the right to complain to a data protection authority, such as the UK Information Commissioner's Office (ICO) or the data protection authority in your EU country.

15.Additional information for United States residents

Residents of some US states, including California, Colorado, Connecticut, Utah and Virginia, may have extra rights. These can include the right to know, delete and correct personal data, and to opt out of targeted advertising, the sale of personal data, or profiling used for decisions with legal or similarly significant effects.

Cleaning Operator does not sell personal data as defined by those state laws. To exercise a state-specific right, email hello@cleaningoperator.com with your request and your state of residence.

16.Children's privacy

The Services are not aimed at anyone under 16, and we do not knowingly collect personal data from children under 16. If we learn that we have collected such data without appropriate consent, we will delete it promptly.

17.Third-party services

The Services may link to third-party websites, apps or services. We are not responsible for their privacy practices or content, and we encourage you to read their privacy policies before you share personal data with them.

18.Changes to this policy

We may update this policy to reflect changes in our practices, the law or technology. We will post the updated policy on cleaningoperator.com with its effective date, and tell you about material changes by email or a prominent notice in the Services.

If you keep using the Services after the effective date, you accept the updated policy.

19.Contact us

If you have questions or concerns about this policy or how we handle personal data, contact us:

• Email: hello@cleaningoperator.com
• Post: Cleaning Operator Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom