Privacy notice
- Home
- Privacy notice
Version: 2026-09-24-draft
This notice explains how cleand collects and uses personal information about:
- customers: people who get a quote or book a clean;
- waitlist members: people who ask to be told when we open in their area;
- partners: the people who register and run a cleaning company on cleand, and the people who work for it and use the partner portal ("workers").
It also explains your rights and how to use them.
1. Who we are
cleand is a trading name of [FILL: legal entity name], registered in England and Wales (company number [FILL: company number]), registered office [FILL: registered address]. We are the controller of the personal information described here. We are registered with the Information Commissioner's Office (ICO) under number [FILL: ICO registration number].
For anything about your personal information, email hello@cleand.uk [DECIDE: a dedicated address such as privacy@cleand.uk] or write to us at the address above. We haven't appointed a data protection officer, as we are not required to; the founder is responsible for data protection.
2. Customers
What we collect
- When you get a quote: the postcode you enter and the job details (service, number of bedrooms and bathrooms, frequency, extras, date and arrival window). We use them to work out your price. We don't store a quote unless you go on to book.
- When you book: your name, email address and mobile number; the address to be cleaned (and, when you pick it from the list, its Unique Property Reference Number, or UPRN); the property type; access instructions (which may include key safe or door codes); parking; pets; any notes for the cleaner; the terms version you agreed to and when.
- Payment: the amount, the payment and refund status, and the payment references Stripe gives us. We never see or store your card details: you enter them on Stripe's page, and Stripe also receives your email address.
- During and after the booking: the booking's history (for example when it was accepted, completed or cancelled, and by whom), problem reports you send us (and what we did about them), and the emails we send you.
- Technical data: your IP address and browser details, in our web server's logs and briefly in memory to limit abuse (for example too many quotes from one address). See section 7.
Why we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR Article 6) |
|---|---|
| Price your clean, take your booking and payment, arrange a cleaning company, send booking emails, handle cancellations, refunds and problem reports | Contract: we need it to provide the service you asked for |
| Keep booking, payment and refund records for tax and accounting | Legal obligation (HMRC record-keeping) |
| Prevent fraud and abuse, keep the site secure, and defend or bring legal claims (for example a damage claim or a payment dispute) | Legitimate interests: protecting our customers, partners and business |
| Show cleaning companies a job before they accept it (see below) | Contract, and legitimate interests in finding a company quickly |
We don't send marketing emails and we don't use your information for advertising or profiling. We don't make decisions about you by automated means that have legal or similarly significant effects. (Prices are calculated automatically from the job details and area, the same for everyone.)
Who sees it
- Cleaning companies. Before accepting a job, approved companies covering your area see only the postcode district (for example "SW11"), the date and arrival window, the service, the home size and extras. Once a company accepts your job, it and the cleaner it assigns see your name, phone number, full address, UPRN, access instructions, parking, pets and notes, so they can do the clean. [DECIDE: whether the partner is an independent controller of this information (this draft's assumption, as the partner decides how it runs its own business and staff) or cleand's processor; see the partner agreement.]
- Our service providers (section 5).
- Others when the law requires or allows it, for example HMRC, the police (for instance about a theft), insurers dealing with a claim, our professional advisers, or a buyer of our business (who would have to keep to this notice).
3. Waitlist members
If your area isn't open yet and you ask us to tell you when it is, we keep your email address and postcode. We use them only to email you once when your area opens. Our lawful basis is your consent: you can withdraw it at any time by emailing us, and we will delete your details.
4. Partners and workers
What we collect
- Your account: name, email address, password (stored only as a secure hash), the codes we email you to verify your email or sign in, and your sign-in sessions (including the IP address and browser details of each session). If you were invited by your company, the invitation (your email, role and who invited you).
- Your company: company name, phone number, the areas you cover, your application status, our approval or rejection decision and reason, and our internal notes.
- Documents you upload: public liability insurance certificate (with its expiry date), evidence of background checks (DBS) for the people who clean, and optionally company registration. Each file's name, type, size and upload date.
- Bank details for payouts: account name, sort code and account number, stored encrypted; you and we see only the last 4 digits in the portal.
- Work and money: the jobs you accepted or were assigned, which worker was assigned, completions, back-outs, problem reports about your jobs, fees, adjustments, monthly statements and payouts.
- Security records: when our staff open your documents or bank details, we record who did it and when.
Workers give us their name, email and password when they accept an invitation. They see only the jobs assigned to them and never any amounts.
Criminal offence data
Background check (DBS) evidence may show that a person has, or hasn't, a criminal record. This is criminal offence data and has extra protection in law. We ask for it only to decide whether a company is suitable to send into customers' homes, which we promise our customers. Only cleand staff can open it, every view is logged, and we delete it on the schedule in section 6. Our lawful basis is [DECIDE: legitimate interests (Article 6(1)(f)) or contract (6(1)(b))] and the condition in Schedule 1 to the Data Protection Act 2018 is [DECIDE: paragraph 10, preventing or detecting unlawful acts, or another; see the appropriate policy document]. Our appropriate policy document explains how we protect it; you can ask for a copy.
If you upload evidence about your workers, you must tell them first, using this notice, and have a lawful basis to share it with us. The partner agreement sets this out.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and secure your account, review and approve your company, show you jobs, pass you customer details for jobs you accept, keep your ledger and statements, pay you | Contract (the partner agreement) |
| Check insurance and background checks, and remind you when insurance is about to expire | Contract, and legitimate interests in keeping customers safe; see above for background checks |
| Keep money records (statements, payouts, fees) for tax and accounting | Legal obligation |
| Investigate complaints, prevent fraud, keep the portal secure, log staff access to documents | Legitimate interests |
5. Our service providers
These providers handle personal information for us, under contracts that require them to protect it and use it only on our instructions:
| Provider | What they do | Where the data is |
|---|---|---|
| Hostinger | Hosts our website, database and partner documents (a private server) | [DECIDE: confirm the server's data centre, e.g. UK or EU] |
| Contabo | Stores our encrypted nightly backups, and runs our monthly price review (which has access to our database over a private network) | [DECIDE: confirm the data centre, e.g. UK or Germany] |
| Purelymail | Sends our emails (booking confirmations, sign-in codes, statements) | [DECIDE: confirm; Purelymail is a US service, so this is likely a transfer to the US, see section 8] |
| Stripe | Takes card payments and refunds | UK, EU and US. Stripe is also a separate controller of payment data for its own legal duties; see stripe.com/privacy |
| lookup.zzapp.uk | Finds the addresses for a postcode when you book | Receives the postcode only. [FILL: who operates it and where it is hosted] |
We also use tools that don't receive personal information about you: a self-hosted secrets manager (Infisical, on our own server), a private network service (Tailscale, which carries encrypted traffic between our servers but can't read it), code hosting (GitHub, which holds our code but no customer or partner data), and a web browsing service (TinyFish) used only to check competitors' public prices.
6. How long we keep it
We delete personal information automatically on this schedule (a daily job, which records what it deletes):
| Information | How long we keep it |
|---|---|
| Paid bookings: your name, email, phone, address, UPRN, access instructions, pets, notes and problem reports | 6 years after the date of the clean, then removed. The amount, date, service, postcode district and payment references stay as an anonymous financial record, which we must keep for tax |
| Checkouts that were never paid | 6 months after you started them, then removed in the same way |
| Waitlist email and postcode | 30 days after we email you that your area is open, then deleted. [DECIDE: a limit for areas that never open, e.g. 2 years; today the software keeps them until the area opens] |
| Partner documents (insurance, background checks, company registration) and bank details | While you work with us. Then 6 months after you leave or we reject your application, or 6 months after an application was abandoned (nothing submitted). Bank details are kept until any unpaid statement is paid. Uploading a new document deletes the old one straight away |
| Partner ledger, statements and payouts | 6 years (tax records) |
| Partner and worker accounts (name, email, sign-in details) | While the account is in use. [DECIDE: a period after the company leaves, e.g. 6 months, after which the account is deleted; today this is done by hand on request] |
| Sign-in sessions | Each session expires 7 days after it was last used. [DECIDE: add automatic deletion of expired session records] |
| Records of staff opening documents or bank details | [DECIDE: today kept indefinitely; recommend 6 years] |
| Web server logs | [DECIDE: e.g. 30 days; confirm the server's log rotation] |
| Backups | Encrypted; daily copies for 30 days and monthly copies for 12 months. Information we delete leaves the backups when they expire, so within 12 months at most. We never restore deleted information into use |
| Emails we send and receive | [DECIDE: e.g. 2 years in our mailbox; the email provider's logs under its own retention] |
7. Cookies
We use only cookies that are strictly necessary: a sign-in cookie for partners and staff, so the portal knows you are logged in. Customers booking a clean don't need an account and get no cookies from us. We don't use analytics, advertising or tracking cookies. Our cookie notice lists them.
8. Transfers outside the UK
Most of the information we hold stays in the UK or the European Economic Area [DECIDE: confirm once the Hostinger and Contabo data centres are chosen]. Where a provider processes it elsewhere (for example Stripe, and our email provider if it is in the US), we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or on the ICO's International Data Transfer Agreement or Addendum. [DECIDE: confirm the safeguard for each provider; Purelymail may need the IDTA.] You can ask us for a copy of the safeguards.
9. Your rights
You have the right to:
- access your personal information and get a copy of it;
- have inaccurate information corrected;
- have your information deleted, where we no longer need it or you withdraw consent (we must keep money records for 6 years, so for a paid booking we remove your details but keep the anonymous financial record);
- restrict how we use it, or object to our use of it based on legitimate interests;
- receive the information you gave us in a portable format (data portability);
- withdraw consent at any time, where we rely on it (the waitlist).
To use any of these rights, email hello@cleand.uk. It's free. We may ask you to confirm your identity (for example the booking date and postcode) and will reply within one month. If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
10. Children
cleand isn't for children. You must be 18 or over to book or to register as a partner. If a child lives at a property being cleaned, we don't collect information about them; please don't include it in your notes.
11. Security
We protect your information with encryption in transit (HTTPS), encrypted bank details and backups, a private network for our database, strict access controls (only cleand staff can see documents and bank details, and every view is recorded), and regular security reviews. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.
12. Changes to this notice
We will update this notice when how we use personal information changes, and show the new version and date at the top. If a change affects you significantly, we will tell you by email.