Privacy Policy

cleaners.cy is a Cyprus-based marketplace that connects cleaners and cleaning companies with customers looking for cleaning services. For the data described in this policy, we are the data controller.

For anything to do with your data (a question, a request, or a complaint) write to contact@cleaners.cy. We have not appointed a Data Protection Officer; requests sent to that address reach the people who can act on them.

One point matters for understanding the rest of this policy: we are an intermediary. Cleaners are independent businesses, so once a Cleaner has your details in order to do a job, they also decide for themselves how they keep those details in their own records. For that part, the Cleaner is their own controller and you can contact them directly.

Clients: people who register to search for and book cleaning services.

Cleaners: individuals who register to offer cleaning services, and the cleaning companies that register as a business.

Team members of a cleaning company: people invited onto a company’s roster who register and are verified in their own name.

People invited but not yet registered: if a cleaning company invites someone to join its team, we store that email address so we can match the invitation when they register. If you received such an invitation and want the record removed, email us and we will delete it.

People on our launch waitlist: if you gave us your email address before launch.

Account details: your name, email address, phone number, profile photo if you add one, preferred language, and the area you are in. We need these to run your account and to let the other side of a booking know who they are dealing with. Your password is stored only in hashed form by our authentication provider: we never see it.

If you sign in with Google: we receive your name, email address and profile picture from Google. We do not receive your Google password and we have no other access to your Google account.

Cleaner verification data: full legal name, identity document type and number, a photo of that document, a photograph of your face, and (for Cleaners applying as individuals) a record that you made the sworn declaration described in Section 5. We use this only to check that you are who you say you are before your profile becomes visible.

Cleaner profile data: your biography, the services you offer, the areas you cover, your hourly rate, the base location and radius you work from, your availability, your ratings and reviews. This is the information the Platform exists to publish, and it is visible to people browsing.

Booking data: the service address, date, time, duration, service type, any notes you add for the Cleaner, whether you asked for a recurring schedule, the status history of the booking, and (for a company booking) which team member it was assigned to.

Saved addresses: a label, street, city, postal code and coordinates, so you do not retype an address for every booking. When you type an address, the coordinates are resolved by your own phone’s operating system (see Section 8).

Saved cleaners: the Cleaners you mark as favourites.

Reviews and ratings: the star rating and text you write after a completed booking, a Cleaner’s public reply, and any report you make about a review you think breaks our rules.

Notes a Cleaner keeps about you: a Cleaner can save private notes about a Client they have worked with, to remember things like access instructions or preferences. Those notes are visible only to the Cleaner who wrote them. You can ask us for a copy of what a Cleaner holds about you, and you can ask that Cleaner to correct or delete it.

Notifications: the notifications we generate for you in the app and, if you allow push notifications, a device token and your platform, so a message can reach your phone.

Cleaning company rosters: who is on a company’s team, their status on it, and the email addresses of people invited to join.

Waitlist: your email address, your area and your language, used only to tell you when we launch.

Technical data: our hosting, database and email providers keep logs that can include your IP address, timestamps and information about your device or browser. We use these for security, for diagnosing faults, and to keep the service running.

We do not collect payment card data. Payment for cleaning is settled directly between the Client and the Cleaner, and subscription payments are arranged by us manually rather than through card processing on the Platform.

Performance of a contract (Article 6(1)(b) GDPR): running your account, showing profiles, taking and tracking bookings, sending the emails and notifications that a booking requires, and handling subscriptions.

Our legitimate interests (Article 6(1)(f)): verifying the identity of Cleaners before they can be booked, keeping the Platform safe and free of fraud, keeping published reviews available so they remain useful, security logging, and improving the service. Where we rely on this, we have considered your interests too, and you can object as described in Section 13.

Compliance with a legal obligation (Article 6(1)(c)): keeping accounting records for subscription payments, and responding to lawful requests from authorities.

Your consent (Article 6(1)(a)): the launch waitlist, and push notifications, which you allow at the device level. You can withdraw consent at any time: for the waitlist by emailing us, for push notifications in your phone’s settings. Withdrawing does not affect processing that already happened.

The sworn declaration is treated separately under Article 10 GDPR and Cyprus Law 125(I)/2018; Section 5 explains it.

Cleaners who apply as individuals must affirm a sworn declaration: that they have no criminal convictions, that no criminal proceedings are pending against them, and that the information in their application is true. This replaces our earlier plan to ask applicants for a criminal record certificate.

What we actually store is narrow, and this matters: we record that the declaration was made and when. We do not ask for, receive, or keep a criminal record certificate, and we do not hold details of any offence, charge or proceeding.

Because it concerns criminal convictions and offences, this information falls under Article 10 GDPR and the additional safeguards of Cyprus Law 125(I)/2018. Access is restricted to the people who carry out vetting, it is never shown to Clients or other Cleaners, and it is used for nothing other than deciding whether a Cleaner can be listed.

Cleaning companies do not make this declaration. Each of their team members makes it when verifying their own identity.

The photo of your identity document and the photograph of your face are stored in a private area of our storage, separate from your public profile. They are never published, and other users never see them.

A person on our review team looks at the two images and compares them, to confirm that the applicant is the person shown on the document. That is the only purpose.

We do not use facial recognition and we do not run any automated biometric matching. Because the comparison is done by a human being and no biometric template is created, we do not process biometric data within the meaning of Article 9 GDPR.

Photos are reduced in size on your device before they are uploaded, so we hold no more image data than the check needs.

An approved Cleaner’s profile is public: their photo, the name they gave, biography, services, coverage areas, hourly rate, rating, reviews, response time and whether they are on the Pro plan. Anyone browsing the Platform can see it.

Reviews are visible to signed-in users, together with the name of the person who wrote them. Please keep that in mind when writing one.

When you book, the Cleaner sees your name, your phone number, and the address and notes for that booking. They need these to arrive and do the work.

If you book a cleaning company, the company and the team member it assigns to your booking both see those details.

Other Clients never see your bookings, your saved addresses or your contact details.

Our administrators can see account and vetting data where needed to review an application, deal with a report or support a user.

We use a small number of service providers, who process data on our instructions under data processing agreements. We do not sell personal data, and we do not share it for anyone else’s marketing.

Supabase: our database, user authentication, file storage for verification documents, and server-side functions. Hosted in the European Union (Frankfurt, Germany).

Resend: the transactional emails we send, such as booking confirmations and cancellations, team invitations and application decisions.

Google (Firebase Cloud Messaging): delivering push notifications to your device. This receives your device token and the content of the notification.

Google (Sign-In): only if you choose to sign in with Google.

Vercel: hosting for our website, and Vercel Web Analytics for aggregate statistics about how the site is used. See Section 9.

Your phone’s operating system: when an address is typed into an app, the app asks the operating system on your own device (Apple or Google, depending on your phone) to turn that text into coordinates. That request goes from your device to the provider of your operating system under their own privacy terms, and the address is not sent to us for that purpose.

Our website uses cookies only where they are strictly necessary: to keep you signed in as you move between pages, and to remember which language you chose. We set no advertising or tracking cookies.

We use Vercel Web Analytics to count visits and see which pages get used. It is built to work without cookies and without profiling you: it stores no identifier on your device, and we cannot use it to identify an individual visitor.

We also keep a simple total of how many times each Cleaner profile has been viewed, which we show to that Cleaner. It is a count only and does not record who looked.

The mobile apps do not use cookies. They keep your session on your own device so that you stay signed in.

Your account, booking and verification data is held in the European Union.

Some of the providers listed in Section 8 (Resend, Google and Vercel) are established in the United States or may process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision, together with the technical measures those providers apply.

You can ask us for details of the safeguards for a specific transfer by emailing contact@cleaners.cy.

Account and profile data: while your account is open, and then as set out below.

Identity documents and your verification photo: while your account is open. They are deleted as part of closing it, not on a later sweep. If we reject an application, the documents are deleted six months after the decision, which leaves time to handle an appeal.

The record of a sworn declaration: kept with the Cleaner’s profile for as long as it exists, because it is the basis on which they were approved.

Bookings: while your account is open. Afterwards, we keep them only where the other party to the booking still needs their own record, and with your identifying details removed.

Reviews: reviews stay published after the person who wrote them closes their account, because other users rely on them, but we remove the reviewer’s name.

Subscription and accounting records: 6 years, as Cyprus tax law requires.

Push notification device tokens: until you sign out or uninstall the app, or until the token stops working.

Waitlist entries: until we launch in your area, or until you ask us to remove you.

Emails you send us: up to 24 months, so we have the history of a conversation.

All traffic between your device and our servers is encrypted with HTTPS.

Our database enforces access rules at row level, which means one user’s records are unreachable by another user rather than merely hidden by the app.

Verification documents sit in a private storage area that is not publicly reachable. Our review team opens them through short-lived links, and that area is not served to anyone else.

Passwords are hashed by our authentication provider. Administrative access is limited to the people who need it.

No system is perfectly secure. If a breach ever affects your rights, we will notify the Office of the Commissioner for Personal Data Protection, and you, as the GDPR requires.

You have the right to be told what data we hold about you and to receive a copy of it (access).

You have the right to have inaccurate data corrected and incomplete data completed (rectification).

You have the right to have your data deleted where we no longer have grounds to keep it (erasure). Section 14 explains how.

You have the right to ask us to pause using your data while a dispute about its accuracy or our grounds is resolved (restriction).

You have the right to object to processing based on our legitimate interests, including a general objection to profiling for direct marketing.

You have the right to receive the data you gave us in a machine-readable form, or have it sent to another provider (portability).

You have the right to withdraw any consent you gave, at any time.

To use any of these rights, email contact@cleaners.cy. We answer within one month, and we will tell you if we need longer. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.

Whether you are a Client or a Cleaner, you can close your account and have your personal data deleted from your account settings in the app. You can always ask us by email at contact@cleaners.cy instead, from the address on the account, and we will do it within one month.

If you have a confirmed booking still to come, we will ask you to cancel it before deleting the account. Someone is expecting that appointment, and we would rather you told them than have it disappear.

When we act on that request, we delete your profile and any verification documents and photos we hold. If nothing about the account has to outlive it, the account itself is deleted outright. If it does, because a Client still needs their record of a booking or because we are obliged to keep a subscription record, we empty the account of your personal details instead and close it permanently, so it can never be signed into or appear on the Platform again. Bookings are anonymised as described in Section 11, and reviews you wrote stay published with your name removed.

We keep the minimum we are required or entitled to: accounting records for any subscription you paid, and a limited record where we need it to defend a legal claim or to stop someone who was removed for safety reasons from simply registering again. We keep no more than that, and no longer than necessary.

If you are a Cleaner, closing your account removes your profile from the Platform. Please cancel any confirmed bookings first, so your Clients are not left waiting.

We do not make decisions about you by automated means alone that have a legal effect or otherwise significantly affect you, within the meaning of Article 22 GDPR. Whether a Cleaner is approved is decided by a person reviewing the application.

Some things on the Platform are automatic but do not decide anything about you: the order in which Cleaners appear in search results, which takes account of distance, rating and whether the Cleaner is on the Pro plan, and the limit of five Clients on the Free plan.

The Platform is for adults. You must be at least 18 to register, and we do not knowingly collect data about children. If you believe a child has registered, tell us and we will remove the account.

We update this policy when what we do with data changes. The date at the top always shows the current version.

If a change materially affects you, we will tell you by email or in the app at least 30 days before it takes effect, so that you can object or close your account if you disagree.

If something about how we handle your data concerns you, please write to contact@cleaners.cy first. Most issues can be sorted out quickly.

You also have the right to complain to the supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection, whose contact details are published at dataprotection.gov.cy. If you live in another EEA country, you may complain to your own national authority instead.