Privacy Policy

Spotless Solutions is the controller for personal information we use for our own purposes, including account administration, subscription billing, platform security, support, fraud prevention and direct communications from Spotless.

A cleaning business using Spotless will generally be the controller for personal information it enters or manages about its own clients, employees, workers, applicants, contractors and suppliers. In those circumstances, Spotless generally acts as that business's processor.

Our processor obligations to Business Customers are described in the Data Processing Terms.

The information processed depends on which parts of Spotless are used.

Account and identity information

• Name and editable display name
• Email address and phone number
• Account type, business relationship and access permissions
• Profile photo where uploaded
• Authentication, login and security information

Business information

• Business name, contact details, address, postcode and service area
• Business branding, public profile and booking settings
• Services, prices, availability and cancellation settings
• VAT and finance settings supplied by the business
• Subscription plan, billing state and service usage

Client and booking information

• Client name, email, phone, address and postcode
• Property and access information entered for service delivery
• Booking requests, bookings, recurrence, notes and service history
• Quotes, invoices, credit notes, receipts and payment status
• Ratings, written client feedback and referral information
• Client Portal profile information and product order history where used

Workforce information

• Employee or worker name, email, phone, role and employment information
• Availability, rota, shifts, attendance, timesheets and leave
• Pay and payroll-preparation information entered by the business
• Training, qualifications, staff documents and development records
• Bank details, National Insurance information and Right to Work information where the business chooses to store them
• Staff Portal profile information and profile photo where uploaded

Operational files and evidence

• Receipts and expense attachments
• Before and after service photos and proof-of-service material
• Staff documents uploaded by the business or staff member
• Business logos, client or staff profile images and public cover images

Communications and marketing preferences

• Support requests and messages
• Operational email or WhatsApp delivery information
• Email marketing status and unsubscribe records
• WhatsApp service and marketing opt-in or opt-out status, timestamps and consent notes where recorded
• Campaign delivery, suppression and usage records

Technical information

We may receive technical information necessary to operate and secure Spotless, such as IP address, browser or device information, timestamps, authentication events, error information, security logs and limited usage information.

We may receive personal information:

• Directly from you when you create or update an account
• From a cleaning business when it creates client, staff, booking, finance or operational records
• From a client through public booking pages or the Client Portal
• From a staff member through the Staff Portal
• From your device when a requested feature needs technical or location information
• From Stripe in connection with subscription or connected-account payment events
• From Meta/WhatsApp or email delivery providers in connection with messages
• From support, security or service providers where necessary to operate the platform

Depending on the context, we use personal information to:

• Create and manage accounts and permissions
• Provide business, booking, client and workforce features
• Operate Client Portal and Staff Portal access
• Generate quotes, invoices, reports and operational records
• Process and reconcile Stripe subscription or connected-account payment events
• Record cash and bank transfer information entered by a business
• Provide stock, product order and retail features where enabled
• Send essential account, billing, booking and service communications
• Send marketing on behalf of a business where the relevant permission or lawful basis is recorded
• Maintain suppression and opt-out records
• Provide support and Spotless Assistant features
• Prevent fraud, abuse, unauthorised access and security incidents
• Diagnose errors, maintain reliability and improve the product
• Comply with legal, regulatory, accounting or dispute-resolution obligations

Where Spotless is the controller, we may rely on one or more lawful bases under UK data protection law:

• Contract, where processing is necessary to provide an account or subscribed service
• Legitimate interests, such as operating, securing, supporting and improving Spotless or preventing abuse
• Legal obligation, where information must be used or retained to comply with law
• Consent, where the law requires consent and you have a genuine choice

The lawful basis used by an independent cleaning business for its own client or workforce data is determined by that business, not by Spotless.

When a Business Customer uses Spotless to manage its own clients, staff, bookings, documents, communications or operational records, that business generally decides why and how the information is used. Spotless processes that Customer Data to provide the configured service.

We do not sell Customer Data or use it to market unrelated third-party products to the business's clients or staff.

If you are a client or employee of a cleaning business, the cleaning business may be the correct organisation to contact first about records it controls through Spotless.

Some Business Customers may choose to store information that is confidential or particularly sensitive, including bank details, National Insurance information, Right to Work evidence, identity documents, sickness or absence information, and other workforce records.

The Business Customer is responsible for deciding whether collection is necessary, identifying the appropriate lawful basis or condition, providing required notices and limiting access. Spotless applies additional role-based restrictions to certain staff records, but no system can replace the business's own data minimisation and compliance duties.

If a Business Customer enables geofenced attendance, a staff member's device may provide location coordinates and reported GPS accuracy when that person actively clocks in or clocks out. Spotless may compare this reading with the configured shift location and store an approximate distance or geofence result.

Spotless does not design this feature to track a staff member continuously or in the background. Clock-out is not intended to be blocked solely because the employee is outside the configured geofence.

The Business Customer is responsible for deciding whether geofence use is appropriate and proportionate, informing its workforce and complying with employment and data protection requirements.

Photos and uploaded files are processed to provide the feature for which they were submitted, such as profile photos, proof of service, receipts, staff documentation or business branding.

Users should upload only information that is necessary and authorised. Businesses should avoid requesting or storing excessive identity, health, immigration or other sensitive information where it is not needed.

Spotless uses Stripe for SaaS subscription billing and, where enabled, to facilitate payments into a cleaning business's connected Stripe account.

Spotless generally receives payment identifiers, amount, currency, status, timestamps, limited billing details and account status needed to reconcile the transaction. Full card numbers are entered into Stripe-controlled payment interfaces and are not intended to be stored in Spotless application records.

Cleaning businesses may separately enter bank details for invoices or workforce/payment administration. Those records are processed according to the business's instructions and applicable access controls.

Spotless supports operational messages and direct marketing tools. We distinguish service communications from marketing preferences where the product provides separate controls.

Where a cleaning business sends marketing through Spotless, that business is responsible for the recipient list, the content and the lawful basis under UK GDPR and PECR. Spotless processes message delivery, consent status, suppression and related records on the business's behalf.

You can object to direct marketing at any time. Marketing messages should provide an appropriate opt-out route, and Spotless maintains suppression records to help prevent further marketing after an opt-out.

When a Business Customer uses Spotless Assistant, the message, recent conversation context and limited relevant account or product context may be sent through an AI service made available via our technology provider to generate a response.

Users should not intentionally submit unnecessary special-category data, passwords, full payment-card details or other secrets to AI features. AI output is stored with the conversation where necessary to provide the feature.

Spotless does not use the Assistant itself to make solely automated employment, credit or other decisions that have legal or similarly significant effects on staff or clients.

We do not sell personal information.

We may share or make information available to providers that help operate Spotless, including providers of:

• Cloud application infrastructure, hosting and authentication
• File storage and technical infrastructure
• Stripe subscription and payment processing
• Email delivery
• Meta/WhatsApp messaging where a business enables it
• AI-assisted functionality where the user requests it
• Security, diagnostics and support services
• Professional advisers, insurers or authorities where necessary and lawful

Access is limited to what is reasonably necessary for the relevant service. Where we act as a processor, our use of subprocessors is also governed by the Data Processing Terms.

Some providers supporting Spotless may process information outside the United Kingdom. Where UK data protection law requires a transfer mechanism or safeguard, we use or rely on appropriate contractual, adequacy or other lawful safeguards provided for international transfers.

Business Customers that independently configure third-party services remain responsible for any transfers they initiate outside Spotless's role.

We keep information only for as long as reasonably necessary for the purpose for which it is processed, taking account of active account use, legal obligations, security, fraud prevention, dispute handling and backup cycles.

Customer Data is generally retained while the relevant Business Account remains active unless the business deletes it earlier or the product applies a shorter lifecycle. After account deletion, active application data is deleted or de-identified subject to technical backup cycles and information we must retain by law.

Subscription invoices, payment records, audit/security records and dispute records may be retained for longer where reasonably necessary for accounting, legal or fraud-prevention purposes.

A Business Customer remains responsible for deciding how long it needs to keep the client and workforce records it controls and for exporting records it is legally required to preserve before closing its account.

We use technical and organisational measures designed to protect information against unauthorised access, loss, misuse, alteration or disclosure. These include authenticated access, tenant separation, role-based restrictions, server-side permission checks and additional restrictions around certain sensitive staff information.

We also rely on security controls provided by our infrastructure, payment and communications providers. No online service can guarantee absolute security.

If you believe there is a security issue involving your account or personal information, contact us promptly.

Spotless contains automation that may calculate totals, plan entitlements, geofence results, report metrics, payment state or workflow status from supplied data. These are operational calculations rather than an intention by Spotless to make legally significant decisions about individuals without human involvement.

Cleaning businesses remain responsible for human decisions about employment, discipline, service eligibility, refunds, customer treatment and other matters affecting people.

Depending on the circumstances and applicable UK data protection law, you may have rights including:

• Access to your personal information
• Correction of inaccurate personal information
• Erasure in certain circumstances
• Restriction of processing in certain circumstances
• Data portability in certain circumstances
• Objection to certain processing, including a right to object to direct marketing
• Withdrawal of consent where processing relies on consent
• Safeguards in relation to significant automated decision-making where applicable

These rights are not absolute and the correct organisation to respond may depend on who controls the information.

You can make a privacy request or complain about how Spotless has handled personal information by emailing vivernouk@gmail.com or selecting Privacy request on the Contact page.

We will take reasonable steps to identify the issue, verify identity where appropriate, investigate and communicate an outcome. For a data protection complaint made to Spotless as controller, we aim to acknowledge it within the period required by UK law, currently no later than 30 days, and to investigate without undue delay.

If the complaint concerns information controlled by a cleaning business, we may direct the request to that business or assist it as processor.

You may also complain to the UK Information Commission, commonly known through the ICO website, if you are unhappy with the way a data protection matter has been handled.

ICO website

Spotless is designed for cleaning businesses, their workforce and people arranging cleaning services. It is not designed as an online service for children.

Business Customers should not intentionally create accounts for children or collect children's information through Spotless unless they have a clear lawful reason and appropriate safeguards.

Spotless uses cookies and similar storage technologies for authentication, security, requested functionality and preferences. Our current use is explained in the Cookie Policy.

We may update this Privacy Policy when the service, our providers or legal requirements change. Material new uses of personal information will be brought to users' attention where required before the new processing begins.

The latest version and revision date will be published on this page.

Privacy enquiries, rights requests and complaints can be sent to:

vivernouk@gmail.com

You can also use the Privacy request subject on our Contact page.