What Cleanly holds, and who sees it.

Cleanly is made and run by Quobo Labs, LLC (“we”).

A cleaning business (“the business”) uses Cleanly to serve its own clients. For what the business puts in about its households, their houses and its staff, the business decides what is collected and why, and we process it on the business’s behalf and on its instructions. For the business’s own account, and for how the service itself runs, we are responsible.

So if you are a household or a cleaner, the business is your first point of contact about your information. You can always come to us as well. See Contact.

Accounts

For everyone who signs in: a name, an email address and, if given, a phone number, plus which business you belong to and your role there (owner, cleaner or household). Accounts are made by invitation, and an invitation link works once. You sign in with a password, or, where email is switched on, with a one-time code sent to your address; a code works once and only for a short while, and asking for one never makes an account. Your password is held by our sign-in provider as a one-way hash, so nobody at Cleanly or at the business can read it.

Asking to join a business

A business can share a link, and anyone who has it can ask that business to take them on: to clean their home, or to work there as a cleaner. The request holds what you give it — your name, your email address and, if you add them, a phone number and a message — and, if you were signed in, which account sent it. Only that business’s owners can read it, and they decide. Asking makes no account. If the business turns you down and email is switched on, you get one short note saying so.

Households

The household’s name as the business records it, a billing email and phone number, and the business’s private notes about the household. Only the business’s owners can read those notes.

Houses

• The address.
• A floor plan the business draws: the floors, the rooms and the spots in each room that get cleaned, with the tasks and step-by-step instructions for each.
• Access notes: gate codes, alarm codes, where the key is kept. These are the most sensitive words in Cleanly, and they are kept apart from everything else. See Who sees what.

Photographs inside the home

• Reference photos. The business photographs each spot to show how it should look, and pins its tasks onto the picture. When a spot is photographed again, the earlier picture is kept as history so that what was pinned to it still makes sense. The app redraws each one on the device before sending it, which removes what the camera saved with the picture: the time, the device and the location. Only the redrawn picture is stored.
• Proof photos. During a visit, a cleaner takes before and after pictures of a specific task in a specific room. The phone redraws each one at no more than 1,600 pixels before sending it, which removes what the camera saved with it, location included.
• For every photo, who took it and when.

Photos are meant to show rooms and surfaces. Cleanly asks businesses and cleaners not to photograph people.

The work

The schedule and each visit’s times; who was assigned; when a visit started and finished; each task done or skipped, with the reason for a skip and any note; the cleaner’s closing note; the wrap-up report the business sends afterwards; cleaning agreements, and who accepted each one and when; requests and offers between the household and the business; and notes left on a spot.

Money

Invoices and their lines, and payments: how much, when, and whether by card or recorded by the business as paid another way (with the business’s note). Card details are typed into Stripe’s own payment page and kept by Stripe. We keep only what Stripe gives back to recognise the card: the brand, the last four digits, Stripe’s reference for the customer and the card, and whether the last charge failed. That record is closed to every account. Only the part of our server that talks to Stripe can read it.

Notifications

Your inbox of notifications. If you switch on notifications on a device, we keep the delivery address your browser gives us for it (a “push subscription”), its encryption keys, and a note of which browser it is.

Signing in, and technical records

Cookies that keep you signed in. These are the only cookies Cleanly sets, and the service cannot work without them. Our hosting and database providers keep short-lived records of requests, which include IP addresses. The pages anyone can use without an account — asking to join a business, finding one by its handle, asking for a sign-in code and entering it — count recent attempts from each network and each email address, so that nobody can flood them. A count is kept under a one-way scrambled key, never the address itself, and counts more than a day old are swept away as the pages are used. When something breaks, a report may be sent to our error-monitoring provider. See Error reports.

A business in Cleanly has three roles. What each role can see is enforced by the database itself, through row-level security. Even a screen that forgot to hide something could not show it. Each business is also walled off from every other business.

Owners

See everything in their own business, including the requests people have made to join it.

Cleaners

• See only the houses where they are assigned a visit: the plan, the tasks, the reference photos, and the notes meant for staff.
• Can read a house’s access notes only while a visit they are on is locked or under way. A visit locks ahead of its start, 24 hours ahead unless the business sets another time, and the notes close again when the visit is finished or cancelled.
• Cannot read agreements, invoices or payments, and the app shows them no prices. They also cannot read requests or offers, wrap-up reports, or the owners’ private notes.

Households

• See their own houses and nothing else: the plan, the tasks, the reference photos, the schedule, and the proof photos from their own visits.
• See an agreement once it has been proposed to them, never while the business is still drafting it. They see a wrap-up once it has been sent and an invoice once it has been issued.
• Do not see the owners’ private notes about them or about a spot, notes marked for staff, the business’s supply list or its price list.

Photographs are never public. They are kept in private storage and shown through links that expire after one hour. A link is made only after the database has confirmed that the person asking may see that house.

People at Cleanly can reach the database in order to run and repair the service. We do so only to keep it working, to answer a request from you or from the business, or when the law requires it.

We use these companies to run Cleanly. Each receives only what its part of the service needs and processes it only to provide that part to us.

Supabase

The database, sign-in, photo storage and the live view of a visit in progress. Hosted in the United States (Amazon Web Services, N. Virginia).

Vercel

Runs the app and serves its pages. Keeps short request logs.

Stripe

Takes card payments and keeps cards on file, when the business has card payments switched on. Receives the household's name and billing email, and each invoice's amount and number.

Resend

Sends email: invitations, password-reset links, sign-in codes, the short note a business sends when it turns down a request to join, and a one-line notice with a link for anyone who has not switched notifications on. Receives the email address and the message itself.

Push services

The service that belongs to your browser or phone (Apple, Google or Mozilla) delivers notifications. What they carry, a title and a link, is encrypted so only your device can read it.

Sentry

Error reports, when error monitoring is switched on. See Error reports.

Your information is stored in the United States. We share it with no one else, except where the law requires it, for example a valid court order. When that happens we tell the business, unless the law forbids us to.

When something breaks and error monitoring is switched on, a report goes to Sentry. It contains the kind of error, its message, where in the code it happened, the screen as a pattern (“a visit’s run screen”, not which visit), and a reference code. Reports never include your name, your account, your cookies or anything you typed, and email addresses are stripped from messages before they leave. Sentry keeps them for up to 90 days.

The reference code is the one an error screen shows you. If you quote it to us, we can find exactly what went wrong.

• While the business uses Cleanly, its information is kept until the business removes it. Archived rooms, spots, tasks and houses are hidden rather than erased, so that past visits, agreements and invoices still read correctly.
• Reference photos, including earlier ones kept as history, stay until the business deletes them. The current reference photo for a spot cannot be deleted in the app, only replaced by taking a new one.
• Proof photos stay with the visit they belong to, as the record of the work. The app has no button that removes one. We delete them on request, as set out under Deleting your information.
• When a business closes, which happens when its last owner deletes their account, everyone in it loses access at once and no account can open its records any more. The records are not erased on a timer. We delete a closed business’s records, photographs included, when we are asked to: write to hello@quobo.co and we do it within 30 days. Invoices and payment records that the law requires to be kept longer are the exception.
• Requests to join stay with the business they were sent to, answered or not, as its record of who asked and what it said. Ask the business, or us, to delete one.
• Notification subscriptions are deleted when you switch notifications off, or when the browser’s push service tells us the address no longer works.
• Request logs are kept by our hosting and database providers for no more than 7 days.
• Backups. Deleted information can remain in the database’s encrypted daily backups for up to 7 days before it is gone for good.

Your account

Signed in, open Settings → Delete account. You need no one’s permission. Deleting signs you out everywhere and removes your sign-in, your email address, your phone number, your inbox and your notification subscriptions. Your name stays on the business’s records of what happened: the visits you worked or received, the agreements you accepted, the photos you took, and the invoices you were sent. Those records belong to the business’s own history, not to your account. The confirmation screen says so before you decide.

If you are the last owner of a business, deleting your account closes the business, and everyone in it loses access at the same time. The confirmation screen names the business and how many people that affects. Closing does not erase the business’s records. From then on no account can open them, and they are deleted when we are asked to, as described under How long it is kept.

What a business holds about you

A house’s address, its photographs, its access notes and the notes about a household are the business’s records. Ask the business to change or remove them. In the app its owner can correct any of them, delete earlier reference photos, and archive a house or a household, which hides it without erasing it. For anything the app cannot erase, or if the business cannot or will not help, write to us and we will work with them.

A copy, a correction, or a deletion

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete what the app itself cannot. Write to hello@quobo.co. We answer within 30 days. Depending on where you live, data-protection law may give you further rights, including the right to complain to your regulator.

• Every table is protected by row-level security. Access notes and owners’ private notes are kept in separate tables with their own, narrower rules, not in columns that the app merely avoids showing.
• Photos are kept in private storage and shown only through links that expire after an hour.
• Everything travels encrypted (HTTPS), and the database and file storage are encrypted at rest.
• Card details never touch our servers: they are typed into Stripe’s page.
• The keys that can bypass these rules are kept on the server and never sent to a browser or phone.

If a breach affects your information, we will tell the business, and you where we can, without undue delay.

• No advertising.
• No analytics or tracking scripts, and no third-party cookies. Even the typefaces are served by Cleanly itself.
• We never sell or rent information.
• We don’t use it to build a profile of anyone.

Cleanly is for businesses and the adults of the households they serve. It is not meant for children, and we do not knowingly hold an account for anyone under 18.

When this policy changes, the date at the top changes. If a change affects what is collected or who can see it, we tell the owners of every business in the app before it takes effect.

Quobo Labs, LLC
Privacy and deletion: hello@quobo.co

For anything else, see Support.