Privacy Policy

1. Information we collect

• Contact: name, email, phone, service address.
• Account credentials: hashed password, MFA state, security questions (if enabled).
• Payment: tokenized card reference via Stripe (we do not store full PAN, CVV, or expiration date).
• Service preferences: cadence, pets, entry method, allergy or sensitivity notes, special instructions.
• Communications: SMS, email, inbound / outbound calls (recorded with notice), chat messages, support tickets.
• Device & usage: IP address, browser / device, pages visited, referrer, time on page, aggregated analytics.
• Geolocation: service address; approximate IP geolocation; precise cleaner GPS during assigned shift only.
• Photos: before / after job photos uploaded by our cleaners (with EXIF watermark).
• Cleaner applicants only: resume, employment history, driver's license, Form I-9 data, consumer-report data subject to the FCRA.

2. How we use your information

• Schedule, deliver, and quality-check cleaning services.
• Process payments, refunds, and tips.
• Send booking confirmations, reminders, cleaner-ETA alerts, and post-service satisfaction surveys.
• Generate AI-assisted service estimates and call summaries (text only, anonymized where feasible). Human review precedes any adverse decision.
• Prevent fraud and secure the platform.
• Comply with tax, insurance, and employment-law obligations.
• Send marketing — only with your opt-in consent and subject to our Anti-Spam Policy.

3. GDPR lawful basis (Art. 6)

Where your personal data is subject to GDPR / UK-GDPR, we rely on the following lawful bases:

For the full treatment (including data-subject rights and international transfers), see our GDPR notice.

4. California / state residents (CCPA / CPRA)

California residents — and residents of Colorado, Connecticut, Virginia, Utah, and Florida under the Florida Digital Bill of Rights — have additional rights, including: right to know, right to delete, right to correct, right to portability, right to limit use of Sensitive PI, right to non-discrimination, and right to opt out of sale / sharing. We do not sell Personal Information for money and honor Global Privacy Control as a valid opt-out. See the full CCPA / CPRA notice and the Do Not Sell My Personal Information declaration.

5. Global Privacy Control (GPC)

When your browser sends the Sec-GPC: 1 header, we treat it as:

• A valid opt-out of "sale" and "sharing" of Personal Information.
• An automatic decline of marketing cookies.
• A dismiss of the cookie banner (your signal is your answer).

6. Third-party service providers

We only share your data with vendors we need to deliver the service. Current subprocessors include Stripe, OpenPhone, SendGrid, Railway, Cloudflare, Google Workspace, Groq, OpenAI, and Nominatim (OpenStreetMap). Each processes data under a written agreement forbidding re-use for their own purposes. See the current list on our Subprocessors page.

7. International transfers (SCCs + UK IDTA)

We are based in the United States and most of our subprocessors are also US-based. For EU / UK / Swiss data, we rely on EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum / UK Addendum to the SCCs, together with supplementary technical measures (TLS 1.3, encryption at rest, least-privilege access).

8. Security

TLS 1.3 everywhere, 1-year HSTS, bcrypt password hashing with HIBP breach-check, audit logs, multi-factor for admin accounts. See our full Security Posture page for controls, incident response, and responsible-disclosure process.

9. Data retention schedule

We retain data only as long as we need it. Current schedule:

10. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated data (subject to legal exceptions).
• Object to or restrict certain processing (e.g., marketing, analytics).
• Withdraw consent at any time, without affecting prior lawful processing.
• Receive your data in a portable, machine-readable format (export is available from your customer portal).
• Designate an authorized agent to exercise rights on your behalf.
• Lodge a complaint with a data protection authority.

To exercise any right, email privacy@gogreenorganicclean.com. We respond within 30 days (45 under CPRA, extendable once).

11. Children's privacy

Our services are intended for adults (18+). Consistent with the Children's Online Privacy Protection Act (COPPA, 15 USC § 6501 et seq.) and GDPR Article 8, we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal data, please contact privacy@gogreenorganicclean.com and we will delete it promptly.

12. Breach notification commitment

In the event of a confirmed personal data breach, we will:

• Notify the competent supervisory authority within 72 hours (GDPR Art. 33, Fla. Stat. § 501.171 where applicable).
• Notify affected individuals within 30 days, or sooner if the risk is high.
• Publish a post-mortem summary on our Security page when appropriate.

13. Changes to this policy

We may update this Privacy Policy from time to time. Changes are posted here with an updated "Last updated" date. For material changes (new categories of data, new vendors, expanded processing), we will re-notify you by email and, where required, re-prompt for consent.

14. Contact

These terms are provided for transparency. For specific legal advice, consult a licensed attorney.