1. Introduction
CleanTask (“CleanTask”, “we”, “us” or “our”) provides an all-in-one platform that helps cleaning companies plan their operations, guide field agents and manage invoicing. This Privacy Policy is the official privacy policy for the entire CleanTask platform and applies to all of our products and services, including:
- the public website at cleantask.co;
- the CleanTask web application at app.cleantask.co;
- the CleanTask mobile applications for Android and iOS;
- our APIs and any future services we provide (together, the “Services”).
We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Belgian law.
By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.
2. Who we are
The Services are operated by CleanTask, established in Belgium. For the purposes of the GDPR, CleanTask acts as:
- a data controller for the personal information of website visitors and account holders (for example billing and account data); and
- a data processor for the personal information that our customers (cleaning companies) store in the platform about their own staff and clients. In that case, the cleaning company is the data controller and this policy applies in addition to their own privacy notices.
You can contact us about anything in this policy at privacy@cleantask.co.
3. Information we collect
3.1 Information you provide to us
- Account information — name, email address, password (stored in hashed form), preferred language, role within your organisation, and phone number where provided.
- Organisation information — company name, address, VAT/company number, billing details and settings configured by your organisation.
- Business content — data your organisation enters into the platform, such as customers, worksites, schedules, quotes, invoices, notes and checklists. This content may contain personal information about third parties (for example a client's contact details).
- Communications — messages you send us (support requests, emails) and their metadata.
3.2 Information collected automatically
- Usage and log data — IP address, browser type, device identifiers, operating system, pages viewed, timestamps and referral URLs, collected when you interact with the Services.
- Device data (mobile apps) — device model, OS version, app version and language, used for compatibility, security and support.
- Audit records — administrative and security-relevant actions performed in the platform (for example logins or changes to key records), so organisations can review activity in their workspace.
3.3 Information collected with your permission (mobile apps)
- Location data — see Section 6 for a full description of how the mobile apps use location, including background location.
- Photos and camera — when a field agent documents a completed visit, photos taken or selected are uploaded to the organisation's workspace.
4. How we use your information
We use personal information to:
- provide, operate and maintain the Services, including scheduling, field-tracking, invoicing and synchronisation across devices;
- create and manage accounts, authenticate users and secure access;
- process transactions and send transactional messages (for example invitations, password resets and billing notices);
- provide customer support and respond to requests;
- monitor, analyse and improve the performance, reliability and usability of the Services;
- detect, prevent and address fraud, abuse, security incidents and technical issues;
- comply with legal obligations, including accounting and tax requirements.
We do not sell personal information, and we do not use the content your organisation stores in CleanTask for advertising.
5. Legal bases for processing (GDPR)
Where the GDPR applies, we rely on the following legal bases:
- Performance of a contract — to provide the Services you or your organisation signed up for.
- Legitimate interests — to secure and improve the Services, prevent abuse and communicate with our business contacts, where those interests are not overridden by your rights.
- Consent — for permissions you grant on your device (such as location or camera access) and for optional communications. You can withdraw consent at any time.
- Legal obligation — to meet accounting, tax and other regulatory requirements.
6. Location data and mobile permissions
The CleanTask mobile app for field agents uses location to support operational features requested by the agent's employer:
- Visit tracking — recording departure, arrival, start and completion of a scheduled visit;
- Geofencing — detecting arrival at or departure from a worksite so visit statuses can be updated automatically, which may require background location access while a visit is active.
Location access is always requested through the operating system's standard permission dialogs, and you can revoke it at any time in your device settings. Revoking access does not prevent you from using the app, but automatic visit detection will be disabled. Location data collected during visits is stored in your organisation's workspace and is visible to your organisation's administrators.
The app also requests, with your permission: camera / photo library access (to document visits) and notifications (to inform you about schedule changes). The app stores a local copy of your schedule on the device so it keeps working offline; this local data is removed when you log out or uninstall the app.
8. Data retention
We keep personal information for as long as it is needed to provide the Services and for legitimate business or legal purposes:
- Account and workspace data is retained while your organisation's account is active. When an account is closed, workspace data is deleted or anonymised within a reasonable period, except where retention is legally required.
- Invoices and accounting records are retained for the periods required by applicable tax and accounting law.
- Logs and audit records are retained for a limited period for security and troubleshooting purposes.
9. Data security
We apply technical and organisational measures appropriate to the risk, including:
- encryption of data in transit (TLS/HTTPS) across all Services;
- password hashing and token-based authentication;
- strict tenant isolation, so each organisation's data is logically separated from every other organisation's data;
- role-based access controls and audit logging;
- regular backups and monitored infrastructure.
No method of transmission or storage is completely secure. If we become aware of a personal-data breach that affects you, we will notify you and the competent authorities as required by law.
10. International data transfers
Our Services are primarily hosted in the European Union. Where a service provider processes personal information outside the European Economic Area, we ensure appropriate safeguards are in place, such as European Commission adequacy decisions or Standard Contractual Clauses.
11. Your rights
Depending on your jurisdiction, you may have the right to:
- access the personal information we hold about you;
- correct inaccurate or incomplete information;
- request deletion of your personal information;
- receive a copy of your data in a portable format;
- object to or request restriction of certain processing;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with your local supervisory authority (in Belgium, the Data Protection Authority).
Organisation administrators can exercise several of these rights directly from the application, without contacting us: the Data & Privacy page (Settings → Data & Privacy) lets them export the organisation's full dataset in a portable format, generate targeted exports of the data held about a specific customer or employee (for example to answer a subject-access request), and request deletion of the organisation.
For anything not covered by these self-service tools, contact us at privacy@cleantask.co. If your data is stored in a workspace controlled by your employer or service provider, we may redirect your request to them, as they are the data controller for that workspace.
12. Account and data deletion
You can request deletion of your account and associated personal information at any time:
- Workspace members (for example field agents) — ask your organisation's administrator to remove your account, or contact us directly.
- Organisation owners — use the Data & Privacy page in the application (Settings → Data & Privacy) to export your organisation's data and request deletion of the organisation, or contact us at privacy@cleantask.co.
We recommend exporting your data before requesting deletion — once the deletion is processed, the workspace and its content can no longer be recovered.
Once a deletion request is confirmed, data is removed from production systems within a reasonable period and from backups on their normal rotation schedule, except for records we must keep by law (such as invoices).
14. Children's privacy
The Services are business tools intended for professional use and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you through the Services or by email. Your continued use of the Services after a change takes effect constitutes acceptance of the updated policy.
16. Contact us
If you have questions, concerns or requests regarding this Privacy Policy or how we handle personal information, contact us at:
- Email: privacy@cleantask.co
- CleanTask — Belgium