Privacy Policy

Last updated: 14 October 2026

Who we are

CleanPilot Ltd ("CleanPilot", "we", "us") provides software that UK cleaning businesses use to manage bookings, invoicing, staff, and clients. This policy covers the personal data we process as part of that service.

What we collect

Depending on how you use CleanPilot, we process:

• Account data — your name, email, phone number, and business details when you register.
• Client and booking data — the customer, scheduling, and address information a cleaning business enters into CleanPilot to run its own operations. We process this data on that business's behalf; the business is the data controller for its own clients, and CleanPilot acts as processor.
• Payment data — handled directly by our payment processors (Stripe and GoCardless). We never see or store full card or bank account numbers.
• Usage data — standard technical data such as IP address and browser type, collected for security and reliability, not for advertising.

How we use it

• To provide and operate the platform — bookings, invoicing, scheduling, and the features you subscribe to.
• To process payments and subscriptions via Stripe and GoCardless.
• To send transactional emails (booking confirmations, invoices, account notices) via our email provider.
• Where a business enables it, to power optional AI features (churn prediction, pricing suggestions, WhatsApp assistance) via Anthropic and/or OpenAI, and WhatsApp messaging via Twilio.
• Where a business connects it, to sync data with Xero (accounting) or Hostaway (short-let property management).

Who we share data with

We share data only with the service providers needed to run CleanPilot, each bound by their own data processing terms: Stripe and GoCardless (payments), Twilio (WhatsApp/SMS), Anthropic and OpenAI (optional AI features), Xero (optional accounting sync), Hostaway (optional short-let sync), and our transactional email provider. We do not sell personal data, and we do not share it for third-party advertising.

Data security

Sensitive fields — including two-factor authentication secrets, connected-account credentials, and portal access tokens — are encrypted or hashed at rest. Access to a business's data is scoped to that business; staff accounts only see what their role permits.

Your rights

Under UK GDPR you have the right to access, correct, export, or delete your personal data. Account owners can export or permanently delete their business's data at any time from account settings. If you're a client of a business using CleanPilot rather than an account holder yourself, contact that business directly, or reach us at hello@cleanpilot.uk and we'll help route your request. See our GDPR page for more detail on exercising these rights.

Data retention

We retain account and business data for as long as an account is active, plus a limited period afterward for legal, accounting, and fraud-prevention purposes. Deleting an account via the self-service option removes the associated data, subject to any records we're legally required to keep.

Contact

Questions about this policy or your data: hello@cleanpilot.uk.