Privacy Policy

DRAFT — pending legal review. Effective date: [EFFECTIVE DATE]. Last updated: [DATE].

This Privacy Policy explains how [Cleaner OS Inc.] ("Cleaner OS", "we", "us") handles personal information. We provide an AI-native operating system for cleaning companies.

1. Two roles, two sets of rules

Our service involves two different relationships, and our privacy responsibilities differ in each:

• When you are our customer (a cleaning company, or an owner/admin signing up) — we act as a controller of your account, billing, and usage information, and this Policy governs.
• When we process data on behalf of a customer (e.g., a cleaning company's own clients, their addresses, photos, or its cleaners' details) — we act as a service provider / processor. The cleaning company is the controller, its privacy notice governs how that data is used, and our handling is set by our Data Processing Addendum. If you are a client or cleaner of a company that uses Cleaner OS, please contact that company to exercise your rights; we will assist them.

2. Information we collect

Account & profile: name, email, phone, company, role, password (hashed), preferences, language. Billing: plan and subscription status. We do not process payments today and collect no card details; when paid plans go live, card details will be handled by our payment provider and never stored by us. That provider will be named in the DPA before it goes live. Usage & device: log data, IP address, device/browser, feature usage, and diagnostics. Communications: messages you send us, support requests, and email consent records. Cookies & similar technologies: see our Cookie Policy. Processed on behalf of customers (as processor): client and cleaner contact details, service addresses, property/access notes (including access codes), schedules, job photos, ratings, and tips. We handle this only per the customer's instructions and the DPA.

3. How we use information

To provide, secure, and improve the service; process subscriptions and payments; communicate with you (service messages, and marketing where permitted); provide support; detect fraud and abuse; comply with law; and operate AI features (see §6). We do not sell personal information, and we do not use customer-processed data to train third-party AI models without the customer's instruction.

4. How we share information

• Sub-processors / service providers that power the platform — Supabase (database, auth, storage), Vercel (hosting and the AI Gateway), OpenAI, Anthropic and Google (AI text processing, under zero-data-retention terms), Resend (email delivery and receipt), and Geoapify (geocoding and travel-time). Our current list and change-notice process are in the DPA and on our sub-processors list.
• Legal / safety: to comply with law, enforce our terms, or protect rights and safety.
• Business transfers: in a merger, acquisition, or sale, with notice as required.

We do not sell or "share" personal information for cross-context behavioral advertising. We honor browser Global Privacy Control (GPC) signals as opt-out requests where applicable.

5. Email and communications

We send transactional email — invitations, job and schedule notices, and messages sent to you through the product — and we receive replies to those messages. We do not send SMS today; if we introduce it, the SMS Terms will apply and the provider will be named in the DPA first.

6. AI and automated processing

Cleaner OS uses AI to assist tasks such as drafting client records, suggesting pricing, recommending assignments, and flagging risks. AI provides recommendations; a human reviews and decides material actions. AI output can be inaccurate — do not rely on it as professional advice. Where state law grants rights regarding profiling or automated decision-making, you may exercise them as described in §8. Certain features (e.g., recruiting tools) may constitute automated employment decision tools and are governed by additional terms and disclosures when offered.

7. Sensitive information & security

Some data we process is sensitive — for example, home access codes and photos of customers' homes. We apply safeguards including encryption in transit and at rest, strict tenant isolation enforced in the database, least-privilege access, and an append-only audit log. To be precise about one thing: home access codes are stored as ordinary text in our database under those controls — not in a separate secrets vault. See Security for what that does and does not mean. Internal access to a customer's data for support is read-only by default, reason-gated, time-limited, and logged. No method of transmission or storage is 100% secure.

8. Your privacy rights

Depending on your U.S. state of residence (e.g., California, Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws), you may have rights to: access, correct, delete, and obtain a copy of your personal information, and to opt out of sale, "sharing," targeted advertising, and certain profiling. We do not sell personal information.

To exercise rights as our direct customer, contact [privacy@cleaner-os.com]. We will verify your request and respond within the time required by law; you may appeal a denial by replying to our response. Authorized agents may submit requests with proof of authority. If your data is processed by a cleaning company that uses Cleaner OS, contact that company; we will support them in responding.

California (CCPA/CPRA): you have the rights above, the right to limit use of sensitive personal information, and the right to non-discrimination for exercising them.

9. Data retention

We retain personal information for as long as needed to provide the service and for legitimate or legal purposes, then delete or de-identify it. Customer-processed data is retained and deleted per the DPA and the customer's instructions.

10. Children

The service is intended for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided data, contact [privacy@cleaner-os.com].

11. Where we operate

Cleaner OS is a United States service. We offer it only to businesses in the United States, we host it in the United States, and we have no plans to offer it elsewhere. We do not knowingly provide the service to businesses outside the US.

12. Changes & contact

We may update this Policy and will post the new effective date. Material changes will be notified as required.

Contact: [Cleaner OS Inc.], [principal mailing address] · [privacy@cleaner-os.com]