Privacy notice

Who is responsible

MopGoblin is operated by [Operator: legal name, registered address and company number]. Contact us about your data at [privacy contact email].

Each cleaning business you book with decides what happens to the details of your bookings with it: it is the controller of that data, and MopGoblin processes it on its behalf under a data-processing agreement. MopGoblin is the controller of your sign-in account (your email address and name) and of the accounts of the businesses’ staff.

What we store

Your account: your email address and, if you give it, your name.

For each booking: the contact name and phone number you give, the address and any access notes, what you asked for and what was agreed, the messages you exchange with the business, and any photos you upload.

For staff: name, email address and a hash of the password.

We use no tracking or analytics. The only cookies are the ones that keep you signed in and that tie an emailed sign-in link to the browser that asked for it.

Why

To arrange and carry out the cleaning you book (performing a contract), to sign you in, and to keep the service secure, for example by limiting repeated sign-in attempts (legitimate interest).

Who processes it for us

Hetzner Online (Germany): the servers, the database and file storage, in the EU.

Amazon Web Services (Frankfurt region): sending email.

Cloudflare: the bot check on sign-in and registration forms (Turnstile). Cloudflare may process the check outside the EU, under the EU-US Data Privacy Framework and standard contractual clauses.

Sentry (EU region): error reports, which hold no request bodies, cookies or query strings.

How long we keep it

Photos: deleted after the business’s retention period once the booking is closed, 90 days unless the business sets another, at most a year.

Unsent booking drafts: deleted 7 days after you last changed them.

Sign-in codes: deleted after a day. Sessions: deleted once they expire.

Closed bookings: anonymized 3 years after they close.

Logs: 14 days. Error reports: 30 days. Backups: 30 days.

A business that closes has its data deleted 30 days after closing.

Your rights

You can download your data from your account page at any time: your account, your details at each business, and each booking as you see it, with its versions, the messages between you and the business, and a list of your photos. Notes a business keeps for itself or its cleaners are not in the download.

You can delete your account there too. Your photos are deleted at once, your open bookings are cancelled and the businesses are told, and what identifies you or your home is removed from the rest: your name, contact details, address, messages and the work described in your own words or the business’s. The dates, prices and the business’s own services stay, with nothing that leads back to you. Copies in our backups disappear as the backups expire, within 30 days.

You can also ask us to correct your data, object to how we use it, or restrict it, at [privacy contact email], and you can complain to a data protection supervisory authority.