1. Who is responsible for your data
HouseStaff Ltd, 5, 35 Bush Lane, London, EC4R 0AW, United Kingdom, is the data controller for the personal data described here.
For any privacy question or to exercise your rights, contact [email protected].
Note that customers and cleaners each control some of their own data too. When a cleaner attends your home, they see the property details you chose to share with them for that booking.
2. What we collect, why, and our lawful basis
| Data | What we use it for | Lawful basis |
|---|---|---|
| Account details (name, email, phone, password, role, profile photo) | Creating and running your account, keeping it secure | Contract |
| Property and home details (address, rooms, access notes, photos, preferences) | Letting your cleaner do the job you booked | Contract |
| Booking history, prices, status and receipts | Providing the service, handling disputes, keeping accounting records | Contract; Legal obligation |
| Payment details (card token, payout bank details, transaction records) | Taking payment and paying cleaners | Contract; Legal obligation |
| Identity documents and DBS check results (cleaners only) | Verifying who a cleaner is before they can work in someone's home | Legal obligation; Substantial public interest (safeguarding) |
| Messages between customers and cleaners | Delivering the chat feature and investigating reports of abuse | Contract; Legitimate interests (safety and platform integrity) |
| Reviews, ratings and reports | Building trust on the platform and acting on unsafe behaviour | Legitimate interests (trust and safety) |
| Approximate location and postcode | Showing cleaners near you and matching bookings to an area | Contract; Consent (for precise device location) |
| Device, app and usage data (device model, OS, app version, crash logs, in-app events) | Keeping the app working, fixing bugs and improving it | Legitimate interests; Consent (for optional analytics) |
| Marketing preferences | Sending updates you asked for | Consent |
We collect most of this directly from you. Some comes from your use of the app (device and usage data), and some from third parties — for example the result of an identity or DBS check, or a payment confirmation from our payment provider.
Special category data. DBS results are criminal offence data. We process them only to check that someone is suitable to work in a customer’s home, under the safeguarding condition in Schedule 1 of the Data Protection Act 2018, and we store the outcome rather than the full report wherever we can.
3. Who we share it with
- Other users, as needed for a booking. A cleaner sees your name, address, access and property notes, and messages for their booking. A customer sees the cleaner’s profile, verification status, reviews and messages. We do not share your contact details beyond what the booking needs.
- Service providers acting on our instructions — see the table below. They may only use your data to provide their service to us.
- Professional advisers, insurers and authorities where we are legally required to disclose, or where it is necessary to investigate fraud, a safety incident or a crime.
- A buyer or successor if the business is sold or reorganised. We will tell you if that happens.
We do not sell your personal data, and we do not share it with advertisers.
| Provider | Purpose | Where |
|---|---|---|
| Google Ireland Ltd (Firebase) | App backend: authentication, database, file storage, crash reporting, push notifications | EU (europe-west1), with some support access outside the UK/EEA |
| Stripe Payments UK Ltd | Card payments, cleaner payouts and fraud prevention | UK/EEA and US |
| Identity and DBS check provider | Verifying cleaner identity and criminal record checks | UK |
| Email and support tooling | Sending service emails and handling your support requests | UK/EEA |
4. Sending data outside the UK
Our systems are hosted in the UK and the EEA. Where a provider needs to access data from outside those areas, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum), together with additional safeguards. You can ask us for details of the safeguards in place.
5. How long we keep it
- Account and profile data — while your account is open, then deleted or anonymised within 30 days of your deletion request.
- Booking, payment and invoice records — 6 years after the end of the relevant tax year, because HMRC and company law require it.
- Messages — 12 months after the related booking, or longer where they are evidence in an open dispute or safety investigation.
- Identity and DBS check outcomes — while the cleaner is active, plus 12 months.
- Safety reports and suspension records — up to 6 years, so a removed user cannot simply return.
- Crash and analytics data — up to 14 months, in aggregated or pseudonymised form.
6. Your rights
Under UK GDPR you have the right to:
- be told how your data is used — that is what this page is for;
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we do not have an overriding reason to keep it;
- restrict or object to how we use it, including profiling;
- receive data you gave us in a portable, machine-readable format, and have it sent to another provider where technically feasible;
- withdraw consent at any time, where we relied on consent; and
- not be subject to solely automated decisions with legal or similar effects.
Email [email protected] and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to put things right first.
7. Deleting your account
You can delete your account and its data from inside the app, or by following the steps on our account deletion page. That page explains exactly what is deleted, what we have to keep and for how long.
8. How we protect your data
- Data is encrypted in transit (TLS) and at rest.
- Access is restricted to staff who need it, with individual accounts and multi-factor authentication.
- Database rules restrict each user to their own records; verification status, ratings and booking counts can only be set by our servers, not by users.
- We do not hold full card numbers — those stay with our payment provider.
- If a breach is likely to risk your rights, we will tell the ICO within 72 hours and tell you without undue delay.
9. Children
HOUSESTAFF is for adults. You must be 18 or over to use it. We do not knowingly collect data from children — if you believe a child has given us data, email [email protected] and we will delete it.
10. Cookies and app storage
Our website uses a small number of cookies and the app uses local storage on your device. See our Cookie Policy for the detail and how to control them.
11. Marketing
We will only send you marketing emails or push notifications if you opted in, or if you are an existing customer and the message is about a similar service. Every message has an unsubscribe link, and you can turn notifications off in the app or in your device settings. Service messages about your bookings are not marketing and will continue.
12. Changes to this policy
If we make a material change we will tell you in the app or by email before it takes effect. The date at the top of this page always shows the current version.