Privacy policy

NoxClean is the data controller for the personal information described here. We are registered in England and Wales at 86–90 Paul Street, London EC2A 4NE. This policy is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

• Account details — name, email address, mobile number, and password (stored only as a secure hash).
• Booking details — your address, home size, access notes, chosen extras, and visit history.
• Payment details — handled by Stripe. We store a payment reference and the last four digits of the card, never the full number.
• Reviews and messages — ratings and feedback you leave, and correspondence with our support team.
• Technical data — IP address, device and browser type, and pages visited, used to keep the service secure and working.
• Sign-in provider data — if you sign in with Google or Apple, we receive your name and email address from them. We never receive your password.

• To provide the service (contract) — matching you to a cleaner, scheduling visits, taking payment, and sending booking confirmations and reminders.
• To keep people safe (legitimate interests) — vetting cleaners, investigating incidents, and preventing fraud and abuse.
• To improve the service (legitimate interests) — understanding which features are used and where people get stuck.
• To market to you (consent) — occasional offers and product news, only if you opt in. You can withdraw at any time.
• To meet legal duties (legal obligation) — tax, accounting, and responding to lawful requests.

• Your cleaner — the assigned cleaner sees your first name, address, access notes, and job details. They do not see your payment information.
• Stripe — to process card payments securely.
• Email and messaging providers — to deliver booking confirmations, reminders, and receipts.
• Postcodes.io — to validate UK postcodes for serviceability. Only the postcode is sent.
• Professional advisers and authorities — where we are legally required to disclose.

We do not sell your personal information, and we never have.

Account and booking records are kept while your account is open and for six years afterwards, to meet UK tax and accounting requirements and to defend legal claims. Technical logs are kept for a much shorter period. When a retention period ends, data is deleted or irreversibly anonymised.

Our systems are hosted in the UK and the European Economic Area. Where a supplier processes data outside the UK, we rely on adequacy regulations or the International Data Transfer Agreement to protect it.

Connections are encrypted in transit. Passwords are hashed, never stored in readable form. Access to customer data inside our team is limited to staff who need it, and administrative actions are recorded in an audit log.

• Ask for a copy of the personal data we hold about you.
• Ask us to correct anything inaccurate.
• Ask us to delete your data where we have no ongoing need to keep it.
• Object to, or ask us to restrict, processing based on legitimate interests.
• Ask for your data in a portable format.
• Withdraw marketing consent at any time, without affecting anything done beforehand.

To exercise any of these, use our contact page. We respond within one month. If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk.

The service is not intended for anyone under 18, and we do not knowingly collect data about children. If you believe we have, contact us and we will delete it.

We use a small number of cookies to keep you signed in and to understand how the site is used. See our cookie policy for the detail.

We will update this page when our practices change and revise the date above. If a change materially affects you, we will tell you directly.