Privacy policy

1. Who is responsible for your data

The controller of your personal data is Jelena Malešević PR Roomaid, Rankovića kraj 1, 18223 Draževac, Serbia, tax ID 114473894, registration number 67604300, operating under the name CleanApp (“CleanApp”, “we” or “us”).

We process data in accordance with the Serbian Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018). For any privacy question or request regarding your data, write to us at office@cleanapp.rs.

This English version is provided for convenience. If it differs from the Serbian version, the Serbian version prevails.

2. What data we collect

We collect the data you give us and a small amount of technical data generated while you use the website and the app:

• Account: first name, last name, email address and mobile phone number. We only store your password in hashed form, so not even we can read it.
• Signing in with Google or Apple: we receive your name and email address from the service you choose. If you choose to hide your email with Apple, we receive the address Apple creates for you. We never see the password of that account.
• Address and apartment details: street and number, apartment number, municipality, floor area and the number of rooms, kitchens and bathrooms.
• Bookings: package, add-ons, frequency, dates and times, price, any coupon used, payment method, booking status and the note you leave for the team.
• Payments: amount, currency, order number, status and the transaction ID returned by the bank. Your card number, expiry date and CVV never pass through our systems.
• Communication: questions and messages you send us through the app, by email or on WhatsApp.
• Website usage: if you accept analytics cookies, Google Analytics records which pages you visit, where you came to the site from, your device and browser type and your approximate location, together with a random identifier stored in a cookie. We don't send your name, email or phone number to Google Analytics.
• Technical data: IP address and time of access, which our servers log for security purposes, for example to prevent password guessing. If the mobile app crashes, it sends us an error report with the device model and the operating system and app versions.

We don't ask for sensitive data, such as health information, and we ask you not to include it in the note for the team.

3. Why we use your data

We use your data only for the following purposes, each with a legal basis under the Law:

• Account, scheduling and cleaning: so we know where and when to come, how much work there is and how to reach you about your appointment. The legal basis is the performance of our contract with you.
• Payments, refunds and coupons: the legal basis is the performance of the contract and, for keeping transaction records and business documentation, compliance with our legal obligations.
• Complaints: compliance with our obligations under the Consumer Protection Law.
• Security and abuse prevention: our legitimate interest in protecting your account, our systems and the team that comes to your home.
• Fixing app errors: our legitimate interest in keeping the app reliable.
• Website statistics and improvements: your consent, which you give in the cookie banner and can withdraw.

Account, address and apartment details are required to provide the service, and without them we can't accept a booking. The note for the team and the coupon are optional.

We don't send you marketing messages without your prior consent, and we don't make decisions about you based solely on automated processing, including profiling.

4. Who we share data with

We don't sell or rent out your data. We only share it with those without whom the service can't be provided, and only to the extent they need it:

• The cleaning team, including staff of partner companies: name, address, apartment details, appointment, note and, if needed, phone number, so the team can come and do the job.
• Raiffeisen banka a.d. Beograd and its card processor, for online payments and refunds.
• Google: Firebase, for signing in with Google and Apple accounts and for app error reports, and Google Tag Manager and Google Analytics, for website statistics.
• Apple, when you sign in with your Apple account.
• Hosting providers (Vercel and Render), whose servers run the website, our server and the database. They process data only on our instructions.
• Meta (WhatsApp), if you message us on WhatsApp.
• Accounting and legal service providers who help us meet our legal obligations.
• Public authorities, only where the law expressly requires it.

Some of these providers process data on servers outside Serbia, in the European Union or the United States. We only transfer data in accordance with the Law on Personal Data Protection: to countries with an adequate level of protection, or with appropriate safeguards such as standard contractual clauses.

5. Card payments

When you pay by card, we redirect you to Raiffeisen Bank's secure payment page. You enter your card details directly with the bank over an encrypted connection. They never pass through CleanApp's systems and we don't store them; the bank only tells us the outcome of the transaction.

The bank may ask you to confirm the payment through 3-D Secure verification by the bank that issued your card. If you choose to pay on the day of cleaning, we only record that choice.

6. Cookies and browser storage

On your first visit, the website asks whether you accept analytics cookies. Necessary cookies and records work regardless of your choice, because the website can't work without them.

Necessary:

• cleanapp_session: keeps you signed in. It is deleted when you sign out or when your session expires.
• NEXT_LOCALE: remembers the language you chose. It is deleted when you close your browser.
• cleanapp_consent (browser local storage): remembers your choice in the cookie banner, so we don't ask you on every visit.
• Temporary payment record (sessionStorage): while you pay at the bank, it remembers which booking the payment is for, so we can show you the outcome when you return. It is deleted at the latest when you close the browser tab.

Analytics, only if you accept them:

• _ga and _ga_*: Google Analytics, to tell visitors and visits apart in our statistics. They last up to 2 years.

The same choice also gives or refuses consent for Google to use data for ad measurement and personalisation, if we use such tools. Google Tag Manager loads on every visit. If you reject cookies, Google Analytics doesn't set any cookies, but Google may receive basic information about the visit without cookies or identifiers.

You can change your choice by deleting the cookies and site data for this website in your browser settings. The banner will then appear again, and you will also be signed out.

The sign-in and registration pages load the Google and Apple sign-in buttons, and online payment takes place on the bank's page. These services may use their own cookies under their own privacy policies.

7. How long we keep data

• Account, addresses and messages: for as long as your account is active.
• Bookings and payments: for as long as accounting and tax regulations require, including after your account is deleted, because they are part of our business records. The address where the cleaning took place stays with them, but your name and contact details don't.
• Analytics: Google Analytics keeps visit-level data for up to 14 months, after which only aggregated reports remain.
• Technical logs: briefly, while needed for security, after which they are deleted automatically.

When you delete your account, we delete your first and last name, phone number and email address, addresses where no cleaning took place, unused coupons and the messages you sent us. We cancel your upcoming appointments, sign you out on all devices and, if you signed in with Google or Apple, delete the record of that sign-in in Firebase.

8. How we protect data

We apply technical and organisational safeguards, including:

• all traffic between your device, the website and our server goes over an encrypted HTTPS connection;
• passwords are stored only in hashed form, and the number of failed sign-in attempts is limited;
• your website session is kept in a cookie that scripts on the page can't access;
• data is accessed only by people who need it for their work.

No system is completely secure. If a data breach occurs that may put your rights at risk, we will notify the Commissioner and, where the law requires, you as well.

9. Your rights

Under the Law on Personal Data Protection, you have the right to:

• find out whether we process your data and get a copy of it;
• request correction of inaccurate or completion of incomplete data;
• request deletion of your data;
• request restriction of processing;
• receive the data you gave us in a commonly used, machine-readable format and transfer it to another controller;
• object to processing based on our legitimate interest;
• withdraw your consent where processing is based on it, without affecting the lawfulness of processing before the withdrawal.

You can update your name and phone number yourself on the Personal info page. You can delete your account in the mobile app settings (Delete account) or by writing to office@cleanapp.rs, which is also where you can exercise all your other rights. Please send your request from your account's email address so we can confirm it's you. You withdraw consent to analytics cookies yourself, as described under Cookies and browser storage. We respond without delay and within 30 days at the latest. Exercising your rights is free of charge.

If you believe we process your data unlawfully, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade, www.poverenik.rs.

10. Minors

Only adults can create a CleanApp account. We don't knowingly collect data from anyone under 18, and if we learn that we have, we will delete it.

11. Changes to this policy

We update this policy when our service or the law changes. The current version is always on this page, together with the date it took effect. We will let you know about important changes in advance on the website or in the app, and by email where appropriate.