Privacy notice

What we collect. Your name, contact details and address; property details (type, bedrooms, access notes); your booking and payment history; your communications with us; your survey ratings and comments; and — only if you choose to give it — a door or key-safe entry code.

What we do with it, and why. Providing your cleaning service — bookings, matching a cleaner, reminders and service messages — under our contract with you. Taking payment and keeping financial records — contract, and legal obligation for accounting records. Service quality — surveys, follow-ups and service analytics — under our legitimate interests. Marketing messages only with your consent, which you can withdraw at any time. Advertising measurement under legitimate interests, with cookies only by consent.

What your cleaner sees. Before accepting a job, a cleaner sees only your postcode district. Once assigned, they see your address, name, phone number and cleaning instructions. If you store an entry code, it is encrypted, never shown to office staff by default, and only revealed to your assigned cleaner in a short window around the clean — every reveal is logged.

Phone calls to and from our team may be recorded, transcribed and summarised (including using AI tools) for quality and record-keeping.

Reviews you leave on Google. If you review us on Google, we may show your review on our website’s page for your area, with your first name, the first letter of your surname and your neighbourhood — never your street or postcode. To place it we match the name on your review to your customer record and the area of the home we clean for you. This is under our legitimate interests; ask us and we’ll take it down.

How long. While you’re a customer and then up to 3 years, after which your record is anonymised. Financial records are kept 7 years (legal requirement). If you enquire but don’t become a customer, we delete your enquiry after 3 years.

Cleaners are self-employed sub-contractors — not employees or workers of Poppins. Because cleaners provide services unsupervised in customers’ homes, we run identity and background checks. We collect more from you than from anyone else, and this section lists all of it.

What we collect. Identity and contact details (name including previous names, date of birth, nationality, address history); photos of your passport and/or driving licence and the details in them; if you’re a British or Irish citizen without a driving licence, a photo of one other document your DBS check needs (such as a birth certificate, bank statement or utility bill) and the date on it; your right to work evidence (passport, or a Home Office share code we check manually on GOV.UK); your DBS application details and the result; a criminal-record declaration; your National Insurance number and (for tax reporting) UTR; referee details and their responses; your work preferences and equipment; your bank details via Stripe (we never see the account number); and your service history on the platform (jobs, ratings, payments).

If you apply through our online form. Applying at poppins.cleaning/join creates an account for you straight away so you can save and return. Step one asks for your name, email, mobile, how you heard about us and — optionally — how you identify (equality monitoring only; it is never used in a decision and is not the gender field on a DBS application). The rest of the application asks for the details listed above, plus an optional short video introducing yourself (about a minute), watched only by the Poppins team reviewing applications. We don’t run the paid checks (identity, DBS) until after we have spoken to you. If your application is unsuccessful, or you start one and don’t finish it, we delete it — including the video, any documents and your login — six months after you last touched it. If you’d rather not record a video, skip that step and we’ll have a chat on the call instead.

AI document reading. When you photograph your passport or licence, the image is read by an AI service (provided by Anthropic) to fill in the form for you — you check and confirm every field before anything is saved. The same service also looks at any other document you upload as ID (for example a birth certificate or a bank statement) to check it is the document it was uploaded as, so a passport or licence added in the wrong place can be moved to the right one. Nothing from those other documents is kept or used. Document images you upload as evidence are stored securely by us.

Your profile on our website (optional). If you switch it on in the app, your first name, photo, years of experience and the words you write about yourself appear on poppins.cleaning, on the pages for the areas you can reach — which shows roughly where you’re based. It’s off unless you (or our team, with your agreement) turn it on, and you can switch it off at any time. Consent (Art 6(1)(a)).

Checks and who runs them. Identity is verified against your documents, or bank-verified via OneID (their own privacy notice applies to the bank step). Right to work uses your British/Irish passport, or a share code we check on GOV.UK, as UK law requires. Your DBS application is submitted to Aaron’s Department Limited (trading as Employment Tools), a registered DBS umbrella body, with your consent collected during onboarding — we record the outcome, not the certificate content. Your criminal-record declaration is handled as criminal offence data in accordance with Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018. Referees you nominate are emailed for a reference; their answers are confidential to our vetting team and not shared with you.

Tax reporting. UK law (the “DAC7” platform-reporting rules) requires us to report sellers’ details — including name, address, NI/UTR and earnings — to HMRC annually. This is a legal obligation; we can’t opt you out.

How long. Your application data while your account is active and for 6 years after you stop providing services through the platform (tax and legal-claim periods); financial records 7 years.

A self-employed cleaner applying to provide services through Poppins gave us your name and contact details. We use them only to ask for a reference (one email, one reminder). Your answers are kept with the applicant’s vetting record and are not shown to them. Basis: legitimate interests (vetting people who provide services in customers’ homes). If you’d rather we deleted your details, reply to the request email and we will.

Our booking enquiry form collects what you type into it. With your consent, we use cookies to measure which advertising brought you here (Google Ads click IDs and similar, kept for 90 days) — declining them doesn’t affect the service. With that same consent we also load Google’s advertising tag, and when you ask us for a quote or start a plan we tell Google that an ad led to it, along with your email address and phone number in hashed (scrambled) form so Google can match it to your Google account without receiving them readable. Decline advertising cookies and none of this happens.

If you give us your house number or name when asking for a quote, we look your home up on the government’s public Energy Performance Certificate register to check its size against the cleaning hours we suggest. We keep the floor area and the certificate’s inspection date with your enquiry, not the register’s address record, and this step is optional — skip it and we go on bedrooms and bathrooms alone.

We use service providers who handle data on our instructions:

• Supabase — our database and infrastructure
• Vercel — website and application hosting
• Stripe — payments in, and payouts to cleaners (also a controller for its own compliance)
• Resend — email delivery, including receiving your replies
• Twilio — SMS, WhatsApp and phone calls, including recordings
• Anthropic — AI reading and checking of the documents you upload as ID, and call transcription/summaries
• OneID — bank-based identity verification
• Aaron’s Department Ltd (Employment Tools) — DBS checks
• Google — advertising measurement

And where the law or the service requires: HMRC (DAC7), your assigned cleaner / your customer (the details each needs for the clean), and professional advisers. Some providers process data outside the UK (notably in the United States); where they do, transfers are protected by UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Encryption in transit and at rest; door-entry codes additionally encrypted at application level with access limited to the assigned cleaner in a time window, and every reveal audit-logged; identity-document numbers held behind audited access controls; role-based staff access with mandatory two-factor authentication.

You can ask us to: access your data; correct it; delete it; restrict or object to processing (including anything based on legitimate interests); port it; and withdraw any consent. Contact us as above — we respond within one month. Some data we must keep despite a deletion request (for example financial records and DAC7 reports); we’ll tell you what and why.

We don’t make solely automated decisions with legal or similarly significant effects about you. AI tools assist (document reading, call summaries) but a person checks or decides.

Complaints. We’d rather you told us first — but you can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.

We’ll update this notice as the service evolves and show the date at the top. Significant changes will be flagged to you directly.