Privacy notice

What we collect. Your name, contact details and address; property details (type, bedrooms, access notes); your booking and payment history; your communications with us; your survey ratings and comments; and — only if you choose to give it — a door or key-safe entry code.

What we do with it, and why. Providing your cleaning service — bookings, matching a cleaner, reminders and service messages — under our contract with you. Taking payment and keeping financial records — contract, and legal obligation for accounting records. Service quality — surveys, follow-ups and service analytics — under our legitimate interests. Marketing messages only with your consent, which you can withdraw at any time. Advertising measurement under legitimate interests, with cookies only by consent.

What your cleaner sees. Before accepting a job, a cleaner sees only your postcode district. Once assigned, they see your address, name, phone number and cleaning instructions. If you store an entry code, it is encrypted, never shown to office staff by default, and only revealed to your assigned cleaner in a short window around the clean — every reveal is logged.

Phone calls to and from our team may be recorded, transcribed and summarised (including using AI tools) for quality and record-keeping.

How long. While you’re a customer and then up to 2 years, after which your record is anonymised. Financial records are kept 7 years (legal requirement). If you enquire but don’t become a customer, we delete your enquiry after 1 year.

Cleaners are self-employed sub-contractors — not employees or workers of Poppins. Because cleaners provide services unsupervised in customers’ homes, we run identity and background checks. We collect more from you than from anyone else, and this section lists all of it.

What we collect. Identity and contact details (name including previous names, date of birth, nationality, address history); photos of your passport and/or driving licence and the details in them; your right to work evidence (passport, or a Home Office share code we check manually on GOV.UK); your DBS application details and the result; a criminal-record declaration; your National Insurance number and (for tax reporting) UTR; referee details and their responses; your work preferences and equipment; your bank details via Stripe (we never see the account number); and your service history on the platform (jobs, ratings, payments).

AI document reading. When you photograph your passport or licence, the image is read by an AI service (provided by Anthropic) to fill in the form for you — you check and confirm every field before anything is saved. Document images you upload as evidence are stored securely by us.

Checks and who runs them. Identity is verified against your documents, or bank-verified via OneID (their own privacy notice applies to the bank step). Right to work uses your British/Irish passport, or a share code we check on GOV.UK, as UK law requires. Your DBS application is submitted to Aaron’s Department Limited (trading as Employment Tools), a registered DBS umbrella body, with your consent collected during onboarding — we record the outcome, not the certificate content. Your criminal-record declaration is handled as criminal offence data in accordance with Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018. Referees you nominate are emailed for a reference; their answers are confidential to our vetting team and not shared with you.

Tax reporting. UK law (the “DAC7” platform-reporting rules) requires us to report sellers’ details — including name, address, NI/UTR and earnings — to HMRC annually. This is a legal obligation; we can’t opt you out.

How long. Your application data while your account is active and for 6 years after you stop providing services through the platform (tax and legal-claim periods); financial records 7 years.

A self-employed cleaner applying to provide services through Poppins gave us your name and contact details. We use them only to ask for a reference (one email, one reminder). Your answers are kept with the applicant’s vetting record and are not shown to them. Basis: legitimate interests (vetting people who provide services in customers’ homes). If you’d rather we deleted your details, reply to the request email and we will.

Our booking enquiry form collects what you type into it. With your consent, we use cookies to measure which advertising brought you here (Google Ads click IDs and similar, kept for 90 days) — declining them doesn’t affect the service. We report conversions to Google in a form designed not to identify you directly.

We use service providers who handle data on our instructions:

• Supabase — our database and infrastructure
• Vercel — website and application hosting
• Stripe — payments in, and payouts to cleaners (also a controller for its own compliance)
• Resend — email delivery, including receiving your replies
• Twilio — SMS, WhatsApp and phone calls, including recordings
• Anthropic — AI reading of identity documents and call transcription/summaries
• OneID — bank-based identity verification
• Aaron’s Department Ltd (Employment Tools) — DBS checks
• Google — advertising measurement

And where the law or the service requires: HMRC (DAC7), your assigned cleaner / your customer (the details each needs for the clean), and professional advisers. Some providers process data outside the UK (notably in the United States); where they do, transfers are protected by UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Encryption in transit and at rest; door-entry codes additionally encrypted at application level with access limited to the assigned cleaner in a time window, and every reveal audit-logged; identity-document numbers held behind audited access controls; role-based staff access with mandatory two-factor authentication.

You can ask us to: access your data; correct it; delete it; restrict or object to processing (including anything based on legitimate interests); port it; and withdraw any consent. Contact us as above — we respond within one month. Some data we must keep despite a deletion request (for example financial records and DAC7 reports); we’ll tell you what and why.

We don’t make solely automated decisions with legal or similarly significant effects about you. AI tools assist (document reading, call summaries) but a person checks or decides.

Complaints. We’d rather you told us first — but you can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.

We’ll update this notice as the service evolves and show the date at the top. Significant changes will be flagged to you directly.