How CleanFlo handles your data under GDPR
You are holding personal data about your cleaners and about the people whose homes they go into. This is where that data sits, how to get it back out, and which obligations are yours rather than ours.
On this page
This guide describes what the product actually does with your data. It is not the legal document: the policy that governs it is at cleanflo.io/privacy, and the same text is inside the app under the Privacy link at the foot of the sidebar. Where the two disagree, the policy wins.
Where the data actually lives
Everything in CleanFlo sits in one Postgres database run by Supabase, on servers in the EU. Supabase is the primary data processor and operates under a data processing agreement. Database contents are encrypted at rest with AES-256, and everything between your browser and the server travels over TLS.
The separation between companies is enforced in the database rather than in the application. Every table carries a company id and every read is filtered through a row-level security policy tied to the account making the request. A query from your account cannot return another company's rows even if the front end asked it to, because the database refuses.
| What CleanFlo holds about a cleaner | What it does not hold |
|---|---|
| Name, email address, phone number | National Insurance number |
| Job title, whether they are active | Bank details for payroll |
| Their cleans, and photos taken on those cleans | DBS certificates |
| Their messages and reactions | Right-to-work documents |
| Location points captured against a clean | Any movement history between cleans |
That last row is worth reading twice. Location points are held against the clean record they belong to and are deleted with it. They are never retained separately, never aggregated across cleans, and never used to build a picture of where somebody went during their day.
Getting a copy of everything
In Settings, under CleanFlo account, is Export data, and its subtitle names its purpose: "Download your data as CSV files. This fulfils your right to data portability under GDPR." Six tables, one button each, and one button underneath that does all six.
Your business, your account and how CleanFlo works for you
Exported files are in CSV format and can be opened in Excel, Google Sheets, or any spreadsheet application.
- Settings in the sidebar opens this screen.
- Exporting Invoices (4 of 6)… is the main action on this screen.
- New, in the title bar on every screen, adds a clean, client, quote, invoice and more.
- A single table downloads as cleanflo_clients_2026-08-14.csv, dated so successive copies do not overwrite each other.
- All six together download as one file, cleanflo_export_2026-08-14.csv, with each table introduced by a comment line reading "# Clients (12)".
- The final toast counts the lot: "All data exported (243 rows across 6 tables)."
- An empty table says so rather than downloading nothing: "No clients to export."
That combined file is what to reach for if somebody asks you to hand over everything, whether that is a new system, an accountant, or a subject access request from a former cleaner. It is not the whole database: messages, health and safety records and inventory are not among the six tables, and those come out of their own screens.
If you stop paying
The important sentence first: nothing is deleted. A lapsed subscription pauses access. It does not remove a single clean, invoice, client or message, and everything is exactly where you left it when you come back.
What you see instead of the app depends on why billing stopped, and each state names its own way out.
Cleaners see a different screen again. Theirs is headed Access suspended and tells them the company's subscription needs attention and to contact their manager, because there is nothing they can do about it and nothing useful in telling them about a card.
Brennan Cleaning Ltd's subscription needs attention. Please contact your manager to restore access.
No price, no card and no way to pay: this is not the cleaner's bill to settle.
Closing your account, and what gets kept
Closing the account is on the Privacy & closure section of Settings, the last one in the list. It is owner-only: a supervisor has no Privacy section and no route to one. The section opens on the three documents that say what is held and who touches it, Privacy policy, Data Processing Agreement and Sub-processors, and the closure control sits under a rule below them.
It is deliberately two decisions rather than one. Nothing is destroyed on the day you press the button: closure is scheduled, the account carries on working normally, and the deletion itself runs 30 days later. Inside that window one button puts it back exactly as it was, because what has been written is a date rather than a tombstone.
Open Settings and pick Privacy
Or go straight to /settings?tab=privacy, which is a bookmarkable address like every other section.
Press Close my account
A quiet red button under the heading Close this account. On its own it does nothing except open the confirmation below it, so pressing it is safe.
Type the phrase
The label reads Type DELETE Brennan Cleaning Ltd to confirm with your own company name in place of that one. Case and spacing matter; a leading or trailing space is forgiven. Schedule deletion stays disabled until the phrase matches, so there is no misclick that can start this.
Press Schedule deletion
CleanFlo confirms with "Closure scheduled. You have 30 days to change your mind." The heading then reads This account is scheduled for deletion and names the exact date everything is destroyed on.
Export before that date
The account still works during the window, so Export data still gives you all six CSVs. After the date nothing can be recovered, by you or by us.
To stop it, open the same section and press Keep my account. CleanFlo answers "Closure cancelled. Nothing was deleted.", and that is literally true: nothing had been. The window exists because the terms already promise 30 days of access after a cancellation, so this honours a commitment rather than inventing a grace period.
Deletion is also not unconditional, because some of what CleanFlo holds you are legally required to keep. The retention periods in the policy are these.
| What | How long it is kept |
|---|---|
| Account data | Your subscription, plus 2 years after the account closes |
| Invoices and payment records | 7 years, in line with HMRC requirements |
| Health and safety incident reports | At least 3 years from the date of the incident |
| Staff and cleaner records | 2 years after deactivation, or until you ask for deletion |
| Clean location points | Deleted with the clean they belong to |
| Server logs and analytics | Up to 12 months |
So a request to erase everything will honour everything it can and hold back the financial records until the statutory period is up. That is the normal position for any business system and it is worth knowing before you promise a former employee that every trace of them has gone.
The bit that is yours, not ours
The word that matters is controller. CleanFlo and Supabase are processors: we hold and move data on your instruction. You are the controller of the personal data in your account, because you decided to collect it and you decide what happens to it. That means most of the obligations sit with you, and no software can take them off you.
Where CleanFlo helps is the mechanical part. A subject access request from a former cleaner is answerable from the Export data section plus their staff record, and a request from a client is answerable from the clients and locations exports. Neither takes long. What CleanFlo cannot do is decide your lawful basis, write your privacy notice, or hold the conversation with the ICO.
| Personal data | Where it lives | Who can see it |
|---|---|---|
| Cleaner name, phone, email | Staff record | Owner only |
| Clean start and finish points Captured when a clean is started on the phone | Clean verification | Owner only |
| Client contact name and email | Client record | Owner only |
| Home address and access notes Key safe codes, alarm codes, parking | Location record | Assigned cleaner |
| Photos taken at a clean | Clean record | Owner and cleaner |
| Incident reports naming a person | Health & Safety | Owner only |
Four habits worth having
Export at every quarter end
Press Export All Data when you do the VAT return and keep the dated file somewhere backed up. It costs a minute and it makes every other problem smaller.
Write access notes as if the client will read them
They are personal data about somebody's home, and they are visible to whichever cleaner is booked. "Key safe left of the porch, code on the clean" is useful. Anything about the occupant that is not needed to clean the property should not be there at all.
Deactivate leavers on their last day
Not at the end of the month. Deactivation ends access immediately while keeping the record, so there is no reason to wait.
Keep one owner account per person
A shared login means you cannot tell who did what, and the activity feed becomes useless. Two owners is two accounts.
Common questions
Where is my data physically stored?
If I cancel, how long do I have to get my data out?
A former cleaner has asked for everything you hold on them. What do I do?
Can I delete a single client and everything about them?
Previous: How to manage your login, team access and security
Did this answer your question?
Good. Back to the app, then.
Sorry about that. Tell us what you were looking for and a person will answer it.
Still stuck?
Every message is read by a person on the CleanFlo team.
