Privacy Policy

This Privacy Policy explains how CleanTrack360, Inc. (“Company,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you access or use the CleanTrack360 platform (the “Platform”), our website, our mobile apps, and related services.

Using the Platform is not, by itself, consent to everything described here. Each purpose has its own legal ground, and where consent is the ground we ask for it separately and you can withdraw it at any time. Section 12 sets out those grounds for Europe and the United Kingdom, and Section 13 for Brazil.

1. Two Kinds of Data, Two Different Roles

CleanTrack360 is business software. Most of the personal information that passes through the Platform is not about our customers, it is about their employees and their clients. Privacy law treats those two situations differently, so this policy separates them from the start.

If you are a cleaner, a supervisor, or a client of a company that uses CleanTrack360 and you want to access, correct or delete information about yourself, that request belongs to the company you work with. We cannot act on their data without their instruction, and we will refer you to them. If you do not know who to contact, write to us and we will point you to the right place.

Businesses that need a written data processing agreement covering their role as controller may request one at info@cleantrack360.com.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide, including:

• Account Information: Name, email address, phone number, company name, and billing details when you create an account or subscribe.
• Business Data: Client records, employee information, schedules, inspection reports, proposals, and other operational data you input into the Platform. This is Customer Data, as described in Section 1.
• Communications: Messages, support requests, feedback, and any other information you send to us.
• Public Form Submissions: Contact details and business information you submit through our public forms, including quote requests, support tickets, and waitlist sign-ups.

2.2 What Our Website and Web App Collect Automatically

This subsection describes our website and the browser version of the Platform only. Our iOS and Android apps behave differently, and Section 2.3 describes them on their own so that nothing here is read as applying to them.

When you use our website or the web app, we automatically collect:

• Device & Browser Information: IP address, browser type, operating system, device and browser identifiers, and screen resolution.
• Usage Data: Pages visited, features used, click patterns, session duration, and referring URLs.
• Cookies & Similar Technologies: We use cookies, local storage, and similar technologies for authentication, preferences, and analytics. See Section 8.

Google Analytics runs here and nowhere else, and only after you allow it. Until you do, no analytics script is loaded and none of the usage data above is sent to Google. Section 8.1 explains the choice and how to change it.

2.3 What Our Mobile Apps Collect

The CleanTrack360 apps for iOS and Android contain no analytics SDK, no advertising SDK, and no third-party tracking software. They do not use Google Analytics. They do not collect an advertising identifier, they do not build a behavioral profile, and they do not track you across other companies' apps or websites. What the apps collect is:

• Account and Business Data: The information in Section 2.1, entered by you or shown to you because your account has access to it.
• Precise Location: GPS coordinates at clock in and clock out, only where your employer has enabled time tracking and only after you grant the operating system permission. Section 2.4 explains this in full.
• Photos and Files: Only the ones you choose to attach to an inspection, a quality report, or a chat message. The app opens your camera or library at the moment you pick something and reads nothing else.
• Push Notification Token: An identifier issued by Apple or Google for your installation of the app, used to deliver schedule and assignment notifications. It is tied to the installation rather than to you, and it stops being used when you sign out or uninstall.
• Diagnostics You Send Us: When you submit a bug report or feedback from within the app, we attach the app version, operating system version, device model and brand, the screen you were on, and the most recent error, so the report can be acted on. This happens only when you send a report.

None of this is used for advertising, marketing, or profiling, and none of it is sold or disclosed to data brokers.

2.4 Precise Location, and Who Is Responsible for It

When an employer enables time tracking, the Platform records GPS coordinates at the moment a worker clocks in and clocks out, and may record the coordinates of a job site. It does not track location continuously and does not record location between those events or outside a work session.

Several privacy laws classify precise geolocation as sensitive personal information requiring consent. That consent is the employer's to obtain, not ours: the employer decides to switch the feature on, decides who it applies to, and holds the employment relationship in which it operates. Employers using this feature are responsible for providing any notice and obtaining any consent their jurisdiction requires, and for complying with applicable employee monitoring laws. We process these coordinates solely to deliver the feature to that employer and never use them for advertising, profiling, or any purpose of our own.

2.5 Information from Third Parties

If you sign in using Google or Apple, we receive your name, email address and a unique identifier from that provider. We do not receive your password. If you use Apple's option to hide your email address, we receive a relay address rather than your own, and we use it the same way we would use any other address.

We may also receive information from other third-party services you connect to the Platform, such as payment processors, accounting software, or calendar integrations. This data is governed by both this Privacy Policy and the third party's own policies.

3. How We Use Your Information

We use your information for the following purposes:

• Providing Services: Operating, maintaining, and improving the Platform and its features.
• Account Management: Creating and managing your account, processing payments, and communicating about your subscription.
• Customer Support: Responding to your inquiries, troubleshooting issues, and providing technical assistance.
• Analytics & Improvement: Understanding how users interact with the Platform to improve functionality, performance, and user experience.
• Communications: Sending transactional emails (for example billing confirmations, security alerts, and address confirmation links) and, with your consent, promotional communications.
• Security: Detecting, preventing, and addressing fraud, abuse, security incidents, and technical issues.
• Legal Compliance: Complying with applicable laws, regulations, legal processes, or enforceable governmental requests.

We do not use Customer Data to train machine learning models, and we do not use it for any purpose other than delivering the Platform to the business that owns it.

4. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We may share information in the following circumstances:

• Service Providers: With vendors who help us operate the Platform, listed by name in Section 5. These providers are contractually restricted to processing data on our behalf and for no purpose of their own.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction.
• Legal Requirements: When required by law, legal process, or governmental request, or to protect the rights, property, or safety of Company, our users, or the public.
• With Your Consent: When you explicitly authorize us to share your information with a specified third party.

5. Service Providers We Use

We name these so you can evaluate them yourself. All of them process data on our instructions under written terms.

• Supabase and Amazon Web Services: Database hosting, file storage, and authentication. Data is stored in the United States.
• Vercel: Application hosting and content delivery.
• Stripe: Payment processing. Card numbers go directly to Stripe and are never stored on our systems.
• Resend: Delivery of transactional and lifecycle email.
• Google: Analytics on our website and web app only, mapping and geocoding, optional calendar integration, and the generative AI model behind the in-app assistant.
• Apple and Google: Mobile app distribution and push notification delivery.

No analytics or advertising SDK from any of these providers is embedded in our mobile apps. The only provider code the apps carry is what is needed to sign you in, deliver push notifications, show maps, and receive updates.

This list may change as our infrastructure changes. Material additions will be reflected here.

5.1 Artificial Intelligence Features

The Platform includes an in-app assistant that answers questions about how to use CleanTrack360. When you send it a message, that message and the relevant help-article context are transmitted to Google's generative AI service to produce a response. We do not send client records, employee records, or job data to that service, and our providers are contractually restricted to processing the data on our behalf rather than for training their own models. If you would prefer not to use this feature, simply do not use the assistant.

We do not use automated decision-making or profiling to produce legal or similarly significant effects about any individual.

6. Data Retention

We retain Account Data for as long as the account is active. Customer Data is retained for as long as the subscribing business keeps it in the Platform, and is deleted when that business deletes it or when its account is closed.

Individual users can delete their own account from the Platform, which removes their profile and the records tied to it. An administrator who is the only administrator of a company must transfer that role before deleting, so that a business is never left without anyone able to reach its own data.

After deletion, residual copies may persist in encrypted backups for a limited period before they expire on their normal rotation. We also retain records we are required to keep, such as billing and tax records, for the period the law requires, and information needed to resolve a dispute or enforce an agreement for as long as that matter is open.

7. Your Privacy Rights

A growing number of U.S. states give residents rights over their personal information, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. The details differ from state to state and not every law applies to every business. Rather than track those differences, we extend the following to anyone who asks, and we will honor any additional right your state gives you:

• Know and Access: Ask what personal information we hold about you, where it came from, why we have it, and who we have shared it with.
• Correction: Ask us to fix information that is inaccurate or incomplete.
• Deletion: Ask us to delete your personal information, subject to the retention obligations in Section 6.
• Portability: Ask for a copy of your data in a portable, machine-readable format.
• Opt Out of Sale, Sharing and Targeted Advertising: We do none of these, so there is nothing to opt out of. We honor Global Privacy Control and similar browser signals regardless.
• Limit Use of Sensitive Information: Ask us to limit our use of sensitive personal information. We already use it only to deliver the feature it belongs to.
• Non-Discrimination: We will not deny service, charge a different price, or provide a lower quality of service because you exercised a privacy right.

7.1 How to Make a Request

Write to info@cleantrack360.com or call (302) 691-9473. We will acknowledge your request promptly and respond within 45 days. If we need more time, we will tell you why and may extend once by a further 45 days.

We will ask you to verify your identity before acting, in proportion to the sensitivity of what you are asking for. We do this to protect you: acting on an unverified request is how one person gets handed another person's data. An authorized agent may submit a request on your behalf with written permission, and we may still contact you to confirm it.

7.2 If We Say No

You may appeal any decision to decline a request by replying to our response, or by writing to us with “Privacy Appeal” in the subject line at info@cleantrack360.com. We will review the appeal and give you a written answer, with our reasoning, within 60 days. If we deny the appeal, we will tell you how to complain to your state attorney general.

7.3 Requests About Customer Data

If your information is in the Platform because a business you work with or buy from put it there, that business decides what happens to it. Send your request to them. If you send it to us, we will forward it and tell you we have done so, but we will not act on their data without their instruction.

8. Cookies and Analytics

This section is about our website and web app. Our mobile apps do not use cookies, do not load web analytics, and are not covered by anything below.

We use the following types of cookies and similar technologies:

• Essential: Required for the Platform to work at all, including sign-in, session security, and protection against forged requests. These cannot be turned off without breaking the service.
• Preferences: Remember your language, theme, and other settings.
• Analytics: We use Google Analytics to understand which pages and features are used and where people run into trouble.

We do not run advertising cookies, we do not use tracking pixels for ad networks, and we do not build advertising profiles.

8.1 Your Choice, and How to Change It

Analytics does not load until you allow it. On your first visit we ask, and until you answer, no analytics script is requested and no analytics cookie is set. Refusing takes exactly one click, the same as accepting. We record your answer in a cookie named ct_cookie_consent, which is how we remember not to ask again, and which expires after six months so the question comes back rather than standing forever.

You can change or withdraw your answer at any time using Cookie settings in the footer of any page. Withdrawing stops the analytics script from loading and deletes the analytics cookies already on your device. You can also opt out of Google Analytics across all sites using Google's browser add-on.

Essential cookies are not part of this choice, because they are what you asked for by using the Platform and it cannot function without them. Blocking them in your browser will prevent you from signing in.

9. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), encryption at rest, tenant isolation so one business cannot reach another's data, role-based access controls, rate limiting on authentication endpoints, and single-use tokens for invitations and password resets. However, no security system is impenetrable, and we cannot guarantee the absolute security of your data.

If a breach affects your personal information, we will notify you and any required authority within the time your law allows, and tell you what happened, what was affected, and what we are doing about it.

10. Children's Privacy

The Platform is not intended for individuals under the age of 18 and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. A parent or guardian who believes we hold information about their child may contact us at info@cleantrack360.com.

11. Where Your Data Is Processed

The Platform is operated from the United States and your information is stored and processed there. If you are outside the United States, using the Platform means your data crosses a border. Sections 12 and 13 explain the protections that travel with it.

12. Europe and the United Kingdom (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, this section applies to you and prevails over anything above that conflicts with it.

12.1 Why We Are Allowed to Process Your Data

The GDPR does not let anyone process personal data simply because it is useful. Each purpose needs a lawful basis, and ours are:

• Performance of a contract (Art. 6(1)(b)): Creating and running your account, delivering the Platform, taking payment, and supporting you. Without this data there is no service to give you.
• Legitimate interests (Art. 6(1)(f)): Keeping the Platform secure, preventing fraud and abuse, and understanding aggregate usage so we can improve it. We have weighed these against your rights and use the least data that achieves them. You may object at any time (see 12.3).
• Consent (Art. 6(1)(a)): Analytics cookies and marketing email. Given by an affirmative act, never assumed, and withdrawable at any moment without affecting what came before.
• Legal obligation (Art. 6(1)(c)): Keeping tax and accounting records, and responding to lawful requests.

Where a business uses the Platform to process data about its own staff or clients, that business is the controller and determines its own lawful basis. We are its processor under Art. 28 and act only on its documented instructions. We enter into a data processing agreement with any customer who requests one.

12.2 Sending Data to the United States

Our infrastructure is in the United States, so transfers out of the EEA and UK are unavoidable. We rely on the European Commission's Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies, and we have assessed the transfer for the risks specific to the destination. Our providers are bound by the same clauses. You may request a copy of the safeguards that apply to your data.

12.3 Your Rights

Alongside the rights in Section 7, you may: object to processing based on legitimate interests; ask us to restrict processing while a dispute is resolved; withdraw consent at any time; and receive your data in a structured, machine-readable format or have it sent directly to another provider where technically feasible. We answer within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.

You also have the right to complain to your national supervisory authority. We would rather you came to us first, but that right does not depend on our agreement.

12.4 Automated Decisions and Data Breaches

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Where a breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware of it, and notify affected individuals without undue delay where the risk is high.

12.5 Contact and Representative

Privacy questions and rights requests go to info@cleantrack360.com. We are not established in the European Union. Where Art. 27 requires us to designate a representative in the Union or the United Kingdom, we will appoint one and publish their details here.

13. Brasil (LGPD)

Se você está no Brasil, esta seção se aplica a você e prevalece sobre qualquer trecho acima que a contrarie. It is written in Portuguese because the LGPD requires information to be given clearly and accessibly to the people it protects.

13.1 Bases legais

Tratamos dados pessoais apenas com uma das bases legais do art. 7º da LGPD:

• Execução de contrato (art. 7º, V): criar e manter sua conta, entregar a Plataforma, cobrar a assinatura e prestar suporte.
• Legítimo interesse (art. 7º, IX): segurança da Plataforma, prevenção a fraude e abuso, e entendimento agregado de uso para melhorar o produto. Usamos o mínimo de dados necessário e você pode se opor.
• Consentimento (art. 7º, I): cookies de análise e comunicações de marketing. Livre, informado e inequívoco, e revogável a qualquer momento pelo rodapé do site, sem prejuízo do que já foi feito.
• Cumprimento de obrigação legal (art. 7º, II): guarda de registros fiscais e contábeis e resposta a requisições legítimas de autoridades.

Quando uma empresa usa a Plataforma para tratar dados de seus próprios funcionários ou clientes, ela é a controladora e nós somos operadores, agindo apenas conforme as instruções dela. Pedidos sobre esses dados devem ser dirigidos a ela.

13.2 Seus direitos (art. 18)

Você pode pedir: confirmação de que tratamos seus dados; acesso a eles; correção de dados incompletos ou desatualizados; anonimização, bloqueio ou eliminação de dados desnecessários ou tratados fora da lei; portabilidade a outro fornecedor; eliminação dos dados tratados com base em consentimento; informação sobre com quem compartilhamos; informação sobre a possibilidade de não consentir e o que isso acarreta; e revogação do consentimento.

Respondemos em até 15 dias. Você também pode peticionar diretamente à Autoridade Nacional de Proteção de Dados (ANPD).

13.3 Localização precisa

A localização precisa registrada no ponto eletrônico não se enquadra no rol de dado pessoal sensível do art. 5º, II, da LGPD, e não a classificamos como tal. Ainda assim, ela recebe proteção reforçada de nossa parte: é registrada apenas nos momentos de entrada e saída, apenas quando o empregador ativa a função, e é tratada somente para entregar essa função a ele. Não a usamos para publicidade, perfilamento ou qualquer finalidade própria.

13.4 Transferência internacional

Nossa infraestrutura fica nos Estados Unidos, portanto há transferência internacional de dados. Mantemos contrato escrito com cada fornecedor listado na Seção 5, com obrigações de segurança e confidencialidade e uso restrito às nossas instruções.

A ANPD aprovou cláusulas-padrão contratuais para transferência internacional na Resolução CD/ANPD nº 19/2024. Estamos adequando nossos contratos de fornecedor a esse instrumento e atualizaremos esta seção quando a adequação estiver concluída, indicando qual mecanismo do art. 33 fundamenta cada transferência. Até lá, preferimos descrever o que existe hoje a afirmar uma garantia que ainda não podemos comprovar documentalmente. Se quiser saber quais salvaguardas se aplicam aos seus dados, escreva para o encarregado.

13.5 Encarregado

Contato do encarregado pelo tratamento de dados pessoais: info@cleantrack360.com, ou por escrito no endereço da Seção 15.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email, in-platform notification, or by updating the “Last Updated” date at the top of this page. Your continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy.