Privacy Policy

1. Data Controller

The data controller for the CleanBag platform is:

• Company: Antonis D. Demetriou Enterprises Ltd
• Registration No.: HE364859
• Address: Sapfous 7 Street, Aglantzia 1070, Nicosia, Cyprus
• Email: support@cleanbag.io
• Data Protection Contact: Antonis D. Demetriou

2. What Data We Collect

We collect the following personal data when you use CleanBag:

Data you provide directly

• Account information: Full name, email address, password
• Profile information: Phone number, city, vehicle type (Drivers), business name and address (Cleaning Facilities), company name (Companies)
• Payment information: Payment card details are collected and processed by Stripe. We do not store your card details on our servers.

Data collected automatically

• Usage data: Pages visited, features used, and interactions with the platform (via Vercel Analytics)
• Device information: Browser type, operating system, and screen size
• Location data: Cleaning facility addresses are geocoded (converted to map coordinates) using Google Maps to display facility locations on maps

Data generated through use

• Order history: Cleaning orders, dates, amounts, and status
• Compliance data: Last cleaning date, compliance status, cleaning frequency
• Ratings: Star ratings given to Cleaning Facilities
• Notifications: In-app and push notification preferences and history

3. How We Use Your Data

We process your personal data for the following purposes:

4. Data Sharing and Third-Party Processors

We do not sell your personal data. We share data only with the following service providers who process data on our behalf:

These providers are based in the United States and comply with applicable data protection standards, including EU Standard Contractual Clauses (SCCs) for international data transfers.

Data visible to other users: Cleaning Facility names, addresses, cities, and ratings are visible to Drivers. Driver names and compliance status are visible to their associated Company. Order details are shared between the Driver and the Cleaning Facility involved in the transaction.

5. Data Retention

We retain your personal data for as long as your account is active and as needed to provide our services. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain certain data for legal or regulatory purposes (such as transaction records for tax compliance).

Order and transaction records may be retained for up to 6 years after account deletion to comply with Cyprus tax regulations.

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Withdraw consent for push notifications at any time through your browser or device settings

To exercise any of these rights, please contact us at support@cleanbag.io. We will respond within 30 days.

7. Cookies and Tracking

CleanBag uses only essential cookies required for the platform to function:

• Authentication cookies: To keep you logged in to your account (managed by Supabase Auth)

We use Vercel Analytics for privacy-friendly usage analytics. Vercel Analytics does not use cookies and does not track individual users across sites.

We do not use advertising cookies, social media trackers, or any third-party marketing tools.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (HTTPS/TLS) for all data transfers
• Encryption at rest for database storage
• Row-level security (RLS) policies ensuring users can only access their own data
• Secure password hashing (managed by Supabase Auth)
• Payment data handled exclusively by PCI DSS-compliant Stripe

9. Children's Privacy

CleanBag is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

10. International Data Transfers

Your data may be transferred to and processed in the United States by our service providers (Supabase, Stripe, Vercel, Google). These transfers are protected by EU Standard Contractual Clauses (SCCs) and other appropriate safeguards in accordance with GDPR Article 46.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Supervisory Authority

If you believe that we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the:

• Commissioner for the Protection of Personal Data
• Address: 1 Iasonos Street, 1082, Nicosia, Cyprus
• Website: www.dataprotection.gov.cy

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: support@cleanbag.io
• Data Protection Contact: Antonis D. Demetriou
• Company: Antonis D. Demetriou Enterprises Ltd (HE364859)
• Address: Sapfous 7 Street, Aglantzia 1070, Nicosia, Cyprus