Privacy Policy

Sweptt ("we", "us", or "our") operates the Sweptt platform — a cleaning management tool for short-term rental hosts. This Privacy Policy explains what data we collect, why we collect it, and how we protect it. By using Sweptt you agree to the practices described below.

If you have any questions, contact us at hello@sweptt.com.

1. Information We Collect

Account information

When you register, we collect your name, email address, and password (stored as a secure hash). If you are invited as a cleaner, we collect your name and email.

Property and reservation data

You may enter property addresses, iCal feed URLs, reservation dates, and guest information. This data is stored and used solely to power the Sweptt service for your organisation.

Cleaning task data

We store task details, status updates, checklist completions, and photos uploaded by cleaners as proof of completion. Photos are stored securely and accessible only to members of your organisation.

Usage and log data

We automatically collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This helps us diagnose issues and improve the service.

Payment information

Payments are processed by Stripe. We do not store your card details — Stripe handles all payment data under their own Privacy Policy. We store your Stripe customer ID and subscription status.

2. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

• Contract — processing necessary to provide the Sweptt service you have signed up for (account creation, cleaning task management, billing)
• Legitimate interests — server logs, security monitoring, and fraud prevention
• Consent — analytics and advertising cookies on the landing page (Google Analytics, Meta Pixel). You can withdraw consent at any time by clicking "Necessary only" on the cookie banner or clearing your browser's localStorage.

3. How We Use Your Data

• To provide and operate the Sweptt platform
• To send transactional emails (account verification, password reset, task notifications)
• To process payments and manage your subscription
• To detect and prevent fraud or misuse
• To measure and improve the product (only with your consent for analytics)

We do not sell your data to third parties.

4. Data Sharing and Sub-processors

We share your data only with the following sub-processors required to operate the service:

• Railway (USA) — cloud infrastructure and PostgreSQL database hosting
• Vercel (USA) — frontend hosting and edge delivery
• Stripe (USA) — payment processing. Stripe handles all card data under their own Privacy Policy. We store only your Stripe customer ID and subscription status.
• Resend (USA) — transactional email delivery (verification emails, password resets, notifications)
• Cloudinary (USA) — cloud storage for cleaning proof photos uploaded by cleaners
• Google (USA) — optional Google Sign-In (OAuth). If you sign in with Google, we receive your email address and name from Google. Google's use of this data is governed by their Privacy Policy.

All sub-processors are contractually bound to protect your data and may not use it for their own purposes.

5. International Data Transfers

Sweptt is operated from the Czech Republic (EU). Several of our sub-processors are based in the United States. Where we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place — typically the EU Standard Contractual Clauses (SCCs) — in accordance with GDPR Chapter V.

6. Cookies

Strictly necessary (always on):

• refresh_token — an httpOnly cookie used to keep you signed in securely. Never accessible to JavaScript. Set only in the app, not on the landing page.
• cookie_consent — localStorage key recording your cookie preference. Not a tracking cookie.

Analytics and advertising (only with your consent):

• Google Analytics (G-VCJQNVNH85) — measures traffic and page usage on our landing page.
• Meta Pixel (Facebook) — measures ad campaign performance and conversion events on our landing page.

These cookies are only loaded after you click "Accept all" on the cookie banner. You can change your preference at any time by clearing cookie_consent from your browser's localStorage and reloading the page.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance (e.g. billing records for up to 7 years under Czech accounting law). Cleaning proof photos are retained until you or a cleaner deletes them, or until your account is deleted.

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data. You can also do this yourself via Settings → Account → Delete account.
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for analytics cookies, at any time by updating your cookie preference
• Lodge a complaint — you have the right to lodge a complaint with your national data protection authority. In the Czech Republic, this is the Office for Personal Data Protection (ÚOOÚ).

To exercise any of these rights, email us at hello@sweptt.com. We will respond within 30 days.

9. Data Security

We take reasonable technical and organisational measures to protect your data including HTTPS encryption in transit, hashed passwords, httpOnly secure cookies, and row-level data isolation between organisations. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

Sweptt is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you by email.

12. Data Controller and Contact

The data controller responsible for your personal data is:
Sweptt
Czech Republic
hello@sweptt.com