Legal
Privacy Policy
Last updated:
Scope and responsibilities
This policy describes how the operator of M7Clean handles personal data in providing its business software. For account administration, security, billing and support, the operator determines the relevant purposes. For client, employee and job information entered by a cleaning business, that business generally determines why the information is used and M7Clean processes it to provide the service. If your information was entered by a cleaning business, contact that business first; we can help direct a request.
Information processed
Information may include names, emails, telephone numbers, company details, business and service addresses, employee and client records, jobs and appointments, checklists, before/after photos, work hours, booking requests and financial records. We also process support communications, IP addresses, technical and security logs, device/request information and billing metadata such as Stripe customer and subscription IDs, plan, currency and payment status. Payment card details are entered with Stripe; M7Clean’s subscription integration does not store full card numbers.
Purposes and lawful processing
We use information to provide the service, authenticate users, separate business accounts, schedule work, process subscriptions, send transactional messages, answer support requests, prevent abuse and investigate technical problems. Operational feedback and technical information may help improve reliability and usability. Where applicable, processing relies on contractual necessity, legitimate interests, consent or another lawful basis available under applicable law. The appropriate basis depends on the activity and the parties’ roles; a business uploading personal data must establish its own lawful basis.
Providers and disclosure
Service providers may process information needed for their functions: Stripe for payments, Resend for transactional email, Vercel for frontend hosting, Cloudflare for network protection and delivery, and hosting/storage providers for the API, data and backups. Providers may change as infrastructure evolves. Access should be limited to the service purpose. Information may also be disclosed when required by law or to address fraud, security incidents or legal claims. Stripe’s own terms and privacy policy apply to its processing.
International processing
Providers and authorised personnel may process data in countries other than your own. Where transfer rules apply, appropriate safeguards and arrangements must be used for the relevant transfer. Contact us for information about processing locations and applicable arrangements; this policy does not claim that all data stays within a single country or region.
Retention, photos and backups
Account and operational records are retained as needed to provide the service and address support, security, accounting and legal requirements. Photo availability is up to 60 days on Starter and 180 days on Pro. Expired photos are hidden; physical deletion is not currently automatic, so stored files may remain beyond that window. Cancellation does not automatically erase account data. Deletion requests are reviewed through support, including what must be retained and why. Backups and security logs follow separate retention cycles; removal from active systems may precede removal from backup copies. We do not promise immediate deletion from every copy.
Essential cookies
M7Clean uses session cookies to maintain sign-in, CSRF cookies to protect requests, and separate session/CSRF cookies for platform administration. These are strictly necessary for authentication and security. In production they are shared across M7Clean’s domain and relevant subdomains; session cookies are not readable by JavaScript, while CSRF cookies must be readable by the application. Blocking these cookies may prevent login or account actions. The current marketing site does not implement analytics or advertising cookies. External payment pages may use their own cookies under their providers’ policies.
Security and your choices
We use measures such as access controls, separation of business accounts and secure transport to protect information. No system can guarantee absolute security. Keep credentials safe and contact us about suspected incidents. Depending on applicable law, you may request access, correction, deletion, restriction, portability or export, object to certain processing, withdraw consent where processing relies on it, or complain to a competent supervisory authority. Requests may require identity and authority checks and may be limited by legal obligations or others’ rights. Export and deletion are currently support-assisted, not automatic self-service features.
Contact and updates
For privacy requests, contact the operator of M7Clean at the email below. Describe the request and the relevant business account without sending passwords or full payment card details. We will assess it under applicable requirements and explain any necessary limitations. This policy is effective and last updated on 21 September 2026; material changes will be communicated where appropriate.