Privacy policy

1. Who we are and when this policy applies

HOSTAL PTY LTD (ABN 58 693 993 501), trading as CleaningCentral operates CleaningCentral. This policy applies to cleaningcentral.net, CleaningCentral accounts, customer workspaces, support, product trials, billing and communications that we send for our own business. Contact us at contact@cleaningcentral.net.

CleaningCentral launches self-service in Australia, the United States, the United Kingdom and supported Eurozone countries. We also apply this policy to people in New Zealand and other supported locations who visit our site, contact us or use a rollout made available to them.

2. Our role and your cleaning company’s role

For account administration, billing, product security, support, our website and our own marketing, CleaningCentral decides why and how personal information is handled and acts as the controller or business responsible for it.

For information a customer places in its workspace about its clients, prospects, employees, contractors and suppliers, the customer normally decides the purpose and use. CleaningCentral processes that customer content to provide the service and normally acts as a processor or service provider. Individuals should direct workspace-specific requests to the relevant cleaning company first. Our Data Processing Addendum explains these roles in more detail.

3. Information we collect

• Account and identity information, including name, business name, email address, sign-in and verification records.
• Subscription and transaction information, including selected plan, billing status, currency, tax location, invoices and provider references. We do not store complete payment card numbers.
• Workspace content supplied by customers, which may include client and prospect details, properties, services, quotes, bookings, messages, invoices, staff records, timesheets, job photos and documents.
• Connection information for services a customer chooses to connect, including provider identifiers, permissions, connection status and encrypted credentials or tokens where required.
• Support and communications, including enquiries, support requests, feedback and records of notices sent.
• Device, security and usage information, including IP address, browser, session, authentication events, audit activity, error diagnostics and feature use.
• Marketing permission and delivery information, including consent source, subscription topics, suppression, unsubscribe, bounce and complaint status.

4. How we collect information

We collect information directly from people who create an account, complete a form, configure a workspace, contact support or use the service. Customers and authorised users may provide information about other people. Connected services may return information at the customer’s direction. We also collect limited technical and security information automatically when the service is used.

Customers must have the authority and any required notices, consent or other lawful basis before adding another person’s information to CleaningCentral.

5. Why we use information

• Provide, configure, secure and support the service.
• Verify accounts, prevent abuse, investigate incidents and maintain audit records.
• Process authorised subscriptions, usage charges, credits, refunds and taxes.
• Operate customer-requested connections and workflows.
• Send transactional notices about accounts, security, billing, jobs or support.
• Improve reliability, accessibility and product design using proportionate usage and diagnostic information.
• Comply with law, enforce our agreements and protect customers, users and the public.
• Send our own marketing only where permitted, with an available unsubscribe or opt-out.

6. Legal bases in the UK and EEA

Where UK GDPR or EU GDPR applies, we rely on performance of a contract, steps requested before a contract, compliance with legal obligations, legitimate interests that are not overridden by individual rights, and consent where consent is required. Legitimate interests include securing the platform, preventing fraud, supporting customers, improving the service and communicating with business contacts in a proportionate way. Consent can be withdrawn without affecting earlier lawful processing.

7. Sensitive, workforce and funded-service information

Some customers may configure workforce, payroll, insurance or Australian NDIS-related workflows. These records can contain sensitive, financial, tax or employment information. Customers choose whether to use those modules and are responsible for collecting only what is necessary and lawful. CleaningCentral applies restricted access, workspace separation and additional safeguards to supported sensitive fields.

Do not place medical details, identity documents, tax file numbers, bank details or other highly sensitive information into free-text fields unless a specifically protected field and workflow is provided for that purpose.

8. Sharing and subprocessors

We share information only as needed to provide, secure and support CleaningCentral, complete an authorised connection, comply with law, or manage a corporate transaction subject to appropriate safeguards. Categories include infrastructure and hosting, email and SMS delivery, payment processing, monitoring and security, customer support, mapping, accounting and customer-enabled business connections.

Our Subprocessor Notice identifies the main providers and explains when customer-selected providers apply. We do not sell personal information for money. We do not use customer workspace content for unrelated advertising.

9. International transfers

CleaningCentral is operated by an Australian company and uses service providers that may process information in more than one country. The actual provider and processing location can depend on the workspace, selected connection and delivery destination.

Where Australian law applies, we take reasonable steps required by the Australian Privacy Principles for overseas disclosures. For New Zealand information, we apply the safeguards required by Privacy Principle 12. For UK or EEA restricted transfers, we use an adequacy decision or approved contractual safeguards, such as the EU Standard Contractual Clauses and the applicable UK transfer mechanism, where required. Additional technical and organisational safeguards are applied according to risk.

10. Retention and deletion

We keep personal information only for as long as needed for the purposes described above, the customer’s contract, security, dispute resolution and legal or accounting obligations. Retention differs by record type. Account, billing, consent, audit and security records may remain after workspace deletion where law or legitimate protection of the service requires it.

For a new unconverted trial, operational access ends at the 14-day deadline and the workspace enters a 30-day recovery period. For trials accepted on or after 2 November 2026, the workspace is frozen rather than locked during those 30 days: the owner can sign in, view and export the workspace records, while creating, sending and taking payments stay paused. Trials accepted before then keep the locked recovery period they accepted. Unless the customer subscribes or a legal hold applies, deletion begins on day 45 after activation. The account shows the exact access and deletion dates. A customer should export required records before deletion. Backup copies age out under protected backup schedules and are not restored for ordinary use after deletion.

11. Security and incidents

We use controls designed for the nature of the service, including workspace separation, role-based access, encryption for supported sensitive values, audit records, provider credential protection, backups and release checks. No online service can promise absolute security. Customers must protect credentials, assign appropriate permissions and tell us promptly about suspected unauthorised access.

Where a breach requires notification, we will notify affected customers, individuals or regulators as required by applicable law.

12. Automated processing and AI

CleaningCentral may use automated rules to detect security risk, prevent duplicate or unsafe actions, enforce permissions and show workflow recommendations. We do not currently use a solely automated process to make a legal or similarly significant decision about an individual. AI products are not part of the initial launch catalogue. If this changes, we will update the relevant notice before using personal information for that purpose.

13. Your rights

Rights depend on where a person lives and the law that applies. They may include access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaint rights. Australian individuals may request access or correction under the Privacy Act 1988 and Australian Privacy Principles. New Zealand individuals may exercise rights under the Privacy Act 2020. UK and EEA individuals may exercise applicable UK GDPR or EU GDPR rights. Residents of California and other US states may have rights to know, access, correct, delete, obtain a copy, opt out of certain uses and receive equal service, subject to scope and exceptions.

Send a request to contact@cleaningcentral.net. We may need to verify identity and authority. If the request concerns content controlled by a CleaningCentral customer, we may refer it to that customer or assist the customer in responding. We will not discriminate against a person for exercising a legal privacy right.

14. Marketing choices

Our marketing messages identify the sender and provide the opt-out required for the destination. Australian messages follow the Spam Act 2003; New Zealand messages follow the Unsolicited Electronic Messages Act 2007; US commercial email follows CAN-SPAM; UK and EEA communications follow applicable direct-marketing and electronic-communications rules. Transactional, security and service notices may still be sent where necessary to operate an account.

Customers using CleaningCentral marketing tools remain responsible for their own recipient permissions, notices, sender identity, physical address where required, suppression lists and lawful content.

15. Children

CleaningCentral is a business service and is not directed to children. Account owners must be at least 18 and authorised to act for the customer. Customers must not use the service to collect children’s information unless the activity is lawful, necessary and covered by appropriate notices and protections.

16. Complaints, regulators and contact

Contact contact@cleaningcentral.net with “Privacy” in the subject. Please describe the issue and the outcome sought. We will investigate and respond within the period required by applicable law.

You may also complain to the regulator that applies to you, including the Office of the Australian Information Commissioner, the New Zealand Office of the Privacy Commissioner, the UK Information Commissioner’s Office, an EEA supervisory authority, the California Privacy Protection Agency or another competent US state regulator. Contacting us first may allow the issue to be resolved more quickly, but does not remove a legal right to contact a regulator.

17. Changes to this policy

We may update this policy when the service, providers, regions or law changes. The current effective date appears at the top. If a change materially affects how we handle information already collected, we will provide additional notice where required.