Privacy Policy

BlastoClean ("we", "us") provides quoting, scheduling and payment software for cleaning companies. This policy explains what we collect on this website and in the BlastoClean application, and what we do with it.

What we collect

On this website. If you use the contact form, we collect the name, email address, company name and message you send us, and we keep a technical fingerprint of the request (such as a hashed network address) to prevent abuse. This site does not use advertising trackers.

Trial signup emails. When you start a free trial, we may send you up to four helpful emails over your trial period — tips for building quotes, scheduling work and getting paid, each with a link to book a live demo if you would like one. They stop automatically when you subscribe, when your trial ends, or when you unsubscribe using the link in any message. To run the series we store your email address, name and company name in this site's database until the sequence finishes; finished rows lose those details after 90 days, and deleting your app account clears them immediately. We send them from the same noreply@mail.blastoclean.com address as other messages from this site.

Scheduling a demo. The /demo page embeds Calendly to let you pick a time for a live walkthrough. Calendly runs on its own domain inside that embed and may set its own cookies or collect the details you enter to book the meeting. When you complete a booking, Calendly notifies the organizer and we receive the invitee details needed to hold the meeting — name, email and the time you chose — through that scheduled event and its notifications, not only when you join the call. See Calendly's privacy notice for what they collect on their side.

The live demo. The /try page lets you walk straight into a shared, furnished sample company without creating an account. To open it we collect the name, work email address and company name you type into the form, and store them in the demo's own separate database together with a hashed form of your network address and a random identifier we set as a cookie on your browser (cqb_demo_device, 90 days). The hashes and that cookie exist for one purpose: recognizing that one person is coming back, so the demo's AI allowance and its limits apply per person rather than per visit. They are not derived from anything about you or your device, are never used for advertising, and are not shared. The name and company name are kept so a demo visit is a record with somebody in it rather than an anonymous hash — which is what we need if something in the demo has to be looked into — and the address is the identity the AI allowance itself hangs on. Opening the demo does not create an account and does not sign you up for anything, and the demo itself sends no email or text messages at all. All three fields are cleared automatically once you have not entered the demo for 90 days, leaving only the counters and hashes the entry checks read.

We also keep those details as a business record. Somebody who opens the demo is someone who has looked at the product, so the name, work email address and company name above are visible to our own staff in an internal console — who has tried it, from what sort of company, and how much they used it. Being able to see your details is not permission to write to you: if you did not tick the box described below, we do not email you about the demo at all, and that includes a personal note from one of us, not only a campaign. Beyond that: we do not sell them, we do not share them with anybody else, we do not use them for advertising or profiling, and they are deleted on the same 90-day clock as everything else on the demo record.

Demo emails, only if you ask for them. The /try form carries a tick box, unticked, that says "send me a few tips on getting started". If you leave it alone we do not email you at all. If you tick it, we send three short emails over about nine days about what BlastoClean looks like with your own customers in it, and then we stop — the last one says so. They stop earlier if you create an account or unsubscribe, and every message carries an unsubscribe link and our postal address. The link takes you to a page with a single button that confirms it — one deliberate extra click, so that the scanners some mail systems run over incoming links cannot unsubscribe you without your knowing. To run the series we store your email address, name and company name in this site's database, along with the date you ticked the box, which is our record of your consent; finished rows lose those details after 90 days. Ticking the box is the only thing that ever puts a demo visitor on an email list, and it applies from the moment you tick it: nobody who opened the demo before this box existed is enrolled, because they were told we would not write to them.

Inside the demo, nothing is private. It is one sample company that every visitor shares at the same time, so anything you type into it can be seen, changed and deleted by other visitors. It is rebuilt from a fixed sample every week and everything added since the last rebuild goes with it. Please do not put real customer records or anyone's personal information into it: the demo refuses to store contact details outside the reserved documentation ranges and sends no email or text messages at all, but those are safeguards, not an invitation. The demo runs on a database of its own, separate from every customer account.

Usage statistics. This site keeps aggregate, cookieless statistics about its own use: which page paths were viewed, which sites referred visitors here, daily totals of each, and how many contact forms and trial signups each of our own advertising campaigns produced. They are plain counters — no cookies, no device identifiers, nothing that could single out a visitor — and they are never shared. The campaign counters name only campaigns we run and have registered in advance; a utm_ tag on a link we did not create is counted, but never stored, so a personalised link cannot leave a record of the person who followed it. When you send the contact form or start a trial, we also record which page and referring site brought you to us, so we know which pages actually help people find the product.

Referral and partner links. If you arrive through a referral link (/r/…) or a partner link (/p/…), we set two cookies on this site: a random identifier for your browser, and the referral or partner code you arrived through. They exist for one purpose — making sure the person who referred you gets credited if you sign up, even if that happens days later. The identifier is random and is not derived from anything about you or your device, and neither cookie is used for advertising or shared with advertisers. They last 90 days and are removed when you clear your browser's cookies. A visit through a partner link also sends that identifier, the partner's code, the page you landed on, the site you came from, your network address and your browser's user-agent string to the BlastoClean application, so the partner can see how their link is performing; that record is kept for as long as the partner relationship needs to be auditable. It is a record of the visit, not a second copy of the credit: if you clear these cookies before signing up, the signup is simply not credited to anyone. Arriving through an ordinary link sets neither cookie.

Where a visit came from. If the first page you open carries campaign tags (utm_source, utm_medium, utm_campaign, utm_term or utm_content), or you arrived from another site, we store that first visit in a first-party cookie named bc_src for 90 days: those tags, the page you landed on, and the address of the site that linked here. A later visit does not replace it. On blastoclean.com and its subdomains (including www and the app), that cookie is shared across the whole site so a first touch on one host is still there when you sign up on another. The cookie is not used for advertising and is not shared with advertisers. The signup form, the live demo and a booked walkthrough receive it so the account can record where you came from. If you choose to answer the optional “How did you hear about us?” question on signup, that answer is stored on the account you create. It is removed when the 90 days end or when you clear your cookies (the hear-about answer stays on the account until the account is deleted).

Partner applications. If you apply to the partner program at /partners, we collect what the form asks for: your name, business name if you give one, email address, phone number, mailing address, the PayPal address commissions should be sent to, your website or social links if you give them, how you plan to promote BlastoClean, the link you would like, and a password for the partner portal — which is stored hashed and is never readable by us. Your application is kept as written, because it is the record of what you applied with, and alongside it we keep hashed forms of your network address and browser user-agent string and the exact consents you gave, as evidence of what was agreed to and when. The mailing address and the PayPal address exist to pay you and to meet US tax-reporting obligations. If your application is declined, or your partnership ends, we keep the application and the commission records for as long as the money involved has to stay auditable.

In the application. When you create a company account we store the information you enter to run your business: your team's names and email addresses, your customers and their properties, your room and task libraries, quotes, schedules and payment records.

What we do with it

We use your information to provide the service — and for nothing else. We do not sell personal information, we do not rent lists, and we do not use your customers' details for our own marketing.

Contact form messages are used solely to reply to you.

Text messages

Phone numbers opted in to text messages — recorded by the office, chosen by the customer online, or given by text reply — are used to send the messages that number agreed to. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, or HELP for help. We do not share or sell mobile numbers or opt-in data to third parties for marketing.

Payments

Card payments are processed by your company's own payment provider (such as Stripe). Card numbers never touch our systems: customers enter them directly with the provider through its hosted checkout. We store only the references the provider gives us and an encrypted copy of the credentials your company connects.

Service providers

We use service providers to run BlastoClean. They process data on our instructions and only for the purposes below. This section names the providers that matter most for the application; the website's contact form, trial emails and demo booking use the same Cloudflare and AWS infrastructure described under "Where your data lives", and Calendly when you book a walkthrough.

Hosting, storage and security

• Cloudflare, Inc. — serves the website and application, stores uploaded files in R2, sends email from our domains (Email Service), verifies forms (Turnstile), and pools database connections (Hyperdrive).
• Amazon Web Services, Inc. — hosts the primary MySQL database (Amazon Aurora).

Payments

• Stripe, Inc. — bills your BlastoClean subscription and, when you connect it, processes your company's customer card payments through Stripe Connect. Card numbers are entered on Stripe's hosted pages, not on our servers.

AI assists

When AI features are enabled for your company, the text, photos or audio you submit to them is processed as follows:

• Anthropic, PBC — Quick Quote (typed job descriptions and room verification), Magic Quote photo analysis, the in-app help assistant, and other drafting and classification assists (such as website-lead quote drafts, inbound message triage, tuning suggestions, weekly digests and follow-up copy). We send this content to Anthropic to generate a response; we do not send it for model training.
• Cloudflare, Inc. (Workers AI) — transcribes Magic Quote voice notes using a speech-to-text model run on Cloudflare's Workers AI platform (an OpenAI Whisper variant operated by Cloudflare, not a separate call to OpenAI's API).

Where your data lives

The service runs on Cloudflare's global platform. Data is stored in a MySQL database hosted on Amazon Aurora (AWS) and in Cloudflare's R2 storage, protected in transit by TLS.

Records created before we moved to that database remain in the Cloudflare D1 database we used previously, under this same policy, until it is decommissioned.

How long we keep it

For as long as your account is in use, and then for a while afterwards, so that leaving by accident costs you nothing.

If you leave — you cancel, or your trial ends and you never subscribe — we keep your account for six months after your access actually ends. Anything with a shorter clock of its own keeps it: walkthrough recordings still expire on the retention window your company chose, and are not held back by this. Canceling takes effect at the end of the period you have already paid for, so the six months start from that day, not from the day you cancel. Moving to the Free plan instead is not leaving: those accounts are covered by the paragraph below however long they pay nothing.

Coming back inside those six months picks up exactly where you left off. After them the account becomes eligible for deletion, and a person at BlastoClean reviews it before anything is deleted. Unlike the inactivity case below, no further notice is sent — the timetable is the one described here — so if you want your records, export them before you go, or ask us for a copy while we still have them. Once the deletion has run there is nothing left to send.

If you are on the Free plan, there is no deadline while the account is in use. If nobody signs in for a year, we email the account owner and pause the account: it is locked, but nothing is deleted, and signing in at any point brings it all back immediately. If nobody signs in during the three months after that email, the account becomes eligible for deletion, again with a person reviewing it first.

When an account is deleted it is deleted in full — every record, every uploaded file, and the email addresses of its users, which become free to sign up with again. Deletions are not retroactive to backups: an account can persist in an encrypted database backup until that backup rotates on its own schedule.

Everything else we hold keeps its own clock, and none of it is tied to your account: contact-form messages are kept so that we can answer you and so that we have a record of who has asked us about the product — we do not delete them on a schedule, and you can ask us to delete yours whenever you like; a partner application and its commission ledger are kept for as long as the payments they describe have to stay auditable, which is longer than the partnership itself; trial-drip and demo-drip enrollment rows on this site hold a copy of your email, name and company only while the email series is running, lose those fields 90 days after the series ends, and are cleared immediately when your app account is deleted; a live-demo visitor record loses the name, address and company name it was opened with — and the record of any tick-box consent given with them — 90 days after that person last entered the demo, and what remains of it is counters and hashes with nobody in them; the cookieless usage counters are aggregates with nobody in them and are kept indefinitely as totals; and the photos, video and voice notes from a Magic Quote walkthrough are deleted on the retention window your company chooses in Settings — 30 days, 90, a year, or kept — after which the timeline, the transcripts and the quote they produced remain.

You can ask us to delete your account sooner than any of this, at any time — see Delete your account for self-service steps and what we remove.

Your rights and your exit

Your company's data belongs to your company. An owner can export the whole account — settings, team, customers, properties, templates, quotes and audit records — as a portable file at any time, and can delete the account from Settings → Delete account in the web or mobile app. Full instructions, retention exceptions and timelines are on Delete your account. You can also ask us to delete the account by contacting hello@blastoclean.com from the email on the account. The export stays available on a paused account too — being locked for inactivity never holds your own records hostage.

Changes

If this policy changes, the date above changes with it, and material changes will be announced in the application.

Questions? Email hello@blastoclean.com.