Privacy Policy

Last updated: 12 June 2026

This policy explains how Mop (“we”, “us”) handles personal data under the UK GDPR and the Data Protection Act 2018. It covers two situations, because we play two different roles:

  • Site owners (our customers). When a cleaning business signs up, we are the controller of the account data.
  • Visitors to tenant sites. When someone requests a quote on a site built with Mop, the cleaning business is the controller of that enquiry and we are their processor — see our Data Processing Terms. Privacy questions about an enquiry you made to a cleaning business should go to that business first.

1. What we collect

  • Account data (site owners): business name, email address, a securely hashed password (we never store the password itself), and the content you add to your site.
  • Lead data (on behalf of site owners): the name and contact details a visitor chooses to submit with a quote request, plus the service, property size and message they provide.
  • Technical data: server logs (IP address, user agent, timestamps) kept by our hosting provider for security and abuse prevention. We do not run analytics or advertising trackers.

2. Why we process it (lawful bases)

  • Contract: providing the Service to site owners (Art. 6(1)(b)).
  • Legitimate interests: securing the platform, preventing abuse, and improving the Service (Art. 6(1)(f)).
  • Legal obligation: where we must retain or disclose data by law (Art. 6(1)(c)).
  • Processor instructions: lead data is processed solely on the site owner’s documented instructions.

3. Where your data lives

The Service is hosted on Vercel with data stored in Upstash Redis. Both providers may process data in the United States and other countries under appropriate safeguards (including the UK Extension to the EU–US Data Privacy Framework and/or International Data Transfer Agreements). Our current sub-processors are listed in the Data Processing Terms.

4. How long we keep it

  • Account data: for the life of the account, then deleted within 30 days of account deletion.
  • Lead data: retained for the site owner; the platform stores up to 500 recent leads per site. Deleted with the account.
  • Server logs: retained by our hosting provider for a short rolling window.

5. Your rights

You have the right to access, rectify, erase, restrict, object to and port your personal data, and to withdraw consent where processing is based on consent. To exercise these rights email hello@usemop.com. We respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

6. Cookies

We use a single strictly necessary session cookie for site-owner login, and no tracking cookies. Details in our Cookie Policy.

7. Children

The Service is for businesses and not directed at children under 18.

8. Changes

We will post any changes here and, for material changes affecting site owners, notify you by email or in the dashboard.

9. Contact

Data protection contact: hello@usemop.com.