Privacy Policy

Introduction

At TidyTrack ("we," "our," or "us"), operated by Slewsoft, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use our cleaning operations platform at tidytrack.com and app.tidytrack.com, and related services (the "Service").

Information we collect

Account and workspace information

Information you provide directly to us, including:

• Name, email address and contact information
• Company or organization name and workspace settings
• Account credentials (managed by our authentication provider, WorkOS)
• Payment and billing information (processed by Stripe; we do not store full card numbers)
• Support communications and feedback

Cleaning operations data

Content your workspace creates while using the Service:

• Sites, areas, checklists, schedules, clients and invoices you configure
• Cleaning logs, including the name a cleaner enters or selects when logging via a QR code, checklist items ticked, notes and timestamps
• If you enable a public "last cleaned" status page for an area, recent cleaning information for that area becomes publicly visible at its status URL until you disable it

Usage information

Information collected automatically when you use the Service:

• Device information and IP addresses (also used for rate limiting on public QR pages)
• Browser type and operating system
• Log files and system activity, including audit logs of actions taken in your workspace

How we use your information

• Providing and maintaining the Service
• Processing subscriptions and managing your account
• Communicating with you about your account and the Service
• Improving the platform and developing new features
• Ensuring security, preventing fraud and abuse of public QR endpoints
• Complying with legal obligations
• Sending product updates you have opted into (you can unsubscribe anytime)

Third-party processors

We do not sell, trade or rent your personal information. We rely on a small number of service providers to run the Service, each of which processes data only as needed to provide their function:

• Cloudflare — hosting, storage and content delivery. The Service runs on Cloudflare's global network (Workers, D1, KV, Pages).
• WorkOS — authentication and user/organization management for dashboard accounts.
• Stripe — subscription billing and payment processing.
• Email delivery providers — transactional email such as team invitations and receipts.

We may also disclose information:

• Legal compliance: when required by law or to protect our rights and safety
• Business transfers: in connection with a merger, acquisition or sale of assets
• Consent: when you have given us explicit permission

Data security

We implement security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Workspace-level data isolation — your data is only queryable within your organization
• Access controls and authentication on all non-public endpoints
• Revocable QR codes: any area's code can be rotated at once, immediately invalidating the old one

Your rights and choices

Depending on your location (including under GDPR and PIPEDA), you may have the following rights regarding your personal information:

• Access: request access to your personal information
• Correction: request correction of inaccurate information
• Deletion: request deletion of your personal information
• Portability: request a copy of your data in a portable format
• Restriction and objection: ask us to limit or stop certain processing
• Opt-out: unsubscribe from marketing communications at any time

To exercise any of these rights, email support@tidytrack.com. If you are a cleaner whose name appears in a workspace's cleaning logs, we may direct your request to the workspace owner, who controls that data.

Data retention

We retain workspace data for as long as your account is active. Report history visibility varies by plan, but underlying logs are retained so upgrading restores access. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where retention is required by law (for example, billing records).

International data transfers

We are a Canadian company, and the Service runs on Cloudflare's globally distributed network, which may process data in multiple jurisdictions. When data is transferred internationally, we ensure appropriate safeguards are in place in accordance with applicable privacy laws.

Children's privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

Contact us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: