Last updated: [to supply].
This policy explains how Blumint Digital Limited uses personal data when we decide why and how it is used. It covers people who sign up for and use harulu, people who visit our website or contact us, our referral partners, and people who receive our marketing. It also explains, in the next two sections, what happens to your data if you are a customer of a business that uses harulu, or if you work for one.
If you are a customer of a cleaning business
If a cleaning business uses harulu to look after your account, book your visits, take your payments, or run its website or customer portal, that business is responsible for your data (it is the "controller"). We only store and process your data for the business, on its instructions (we are its "processor").
The business's own privacy notice explains how it uses your data. You can find it on the business's website and in its customer portal. For questions, or to use your rights, contact the business first. If you contact us, we will pass your request to the business.
A few things are the same for every business that uses harulu:
- Your data is kept apart from every other business's data. Another business cannot see it.
- Photos taken at your property have location details removed on the cleaner's phone before upload. A business can only show photos of your property on its website if you have agreed to that, and you can withdraw that agreement at any time in the portal or by contacting the business.
- Gate and door codes are stored encrypted and shown only to the owner or manager, or to the cleaner assigned to a visit at your property around the visit date.
- Marketing from the business needs your agreement or, in some cases, can be sent because you are already a customer. Every marketing email has an unsubscribe link, and you can reply STOP to any text from the business.
- If the business moves your account to another business (for example when it sells its round), you will be told which business now looks after you. Your agreement to marketing and to website photos does not move with you; the new business must ask again.
- The portal's sign-in page may show an offer from the business itself. It never shows other companies' adverts and does not track you.
If you work for a business that uses harulu
Your employer, or the business you work with, is the controller for the data the service holds about your work: your profile, rounds, visits, clock times, timesheets, mileage, pay and ratings. We process it for them. Please ask them first about how it is used.
- No location tracking. The apps do not track where your phone is. Mileage is worked out from the route between completed visits and any trips you add.
- Your profile photo is resized on your phone or computer before upload, which removes location and camera details. Only people in the same business see it.
- Your mobile number is shown to your teammates so they can call or text you, unless you turn off "Share my mobile with the team". Owners and managers always see it.
- Start places (your usual one and any for a particular day) can be a home address. Only you, owners and managers see them. They are used to plan routes and work out mileage.
- Notifications to your phone never show customers' addresses, names or notes on the lock screen.
1. Who we are
Blumint Digital Limited, a company registered in England and Wales with number [to supply]. Registered office: [to supply].
- Email: hello@harulu.com
- ICO registration number: [to supply]
We have not appointed a data protection officer because the law does not require us to. [CONFIRM with the solicitor.] Contact us by email for anything about this policy.
2. What we collect and why
| Who you are | What we collect | Why | Lawful basis |
|---|---|---|---|
| Owner, manager or cleaner with a login | First and last name, email, phone, password (stored hashed by our sign-in provider), two-factor settings, trusted devices, role, business | To create and run your account and keep it secure | Contract with the business you work for, and our legitimate interest in providing a secure service |
| Person signing up a business | Name, email, business name, team size, and, if you choose to tell us, how you heard about us | To set up the trial and the right plan, and to learn which ways of finding us work | Contract; legitimate interests (how you heard about us, which is optional) |
| Business owner (billing) | Business name and address, plan, billing contact, payment history, account credits, VAT number if given. Card or bank details are held by our payment provider, Stripe, not by us | To take subscription and text top-up payments, apply credits and keep tax records | Contract; legal obligation (tax records) |
| Business that refers or is referred by another business or a partner | Which business or partner referred you, the referral's status and any credit or reward. To stop abuse we compare the two businesses' owners, card or bank fingerprints, email addresses and domains, phone numbers and addresses, and keep the reason if we refuse a reward | To run the referral offer and prevent fraud | Contract; legitimate interests (preventing fraud) |
| Any user | Support messages, feature suggestions and any screenshots you send | To help you and improve the service | Legitimate interests |
| Any user | Sign-in records, rate-limit records, error reports, audit records of sensitive actions | To keep the service secure, prevent fraud and fix faults | Legitimate interests |
| Visitor to our website | Messages through our enquiry or demo booking forms: name, business, email, phone, message | To reply and arrange a demo | Legitimate interests (replying to your enquiry) |
| Visitor to the web admin's sign-in page | Nothing about you. The sign-in page may show one advert, labelled "Advert", stored and shown by us with no advertiser code or trackers. If you click it, the advertiser's site sees that the visit came from our sign-in page, not who you are | To fund the service | Not applicable (no personal data) |
| Anyone making a data protection complaint | Name, email, which business it concerns (optional) and what happened | To look into the complaint, reply and keep a record | Legal obligation (the duty to handle data protection complaints); legitimate interests |
| Business contact receiving our marketing | Name, email, business, and your marketing choices | To send news and offers about harulu | Consent where the law needs it (for example sole traders and partnerships), otherwise legitimate interests. You can unsubscribe at any time |
| Referral partner | Name, contact details, bank details (given to us directly, not stored in harulu), referrals and payments | To run the partner scheme and pay you | Contract; legal obligation (accounting records) |
| People in businesses' data (pooled insights) | We do not collect anything new. We combine records from many businesses into statistics such as typical visit times and prices by area. The results do not identify any business or person | To improve the service and offer features such as realistic day plans and suggested prices | Legitimate interests. [CONFIRM: legitimate interests assessment completed, D-043.] |
Pooled insights. We keep the working data for up to 24 months. We only keep a figure if at least 10 businesses contribute to it. The working data can only be read by our servers, never by businesses or through the apps. A business can opt out of contributing at any time in its settings. If you are a customer or staff member of a business and want to object, contact us or the business.
No AI training. We do not use AI language models in harulu and do not use anyone's data to train AI.
We do not sell personal data, and we do not use it for advertising.
3. Who we share it with
- Our suppliers who host and run the service for us. A list of them, with where they process data, is available on request from hello@harulu.com.
- Stripe, which takes subscription and top-up payments on our behalf.
- Our professional advisers (accountants, lawyers, insurers) when needed.
- Authorities such as HMRC, the police or the ICO, when the law requires it.
- A buyer of our business, if that happens, who would have to use your data in line with this policy.
- The business or partner who referred you, which sees your business name and whether the referral qualified. A business you referred sees your business name in the same way. Partners are shown to businesses only as "a partner".
4. Transfers outside the UK
We store data in the United Kingdom. [CONFIRM: production project created in London.] Some suppliers may process data, or have support access to it, in other countries such as the United States or Singapore. When they do, we protect it with one of: UK adequacy regulations, the UK-US data bridge, or the ICO's International Data Transfer Agreement or Addendum. The safeguard for each supplier is set out in our supplier list, which is available on request from hello@harulu.com.
5. How long we keep it
| Data | How long |
|---|---|
| User accounts and business data | While the account is open. When a business closes its account, everything is deleted 30 days later. Copies in backups expire within a further 30 days |
| Billing and payment records | 6 years after the end of the financial year they relate to, for tax and company law. [CONFIRM with the accountant.] |
| Support messages and feature suggestions | Feature suggestions while the account is open; screenshots sent with them 24 months. Support emails: [CONFIRM: period not set yet.] |
| Audit log of sensitive actions | 6 years |
| Sign-in and rate-limit counters | 30 days |
| Error reports | [CONFIRM: the error tracker's retention period, once the account is set up.] |
| Data protection complaints and the breach log | 6 years after the complaint or breach is closed |
| Website enquiries that do not lead to an account | [CONFIRM: period not set yet; suggest 12 months.] |
| Referral records | As billing records |
| Marketing contacts | Until you unsubscribe or we stop sending. We keep a short record of unsubscribes so we do not contact you again |
| Partner records | For the life of the partner agreement, then 6 years for accounting. [CONFIRM.] |
| Pooled insights working data | Up to 24 months. The statistics produced do not identify anyone |
6. Your rights
You have the right to:
- ask for a copy of your data;
- ask us to correct it;
- ask us to delete it;
- ask us to limit how we use it;
- ask for data you gave us in a format you can take elsewhere;
- withdraw consent at any time, where we rely on consent; and
- object to how we use your data where we rely on legitimate interests, including pooled insights, and to direct marketing at any time.
To use these rights, email hello@harulu.com. We will reply within one month. We may need to confirm who you are. Some rights have limits; we will explain if one applies.
7. Complaints
If you are unhappy with how we have handled your data, please tell us first, using our complaint form at harulu.com/data-complaint or by email to hello@harulu.com with the subject "Data protection complaint". The form gives you a reference straight away. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. [CONFIRM: the address the complaint form is published at.]
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. [CONFIRM: ICO contact details on the day of publishing.]
8. Cookies and similar technology
We use only storage that is strictly necessary for the service to work, or that remembers a choice you made. We do not use analytics, advertising or tracking cookies, so we show no cookie banner. Referral links carry a code in the web address. The sign-up page keeps it in your browser's session storage until the tab is closed, so the referral counts when you finish signing up; no cookie is set. If we ever add analytics, we will update this section and our cookie notice first. The cookie notice lists everything we store.
9. Automated decisions
We do not make decisions about anyone by automated means alone that have legal or similarly significant effects.
The "Decide" queue in harulu suggests actions to a business, such as following up a low rating or a late payment, using rules applied to that business's own data. A person at the business decides whether to act. Nothing involving money or messages to customers happens without someone choosing it.
10. Children
harulu is for businesses. It is not meant for children, and accounts are only for people working in a business. We do not knowingly collect children's data for our own purposes. Partners must be 18 or over. If you think a child has given us their details, contact us and we will delete them.
11. Changes to this policy
We will post any changes here and update the date at the top. If a change is significant, we will tell account owners by email.