Privacy Policy

1.1. Controller: Talova OÜ (registration code 17584985, registered address: Harju maakond, Loksa linn, Posti tn 19, 74805, Estonia) operates the Talova platform and is the controller of the personal data described in this policy.

1.2. Contact: Questions about your data, or requests to exercise your rights, can be sent to support@talova.co.uk.

2.1. Data We Process:

• Account details: name, date of birth, email address, phone number, profile photo and the role you use (Client or Cleaner).
• Bookings: addresses, dates, services, prices, cancellations, ratings and reviews.
• Payments: payment and refund records and your Account Credit history. Card details are handled by our payment provider Stripe; we do not store full card numbers.
• Messages: messages between a Client and a Cleaner about a booking.
• Cleaner verification: the result of the identity check, right-to-work details, tax details and documents a Cleaner uploads (such as DBS or insurance certificates).
• Location: the Cleaner's device location, checked from 5 minutes before a job's scheduled start, at regular intervals while it runs (also in the background, while a notification shows on the device) and when the job is started and finished, to confirm attendance (Terms 7.3).
• Reports and support: reports, disputes and support requests.
• Security: data used to protect accounts (Section 8).

3.1. Purposes and Lawful Bases: We use personal data to provide the Platform and process bookings and payments (performance of our contract with you), to meet accounting and tax obligations (legal obligation), and to keep the Platform safe, prevent fraud and resolve disputes (our legitimate interests). Where a process relies on consent, it is stated below.

3.2. Date of Birth: We ask for your date of birth when you create an account, to confirm that you are 18 or over: Talova is for adults only, and we cannot create an account for anyone younger. We store only the date itself. It is not shown to Clients, Cleaners or anyone outside authorised Talova staff, and we use it for no other purpose (for Cleaners, it is also compared with the identity check, Section 4). Lawful basis: performance of our contract with you (only adults can hold an account) and our legitimate interests in keeping the Platform for adults. It is erased when your account is deleted (11.2).

4.1. Identity Verification: We use Stripe Identity to verify Cleaners. Stripe captures a live photo of your passport and a live selfie and compares your face with the passport photo; this comparison uses biometric data, which Stripe processes as an independent controller. We do not receive or store your passport images, your selfie or your passport number. We receive and store the result of the check, your first and last name, date of birth, the passport's issuing country and the document type. We compare your name and date of birth with your profile to confirm your identity, prevent fraud and protect Clients. This data is visible only to you and authorised Talova staff, and is deleted when your account is deleted. Lawful basis: our legitimate interests; for the biometric check, your explicit consent, given in the verification flow.

5.1. Job Location: For each booking, the Cleaner's app checks the device's location from 5 minutes before the scheduled start, at regular intervals while the job runs — also in the background, while a notification shows on the device — and when the job is started and finished, to confirm attendance (Terms 7.3). Clients never see it. Only authorised Talova staff can, and only to review disputes and jobs that were not started. Location records and the booking's messages are deleted 14 days after the booking ends. If the booking is disputed, its messages are kept with the dispute record for 6 years, and its location records are deleted 60 days after the dispute is resolved. Lawful basis: performance of our contract with the Cleaner and our legitimate interests in preventing fraud and resolving disputes.

6.1. Strike Records: When a Cleaner Failure is recorded under the Terms (Section 12), we record its date, reason, the booking concerned and its consequence. We use these records to apply and review suspensions, handle disputes and protect Clients, on the basis of our legitimate interests. They are visible to authorised Talova staff only and are kept for 6 years after the event, including after the account is closed, then deleted.

7.1. Cancellation Records: When you cancel a paid booking, we record which Cleaner it was with and when, for 24 hours, to identify repeated cancellations with the same Cleaner (Terms 4.3). If a repeat is identified, a review item naming you, the Cleaner and the booking is created for authorised Talova staff. Lawful basis: our legitimate interests (preventing misuse of Cleaners' time). The 24-hour record is then deleted; review items are kept for 12 months.

8.1. Security Data: To protect accounts from misuse, we process the IP address and email address used for sign-in, password reset and registration attempts. For these limits we store them only as a one-way coded identifier, together with the times of recent attempts. For certain account actions (for example, withdrawing Account Credit) we record the IP address in an internal audit log. Lawful basis: our legitimate interests (security and fraud prevention). Attempt records are kept for 30 days and audit logs for 6 years.

9.1. Payment Records: We keep your Account Credit balance and its history (amounts, dates, the related booking or payment and any withdrawal, including its refund references) to operate your account and meet our accounting and tax obligations. Card payments and refunds are processed by Stripe. These records are kept for 7 years after the transaction, as the Estonian Accounting Act requires, including after the account is closed. Lawful basis: performance of our contract with you and legal obligation.

10.1. Who We Share With: Your name, photo and rating are shown to the other party of a booking. We use service providers to run the Platform: Stripe (payments and identity verification), Google Firebase (hosting, database and notifications) and our email provider. We do not sell personal data.

10.2. International Transfers: Some providers may process data outside the UK and the EEA; where they do, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum.

11.1. Your Rights: You may ask to access, correct or delete your personal data, to restrict or object to its processing, or to receive it in a portable format, by writing to support@talova.co.uk. You can also delete your account and its personal data yourself, in the app (Menu → Account & Privacy → Delete account) or at talova.co.uk/delete-account (see 11.2).

11.2. Account Deletion: When you delete your account we deactivate it at once, and you can restore it by signing in within 30 days. After that we erase your profile (including your date of birth), contact details, addresses, photos, documents, saved searches, notifications and devices, and ask Stripe to delete your saved cards, your payout account and the images from your identity check. Reviews you wrote stay, without your name or photo. We keep, without your name or contact details, payment and Account Credit records and booking prices, with only the postcode district of the address, for 7 years to meet our accounting and tax obligations; for Cleaners, we also keep for 7 years the tax details we must report as a platform operator. Strike records, audit logs and disputed booking records are kept for 6 years (5.1, 6.1, 8.1). Stripe keeps its own payment records as an independent controller.

11.3. Complaints: You can complain to the UK Information Commissioner's Office (ico.org.uk) or the Estonian Data Protection Inspectorate (aki.ee).

12.1. Changes to This Policy: We will post any changes on this page and in the app, with the date of the latest update.