Book now

Privacy Policy

Last updated: 16 Oct 2026

1. Controller

3S-Clean GmbH i.G., limited liability company (GmbH) in formation
Löffelstraße 22-24, 70597 Stuttgart, Germany
Email: support@3s-clean.com
Phone: +49 176 29607551

2. Categories of Personal Data

Depending on the services used, we process in particular:

  • Identification & contact data (name, email, phone)
  • Booking & contract data (service, add-ons, address, appointment, access instructions including photos you choose to add to your notes)
  • Payment & invoicing data (payment method, invoice data, transaction references)
  • Technical usage data (IP address, device/browser data, logs)
  • Video and photo data for service documentation (if booked)
  • Ratings of completed cleanings (stars and an optional comment)

3. Purposes of Processing

  • Contract performance and booking management
  • Payment processing and invoicing
  • Customer support and complaint handling
  • Quality assurance and internal documentation, including the review of ratings
  • Employee safety
  • Dispute resolution and legal evidence
  • Compliance with legal obligations

4. Legal Bases (Art. 6 GDPR)

  • Art. 6(1)(b) GDPR (contract)
  • Art. 6(1)(c) GDPR (legal obligation, e.g. tax law)
  • Art. 6(1)(f) GDPR (legitimate interests: security, fraud prevention, legal claims, quality)
  • Art. 6(1)(a) GDPR (consent, where required, e.g. analytics/marketing)

5. Photo Documentation and Footage

We take photos before and after cleaning. If booked, we also take time-lapse photos during the service, which are then assembled into video clips. We may also photo-document broken or faulty items. Any footage made may be used for quality control, as evidence of service performed and for employee safety.

Scope limits:

  • only within the booked service scope;
  • no filming inside drawers/wardrobes/containers unless explicitly requested;
  • we avoid personal documents/photos/sensitive items where reasonably possible.

Access: secure, individual, time-limited links and role-based access control. Accessible for customers in their personal account for 7 business days (Monday to Friday) following the service completion notification.
Hosting/processing: in our file storage at Supabase (EU region, Frankfurt), a processor under Art. 28 GDPR. No automated decision-making or profiling (Art. 22 GDPR).
Retention: before/after photos and photos of broken or faulty items are retained for 6 months after service completion and then deleted automatically; time-lapse photos and the video clips assembled from them are automatically and irreversibly deleted no later than 10 business days (Monday to Friday) after the service completion notification. Retention may be extended for disputes or legal obligations; where a complaint or claim is raised, the relevant footage is retained until the matter is finally resolved.

Advertising use: only anonymised clips (e.g., blurring faces, documents, addresses, licence plates). If anonymisation is not feasible, we obtain separate explicit consent.

6. Photos with Your Notes

For a booked appointment you can add up to six photos to your notes for the cleaner in your customer account – for example the front door, the doorbell, a key box, the place where the key is, the parking spot, or things we should leave as they are. This is voluntary: without photos your written notes apply, and not adding any puts you at no disadvantage.

Data processed: the photos, the order they belong to, and when they were uploaded. When you upload a photo we remove its metadata, in particular the location where it was taken (GPS); photos in HEIC format are converted to JPEG.

Purpose: so that the cleaner can get into the premises on the day without detours and understand your notes (Clauses 5.9 and 7.1 of our Terms). The photos apply to this one appointment only and are not carried over to later bookings.

Who sees them: you, our office, and the cleaner assigned to the appointment – the cleaner only until the cleaning is finished. Until the cleaning starts you can add and delete photos.

Other people in the photos: doorbell nameplates, letterboxes or number plates may show names or details of other people, such as neighbours. We do not use or analyse these details; they are deleted together with the photos. Please photograph only what your notes need. These people, too, can exercise their data protection rights by writing to support@3s-clean.com.

Storage and access: in a non-public area of our file storage at Supabase (EU region, Frankfurt), a processor under Art. 28 GDPR. The photos are shown only through individual, time-limited links, with role-based access control.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). For details of other people in the photos and for the longer retention after a No-Access fee, Art. 6(1)(f) GDPR; our legitimate interests are that the cleaner finds the right entrance and understands your notes, and being able to show which notes we had.

Retention: we delete the photos automatically no later than 14 days after the appointment. If we charged you a No-Access fee (Clause 7.4 of our Terms), we keep them for 6 months after the appointment so that we can support the fee if it is disputed later. If a complaint is raised, the photos are kept until the matter is finally resolved. Photos you delete yourself are deleted straight away; when your account is deleted, the photos of all appointments are deleted straight away, except for appointments with a No-Access fee, an open complaint or an open payment dispute – there the period above applies.

7. Ratings of a Cleaning

Once a cleaning is finished you can rate it in your customer account within one week: one to five stars and, optionally, a comment.

Data processed: the star rating, the optional comment, the order it belongs to, and when it was submitted.

Voluntary: rating is voluntary. It is not a condition of the service, and not rating a cleaning does not put you at any disadvantage.

Who sees it: our office and the cleaner who carried out the rated job. Please bear that in mind when writing a comment; we also say so in the rating form itself. Other customers do not see your rating.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is assuring the quality of our service and handling complaints. Where a rating is at the same time a complaint under the contract, the processing is based on Art. 6(1)(b) GDPR.

Not published: we do not publish ratings on our website or in advertising. If we would like to quote one, we ask for your separate consent first.

No automated decision-making: ratings are read by people. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Changing and deleting: within that week you can change your rating in your customer account; after that it stays as it is. You can have it deleted at any time — write to support@3s-clean.com.

8. Contact Form

If you write to us through the contact form, we process your name, your email address and your message and – if provided – your phone number and subject; in addition the language of the page and your browser's identifier (user agent), to detect abusive mass submissions. The message is stored in our database (Supabase, EU region, Frankfurt); by email (Resend) our office receives a notification and you receive a copy of your message. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a booking or an order, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and in protection against abuse). We delete your message 12 months after receipt unless statutory retention obligations apply.

9. Payment Processing (Stripe, PayPal)

We use external payment service providers (e.g. Stripe). We do not store full card details on our systems; we typically receive only confirmations and references required for accounting and invoicing. Payment data is processed by the payment provider according to applicable security standards (e.g. PCI-DSS).

If you choose PayPal, Stripe redirects you to PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal processes your data as an independent controller under its own privacy statement (https://www.paypal.com/de/legalhub/paypal/privacy-full). Through Stripe we transmit the data required for the payment, in particular amount, currency and order number. Through Stripe we receive from PayPal a confirmation of the payment as well as the e-mail address and identifier of your PayPal account. If you save PayPal for later payments, you give PayPal an agreement for automatic payments; you can end it at any time in your PayPal account. The legal basis is Art. 6(1)(b) GDPR.

10. Cookies, Consent and Analytics

We use cookies and similar technologies (e.g. local storage).

Strictly necessary cookies and storage: for login/sessions, security, language preferences, the booking draft on your device, and booking/payment flows. Legal basis: Art. 6(1)(b) and (f) GDPR and § 25(2) No. 2 TDDDG.

The cookies we set:

  • Your cookie choice: the answer you gave in the cookie banner. 12 months. (3s-consent, us)
  • Language: the language you picked. Until you close the browser. (NEXT_LOCALE, us)
  • Login: keeps you signed in to your customer account. Until you log out. (sb-…-auth-token, us via Supabase)
  • Trusted device: recognises the device you logged in from, so nobody else can log in as you from a new one unnoticed. 90 days. (__Secure-3s_td, us)
  • Payment security: fraud prevention by Stripe, only on pages with a payment step. 1 year and 30 minutes respectively. (__stripe_mid, __stripe_sid, Stripe)
  • Analytics: only after your consent, to see how the site is used. 60 days. (_ga, _ga_…, Google)
  • Booking draft: so you can resume a booking you started. 24 hours, in your browser's local storage, not a cookie. (3s-booking-storage, us)

Consent management: We store your decision for 12 months in the cookie 3s-consent on your device; no data is transmitted to third parties. You can change or withdraw your choice at any time via “Cookies” in the footer of the website. If we change the services we use, we ask you again.

Google Analytics 4: only with your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). Without consent the service is not loaded and no data is sent to Google. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 processes IP addresses only in truncated form and does not store them. Google Signals and personalised advertising are disabled; retention of user data at Google is set to two months, and the Google Analytics cookies expire after 60 days. We analyse page views, the steps of the booking process and completed bookings in order to improve the website. If you withdraw your consent, the analytics cookies on your device are deleted. A data processing agreement is in place with Google; transfers to the USA take place under the EU-U.S. Data Privacy Framework. More information: https://policies.google.com/privacy

Statistics without cookies: Independently of your consent, we count on our own servers how many visitors reach each step of the booking process, and we record for a booking through which channel you reached us (e.g. Google Search, Google Business Profile) where the address you opened carries that information. No cookies are set and no user profiles are created. Legal basis: Art. 6(1)(f) GDPR.

Logins and devices: to protect your account we keep a list of the devices you are logged in with. For each device we store your browser's identifier (user agent), a check value (hash) of technical device characteristics (platform, screen size and pixel density, number of processor cores, memory, touch support), the page language, when it was first and last used, and the approximate location (city, region, country) that our hosting provider Vercel derives from your IP address. You can see the list in your customer account and log devices out there. When you log in from a new device we send you an email naming the approximate location and the IP address; we do not store the IP address in our database. Legal basis: Art. 6(1)(f) GDPR (security of your account); reading the device characteristics is strictly necessary for the secure login you asked for (§ 25(2) No. 2 TDDDG).

11. Recipients / Processors

We use the following service providers as processors (Art. 28 GDPR): Vercel Inc. (website hosting, USA/EU), Supabase Inc. (database and file storage, EU region, Frankfurt), Stripe Payments Europe Ltd. (payment processing, Ireland), Resend (email delivery, USA) and – only with your consent – Google Ireland Limited (analytics). All are contractually bound to confidentiality and data security.

Other recipients:

  • Address suggestions when booking: while you type your address, our server asks for matching suggestions: the street you have entered (possibly with house number), together with the postcode and city, is sent to the Photon service of komoot GmbH (Potsdam, Germany), and the postcode alone to the OpenPLZ API of STÜBER SYSTEMS GmbH (Berlin, Germany). Your name, your contact details and your IP address are not passed on. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a complete and correct service address.
  • Push notifications: if you turn on notifications, we store the delivery address and keys your browser creates for them, and your browser's identifier (user agent). Notifications are delivered through the push service of your browser or device (Apple, Google, Microsoft or Mozilla, depending on the browser; these providers may also process data in the USA). The content is encrypted and cannot be read by the push service, which only learns that and when a message for your device arrives. You can turn notifications off at any time in your customer account or in your browser settings. Legal basis: Art. 6(1)(a) GDPR.

12. Transfers Outside the EU/EEA

Where data is processed outside the EU/EEA (e.g. hosting, email delivery, analytics, push services), this is done only with appropriate safeguards (e.g. adequacy decision, EU-U.S. Data Privacy Framework, or Standard Contractual Clauses – SCCs).

13. Retention Periods

  • Account data: while the account exists
  • Booking/invoice data: 8 years from the end of the year of the invoice (statutory tax retention)
  • Before/after photos and photos of broken or faulty items: 6 months after service completion; time-lapse photos and video clips: no later than 10 business days (Monday to Friday) after the service completion notification (longer in each case for disputes/legal obligations)
  • Ratings: 12 months after they are given; we delete them earlier on request
  • Photos with your notes: no later than 14 days after the appointment; 6 months after the appointment where a No-Access fee was charged (longer in each case for disputes)
  • Messages sent through the contact form: 12 months after receipt
  • Logged-in devices (browser identifier, device check value, approximate location): 90 days after last use, at the latest when the account is deleted
  • Push subscriptions: until you turn notifications off in your customer account or the push service reports that the delivery address is no longer valid

14. Your Rights

You have the rights of access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. You also have the right to lodge a complaint with a supervisory authority.

15. Contact

support@3s-clean.com