Privacy policy

Data controller

The controller of your personal data is the company behind the tojeto service:

What data we collect

We only collect what we need for the service to work:

• Account data: the name, email and phone number you use to sign in and receive notifications.
• Property and job data: property addresses, cleaning schedules, tasks and notes you enter.
• Photos: images you and your team upload against a job (e.g. before-and-after condition of a property).
• Messages: the content of messages we exchange over WhatsApp and SMS, including sender and recipient phone numbers.
• Technical data: basic usage and security logs needed to operate and protect the service.

Why we process data

We use your data to:

• provide the property-management and cleaning-operations service;
• schedule, assign and track cleaning jobs and your team;
• send notifications about jobs and schedules, including over WhatsApp and SMS;
• keep the service secure, prevent abuse and meet our legal obligations.

Legal basis (GDPR)

We process your data under the General Data Protection Regulation (GDPR):

• performance of a contract — to deliver the service you asked for;
• legitimate interest — to keep the service secure, reliable and to improve it;
• consent — for sending messages over WhatsApp and SMS, which you can withdraw at any time.

WhatsApp and SMS messaging

We may send you job and schedule notifications over WhatsApp and SMS. For WhatsApp we use Meta's WhatsApp Business platform, which delivers messages on our behalf. We process the content of those messages and the associated phone numbers solely to provide the service. Messaging relies on your consent and you can stop it at any time — contact us at [email protected] or reply to a message.

On WhatsApp we also offer an automated assistant that answers your questions. We run the conversations through the Chatwoot platform, and when you use the assistant the content of your messages is processed by Anthropic's (USA) AI solely to compose a reply. For debugging and security, our operators may review conversations with the assistant and its activity trace — which data it fetched and what it answered. That trace is a separate record of message content and fetched data that we keep for a limited retention period and then delete automatically.

Who we share data with

We do not sell your data and we do not give it to third parties for marketing. We share it only with carefully chosen processors who help us run the service, acting on our instructions:

• infrastructure and hosting providers that run the app and database;
• Cloudflare R2 for storing the photos you upload against jobs;
• Meta (WhatsApp) for delivering WhatsApp messages;
• an SMS provider for delivering text messages;
• Chatwoot for running our WhatsApp conversation inbox (where we receive and send messages);
• Anthropic (USA) for AI processing of message content when you use our WhatsApp assistant.

We have a contract with each processor that binds them to protect your data in line with the GDPR. Where data is transferred outside the European Economic Area (for example Anthropic in the USA), that transfer is protected by appropriate safeguards, such as standard contractual clauses.

How long we keep data

We keep your data for as long as you have an active account and as long as we need it to provide the service. After you close your account we delete or anonymise your data within a reasonable period, except where we are required to retain it by law (e.g. accounting records).

Security

We apply reasonable technical and organisational measures to protect your data: encrypted connections, encrypted photo storage, access controls and limiting access to data to what is strictly necessary. No system is perfectly secure, but we take the protection of your data seriously.

Support access to your account

So we can help when something goes wrong, authorised members of our support team may sign in to your account and act on your behalf to fix a problem — for example correcting a wrongly scheduled cleaning. This access is limited to what is needed to help you, every action they take is recorded in our audit log alongside their name, and their access ends automatically after a short time.

Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at [email protected]. We aim to respond promptly and within the time limits set by the GDPR.

If you believe we are not processing your data lawfully, you have the right to lodge a complaint with a supervisory authority — in Croatia this is the Personal Data Protection Agency (AZOP), www.azop.hr.

Contact

For any questions about this policy or how we handle your data, write to us at [email protected].