Privacy Policy

v4 — GDPR accuracy: deletion model (§5.2) + transfer safeguards (§9) · published 3 June 2026

1. Introduction

1.1 Important information and who we are

Welcome to Twinklin Ltd's Privacy and Data Protection Policy ("Privacy Policy").

At Twinklin Ltd ("we", "us", or "our") we are committed to protecting and respecting your privacy and Personal Data in compliance with the United Kingdom General Data Protection Regulation ("GDPR"), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.

This Privacy Policy explains how we collect, process and keep your data safe. The Privacy Policy will tell you about your privacy rights, how the law protects you, and inform our employees and staff members of all their obligations and protocols when processing data.

The individuals from which we may gather and use data can include: Customers, Suppliers, Business contacts, Employees/Staff Members, Third parties connected to your customers, and any other people the organisation may need to contact.

This Privacy Policy applies to all our employees and staff members and all Personal Data processed at any time by us.

1.2 Your Data Controller

Twinklin Ltd is your Data Controller and responsible for your Personal Data. We are not obliged by the GDPR to appoint a data protection officer and have not voluntarily appointed one at this time. Therefore, any inquiries about your data should either be sent to us by email to support@twinklin.app or by post to 128 City Road, London, EC1V 2NX, United Kingdom.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

1.3 Processing data on behalf of a Controller and processors' responsibility to you

In discharging our responsibilities as a Data Controller we have employees who will deal with your data on our behalf (known as "Processors"). The Data Controller and our Processors have the following responsibilities:

Ensure that all processing of Personal Data is governed by one of the legal bases laid out in the GDPR;
Ensure that Processors authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of Personal Data;
Obtain the prior specific or general authorisation of the Controller before engaging another Processor;
Assist the Controller in the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights;
Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller;
Maintain a record of all categories of processing activities carried out on behalf of a Controller;
Cooperate, on request, with the supervisory authority in the performance of its tasks;
Ensure that any person acting under the authority of the Processor who has access to Personal Data does not process Personal Data except on instructions from the Controller; and
Notify the Controller without undue delay after becoming aware of a Personal Data Breach.

2. Legal Basis for Data Collection

2.1 Types of data / Privacy policy scope

"Personal Data" means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together below:

Profile/Identity Data: first name, last name, gender, date of birth.
Contact Data: phone number, addresses, email addresses. Phone numbers may be verified via SMS one-time code (see Section 4.4).
Marketing and Communications Data: your preferences in receiving marketing information and other information from us.
Billing Data: debit and credit card information such as the name attached to your payment details and your billing address.
Financial Data: banking details e.g. your account number and sort code.
Transactional Data: details and records of all payments you have made for our services or products.
Customer Support Data: feedback and survey responses.
Usage Data: information about how you use our website, products and services.
Location Data: precise GPS coordinates, speed, heading, and accuracy data collected from cleaner devices during active bookings (see Section 3 for full details).
Audio Data: real-time voice audio captured by your device microphone during in-app voice calls between you and your cleaner or customer. Voice call audio is streamed live and is not recorded or stored by Twinklin (see Section 3a for full details).

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

2.2 The Legal Basis for Collecting That Data

There are a number of justifiable reasons under the GDPR that allow collection and processing of Personal Data:

"Consent": Certain situations allow us to collect your Personal Data, such as when you tick a box that confirms you are happy to receive email newsletters from us, or 'opt in' to a service.
"Contractual Obligations": We may require certain information from you in order to fulfil our contractual obligations and provide you with the promised service.
"Legal Compliance": We're required by law to collect and process certain types of data, such as fraudulent activity or other illegal actions.
"Legitimate Interest": We might need to collect certain information from you to be able to meet our legitimate interests — this covers aspects that can be reasonably expected as part of running our business, that will not have a material impact on your rights, freedom or interests.

3. Location Data and Cleaner Tracking

3.1 What we collect

We collect precise GPS location data (coordinates, speed, heading, and accuracy) from cleaner devices during active bookings. Location data is collected approximately every 15 seconds while a cleaner is travelling to a customer's location.

Location data is collected even when the app is in the background or not actively in use, during the period a cleaner is travelling to a customer's location. This is necessary because cleaners routinely switch to navigation apps (such as Google Maps) while en route.

3.2 Purposes

Location data is used to:

Provide customers with real-time arrival estimates and journey progress on a map
Calculate and update estimated arrival times (ETAs)
Verify that the cleaner has arrived at the correct job location
Support dispute resolution (e.g. verifying attendance)

3.3 Lawful basis

We process cleaner location data on the basis of legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interests are: providing customers with accurate arrival information and journey visibility, ensuring service accountability and quality, and resolving disputes about attendance and timing.

We have conducted a Legitimate Interests Assessment (LIA) and a Data Protection Impact Assessment (DPIA) for this processing. These are available on request.

We do not rely on consent as the lawful basis for location tracking because ICO guidance recognises that consent in a worker/platform relationship may not be freely given due to the inherent power imbalance.

3.4 Who sees your location

The customer who booked the service — approximate position on a map with ETA, during the active booking only
Twinklin platform administrators — precise location data, for support and dispute resolution only
Google Maps — location coordinates for map rendering during active tracking

Location data is not shared with other users, third parties, or used for advertising purposes.

3.5 When we track

Only during active bookings — from the moment a cleaner taps "I'm on my way" until the job is marked as completed
Not during off-duty time, between bookings, or at any other time
Background collection occurs only during an active journey to a booking
A visible notification appears on the cleaner's device whenever tracking is active

3.6 Retention of location data

Real-time location tracking data is retained for 30 days after booking completion, for dispute resolution and service quality purposes. After the retention period, precise location data is automatically deleted.

Aggregated, anonymised journey data (e.g. average travel times by area) may be retained for service improvement.

3.7 Right to object to location tracking

As we process location data on the basis of legitimate interests, you have the right to object to location tracking at any time. To object, revoke location permissions in your device settings or contact us at support@twinklin.app.

If you object, we will stop processing your location data unless we can demonstrate compelling legitimate grounds that override your interests. Please note that location sharing is integral to the arrival tracking service; objecting may affect the customer experience and your visibility for receiving bookings.

3.8 Security of location data

Location data is transmitted over encrypted connections (TLS) and stored in encrypted cloud infrastructure. Access is restricted to authorised personnel and automated systems that require it for the stated purposes.

3a. Voice Calls and Microphone Access

3a.1 What we collect

When you start or accept an in-app voice call with the other party on a booking, your device microphone captures live audio that is transmitted in real time to the other participant via our voice infrastructure provider (LiveKit). Microphone access is requested only at the moment you initiate or accept a call.

3a.2 Purposes

In-app voice calls let customers and cleaners speak directly about an active booking — directions, access instructions, gate codes, scheduling adjustments — without exchanging personal phone numbers.

3a.3 Lawful basis

We process voice call audio on the basis of legitimate interests (UK GDPR Article 6(1)(f)) — enabling private, low-friction communication between two parties who already share a contractual booking relationship through us. The microphone permission is requested only when you initiate or accept a call and is not used for any other purpose.

3a.4 Who hears your call

Only the other party on the call. Calls are routed through LiveKit's infrastructure but are not monitored, transcribed, or recorded by Twinklin or LiveKit. We do not access call audio, including for support purposes.

3a.5 Retention

Voice call audio is not recorded or stored. The audio stream exists only in transit between the two devices for the duration of the call, then is gone.

We do retain call metadata — booking id, the two participant ids, start and end timestamp, and total duration — for up to 12 months. This metadata is used for billing reconciliation, abuse investigation, and service quality.

3a.6 Right to object

You can decline microphone access at any time via your device settings. Without microphone access the in-app calling feature won't work; in-app messaging and external phone communication remain available.

4. How We Use Your Personal Data

4.1 Our data uses

We will only use your Personal Data when the law allows us to. When users sign up, we collect Profile/Identity Data, Contact Data, Marketing and Communications Data, Billing Data, Financial Data, Transactional Data, Customer Support Data, and Usage Data to onboard cleaners and clients, match cleaners to clients, and process payments for services purchased or provided on our platform.

4.2 Marketing and content updates

You will receive marketing and new content communications from us if you have created an account and chosen to opt into receiving those communications. From time to time we may make suggestions and recommendations to you about goods or services that may be of interest to you.

4.3 Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

4.4 Phone number verification

When you choose to verify your phone number, we send your number to Twilio Inc. ("Twilio Verify") solely so Twilio can deliver one SMS one-time code to that number. We do not use Twilio for marketing, A2P messaging, or any other purpose. The verified status (a yes/no flag and a timestamp) is stored against your Twinklin account; the code itself is not retained.

5. Your Rights and How You Are Protected by Us

5.1 Your legal rights

Under data protection laws, you have the following rights in relation to your personal data:

Right to be informed: You have a right to be informed about our purposes for processing your personal data, how long we store it for, and who it will be shared with.
Right of access: This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Right to rectification: You have a right to request correction of the personal data that we hold about you.
Right to erasure: You have the right to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
Right to object: You can object to the processing of personal data we hold about you, for example where we are processing it for direct marketing purposes.
Right to restrict processing: You have the right to request the restriction or suppression of your personal data in certain circumstances.
Right to data portability: You have the right to request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.

If you wish to make a request under any of these rights, please contact us at support@twinklin.app.

5.2 Your control over Twinklin Ltd's use of your Personal Data

You may delete your account at any time — this will remove your account page from our systems and our related software. After a 30-day grace period (during which you can cancel by signing back in), we permanently delete your personal data. We keep only the limited records the law requires us to retain — for example records needed for tax, accounting, or to establish or defend a legal claim — and we delete those once the legal retention period ends.

Your account information will be protected by a password for your privacy and security. You need to prevent unauthorized access to your account and personal information by selecting and protecting your password appropriately and limiting access to your computer or device.

5.3 How Twinklin Ltd protects customers' Personal Data

We are concerned with keeping your data secure and protecting it from inappropriate disclosure. We implement a variety of security measures to ensure the security of your Personal Data on our systems, including adopting a secure protocol and encrypting our databases to protect customer personal data. Any Personal Data collected by us is only accessible by a limited number of employees who have special access rights to such systems and are bound by obligations of confidentiality.

5.4 Opting out of marketing promotions

You can ask us to stop sending you marketing messages at any time by using the 'Unsubscribe' option provided in our communication. Where you opt out of receiving these marketing messages, we will continue to retain other Personal Data provided to us as a result of interactions with us not related to your marketing preferences.

5.5 How to request your data

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, if your request is clearly unfounded, we could refuse to comply with your request. We may need to request specific information from you to help us confirm your identity and ensure you have the right to access your Personal Data.

6. Your Data and Third Parties

6.1 Sharing your data with third parties

We may share non-Personal Data with third parties. We may share your Personal Data with subcontractors or affiliates, subject to confidentiality obligations to use it only for the purposes for which we disclose it to them and pursuant to our instructions.

We may also share Personal Data with interested parties in the event that Twinklin Ltd anticipates a change in control or the acquisition of all or part of our business or assets or with interested parties in connection with the licensing of our technology.

6.2 Third-Party Links

This Site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

7. How Long We Retain Your Data

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your Personal Data for a longer period than usual in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

8. Age Limit for Our Users

You must not use Twinklin Ltd unless you are aged 16 or older. If you are under 16 and you access Twinklin Ltd by lying about your age, you must immediately stop using Twinklin Ltd. This website is not intended for children and we do not knowingly collect data relating to children.

9. International Transfer of Data

Your information may be stored and processed outside the United Kingdom. Our cloud infrastructure provider (Convex) processes data in the United States. Location data is also processed by Google Maps (Google LLC, United States) for map rendering. Voice call audio is routed in real time through LiveKit (LiveKit, Inc., United States, with regional edge nodes) but is not stored.

These international transfers are protected by appropriate safeguards. Google (Google Maps) and LiveKit are covered by the UK Extension to the EU-US Data Privacy Framework. Our cloud infrastructure provider, Convex, is not certified under that Framework, so the transfer to Convex is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (entered into through Convex's Data Processing Agreement), supported by a transfer risk assessment.

If you would like more information about the safeguards in place for international transfers of your data, please contact us at support@twinklin.app.

9a. Consent Management, Vendors, and Retention

Where Twinklin uses cookies, mobile SDKs, or server-to-server analytics integrations that go beyond what's strictly necessary to provide the booking service, we ask for your consent before anything fires. Your choice is recorded — when, where, and to what version of this policy you agreed — so that if you ever ask us to prove your consent, we can.

Vendors and what they receive

Convex — booking data, account fields, encrypted at rest.
Clerk — authentication identity (email, phone, name). Clerk uses Svix as a sub-processor for webhook delivery.
Stripe — payment card details, payout email, KYC data for cleaners.
Brevo (Sendinblue SAS, France) — delivery of transactional and service emails (booking confirmations, receipts) and, where you have opted in, area-launch notifications. Receives your email address and the message content.
Google Maps — service-area address autocomplete.
LiveKit — real-time voice call audio streamed between two booking participants. Audio is not recorded; only call metadata (booking id, participant ids, timestamps, duration) is retained on Twinklin systems.
Twilio Verify — your mobile number, used solely to send one SMS verification code at the moment you choose to verify your phone.
Firebase Crashlytics — anonymised crash logs (essential diagnostic).
Google Analytics 4 / Tag Manager — anonymised page-view + event data (opt-in).
Microsoft Clarity — heatmaps only (opt-in; session recordings disabled).
Vercel Analytics + Speed Insights — first-party performance metrics (opt-in).
Firebase Analytics — anonymised app event data on iOS + Android (opt-in).
Meta — hashed email + hashed phone + a Twinklin-internal user identifier sent to Meta's Conversions API and Meta Pixel for ad attribution + Meta Custom Audiences (opt-in).

Retention

Booking data — duration of our customer relationship plus six years thereafter (UK statute of limitations for contract claims).
Voice call audio — not retained (real-time stream only).
Voice call metadata — up to 12 months.
Marketing analytics events — up to 26 months (Google Analytics 4 default).
Crash diagnostic data — 90 days.
Consent decisions — five years after account deletion, in anonymised form (your user identifier and IP-hash are removed; only the timestamped purposes you agreed to and the policy version are retained, so we can demonstrate proof of consent if challenged).
Audit logs of administrative actions — six years.

Your data subject rights (DSAR)

Under UK GDPR you can request access to, rectification of, or erasure of your personal data; you can object to or restrict certain processing; and you can withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. Email us at privacy@twinklin.app and we'll respond within one calendar month, as required by UK GDPR Article 12(3).

When you ask us to delete your account, we erase your personal records from our systems. We retain anonymised consent records for five years as described above; we retain anonymised, aggregated analytics for as long as the relevant analytics provider keeps it. Neither contains anything that identifies you.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/concerns.

Area waitlist ("Coming Soon" notifications)

If Twinklin isn't yet available in the area you searched and you ask us to let you know when we launch there, we collect the email address you provide, the postcode/area and approximate location you searched, and whether you opted in to marketing email. If you later create an account using the same email address, we link this record to your account.

We process this data on the basis of your consent (to send you the launch notification and any associated introductory offer) and our legitimate interest (understanding demand so we can decide where to expand next). You can withdraw your consent at any time using the unsubscribe link in any email we send, after which we will not email you again.

We keep area-waitlist entries until you unsubscribe or ask us to delete them, or until 12 months after we launch in (or decide not to serve) your area, whichever is sooner. You can ask us to delete your waitlist entry at any time — even if you do not have an account — by emailing privacy@twinklin.app.

10. Notification of Changes and Acceptance of Policy

We keep our Privacy Policy under review and will place any updates here. This version is dated 3 June 2026.

By using Twinklin Ltd, you consent to the collection and use of data by us as set out in this Privacy Policy. Continued access or use of Twinklin Ltd will constitute your express acceptance of any modifications to this Privacy Policy.

11. Interpretation

All uses of the word "including" mean "including but not limited to" and the enumerated examples are not intended to in any way limit the term which they serve to illustrate. Unless otherwise required by law, we reserve the right to not respond to emails, even if they relate to a legitimate subject matter for which we have provided an email address.