Draft. This document is being reviewed and is not yet in force.
Spotless Privacy Policy
Last updated: [[date of publication]] Version: 0.1 (draft)
This policy explains what personal data Spotless handles, why, where it goes, how long it is kept, and what you can do about it. It covers the Spotless phone app, the Spotless website at app.spotlessplatform.com, the guest pages reached by scanning a Spotless code, our messages on Telegram, WhatsApp and email, and our public site at spotlessplatform.com.
1. Who we are
Spotless is made by [[LemonByte LLP — confirm legal name]], [[LLPIN]], [[registered address]], Goa, India ("LemonByte", "we", "us").
- Questions about privacy: [[privacy@spotlessplatform.com or support@spotlessplatform.com]]
- Grievance Officer: [[name]], [[email]], [[postal address]]. We acknowledge a grievance within [[48 hours]] and answer within [[30 days]].
2. Two roles: your employer's data, and ours
Most of the personal data in Spotless belongs to the business that uses it (a hotel, restaurant, clinic or factory: our "customer"). Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the customer is the Data Fiduciary for its staff's data and decides why it is processed. LemonByte is its Data Processor: we process that data only to run Spotless for the customer, under our agreement with them.
If you work at a property that uses Spotless, your employer is responsible for your data in Spotless, and requests about it (to see it, correct it or erase it) go to them first. We give them the tools to act on your request, and we will help you reach them if you write to us.
LemonByte is the Data Fiduciary for a smaller set of data: details of the people who sign up a business, contact us, or visit spotlessplatform.com, and the technical records we keep to run and protect the service (section 9).
3. What we collect, and from whom
People who use the phone app (staff, supervisors, managers, owners)
| Data | Where it comes from | Why |
|---|---|---|
| Name, role, the property you work at, a staff code | Your employer, when they add you | To show you your work and record who did it |
| Mobile number | Your employer | To set up your account and sign you in |
| A PIN (stored only as a one-way hash we cannot reverse) | You | To sign in, including on a shared phone |
| The checks you complete, answers, counts, notes you choose to add, issues you raise or fix | You, as you work | This is the record the service exists to keep |
| Photos you take of surfaces, equipment and stock | You | Proof that a check was done |
| An approximate location at the moment you submit a check | Your phone | To note whether the check was done on site |
| If your employer uses Attendance: your location when you check in, or the code you scanned | Your phone | To record that you checked in on site |
| A push notification token, the phone's make and model, its operating system and the app version | Your phone | To send you notifications, and to fix problems |
If your phone offers Face ID or fingerprint unlock, the phone checks it; Spotless never receives your fingerprint or face data.
People who use the website (managers, owners, auditors)
Name, work email address, role, a password (stored only as a one-way hash), and, if you turn it on, a second sign-in step. Everything you create or change in Spotless is recorded with your account.
Guests who scan a Spotless code in a room or at a table
The guest page shows when that place was last checked. It never shows staff names, photos of people or notes. If you report a problem, we receive the category you choose, anything you write, a photo if you add one, and contact details only if you choose to give them. If the property uses Dining, we receive your order and the room or table it is for. We do not ask guests to create an account.
People who visit spotlessplatform.com or contact us
The public site sets no cookies and uses no analytics or advertising tools. Our server keeps a short technical log of requests (including your IP address) to keep the site running and secure. If you email us, we keep your message and address to reply.
4. What we never collect
Spotless is designed never to photograph people: photos are of surfaces, equipment and stock, and the app says so when the camera opens. We do not collect continuous or background location, contacts, addresses, identity documents, dates of birth (unless your employer chooses to record a birthday for a staff greeting), biometric data, or anything about staff members' personal lives. We do not sell personal data, and we do not use it for advertising. Spotless does not give managers scores or rankings of individual staff.
5. How we use personal data
For our customers, and only as they instruct us:
- to show each person their work, and to record what was done, when and by whom, with the evidence;
- to turn missed or failed checks into issues with an owner, and to tell the right people (in the app, by push notification, or by message if the person has turned messages on);
- to produce reports, summaries and exports for the customer;
- to keep the record trustworthy: a saved check is never edited, and a correction is a new entry beside it.
For ourselves, as Data Fiduciary:
- to run, secure and fix the service (section 9);
- to set up and manage customer accounts, bill customers, and answer questions;
- to meet legal obligations.
We process data on the basis of our contract with the customer, the consent or other lawful ground the customer relies on for its staff, and, for our own data, your consent or the legitimate uses the DPDP Act allows. [[Advisor: confirm the grounds to cite under the DPDP Act and Rules.]]
6. Photos
Photos are kept in private storage. Nobody can open one with a public link: each view uses a link that stops working within minutes. A photo taken in an occupied hotel room can show a guest's belongings; staff are asked to frame the fixture being checked, not the room.
7. Messages on Telegram, WhatsApp and email
If a person turns on messages in the app, Spotless sends them summaries, reminders and issues by the channel they choose, and they can reply with simple commands. Managers and owners can also choose to receive photos and the daily report as files. A copy of anything sent this way is kept by that service (Telegram, Meta for WhatsApp, or the email provider) under its own terms, outside Spotless, and we cannot delete it. The app says this before those options are turned on. Messages are off until each person turns them on, and STOP turns them off.
8. Who we share data with
We share personal data only with the service providers that run Spotless for us, under contracts that limit them to doing so, listed with what each does and where at [[spotlessplatform.com/subprocessors]]: hosting, the database, photo storage, backups, email, push notifications and, if a person turns them on, Telegram and WhatsApp.
We may disclose data if the law requires it, to protect people from harm, or as part of a sale or reorganisation of our business (in which case this policy continues to apply). We do not share personal data with anyone for their own marketing.
9. Technical records
To run, fix and protect Spotless we keep:
- Server logs of requests, including IP addresses, for security and to limit abuse, deleted after 30 days.
- Diagnostics: requests that failed and errors the apps hit, kept for 30 days. With the customer's agreement during a pilot, a more detailed log of screens opened and actions sent, deleted when the pilot ends. These records hold the person's account ID (not their name), the property, the app version and the device, and never what anyone typed, notes, names, phone numbers, PINs, passwords or photos.
- Problem reports a person chooses to send from the app: what they wrote, the screen they were on, their app's recent steps and, unless they untick it, a screenshot. A screenshot can show whatever was on screen. Only Spotless staff see screenshots; they are deleted 90 days after the report is closed.
10. Where data is stored
Our servers and database are in [[India — e.g. DigitalOcean, Bangalore; confirm at deployment]]. Some of our providers may store or process data outside India (for example photo storage, email delivery, push notifications, Telegram and WhatsApp); the list in section 8 says where. We transfer data outside India only as the DPDP Act allows. [[Advisor: confirm wording on cross-border transfer.]]
11. How long we keep it
| Data | Kept |
|---|---|
| Photos | 90 days after they are taken, unless the customer chooses 30, 180 or 365 days, or to keep them. This includes the photo taken when food is delivered to a room. A photo on an issue that is still open is kept until the issue is closed. The check stays and says a photo was taken. Photos on a restaurant's menu are kept until the restaurant changes them |
| A customer's other records (checks, issues, reports) | For as long as the customer uses Spotless, unless the customer deletes them sooner. When a customer leaves, we delete their data within [[60]] days after their export window |
| A person who leaves a customer | Signed out at once. After a grace period (30 days unless the customer chooses otherwise), their name, phone number and PIN are erased. The record that the work was done stays, linked to an anonymous ID, because the record would be worthless without it |
| Message text sent on Telegram, WhatsApp or email | 30 days in Spotless; the record that a message was sent stays |
| Diagnostics | 30 days; a pilot's detailed log until the pilot ends |
| Problem report screenshots | 90 days after the report is closed |
| What a guest wrote, their photo and contact details | 30 days after the issue they reported is closed; the issue itself stays |
| Server logs | 30 days |
| Backups of the database | 30 days, so anything deleted is gone from backups 30 days later |
| Emails to us | As long as needed to deal with them, then [[2 years]] |
12. Security
Data is encrypted in transit (HTTPS) and at rest. Each customer's data is kept apart by the database itself, so one customer's account cannot read another's. Photos are private. Passwords and PINs are stored only as one-way hashes. Spotless staff who support a customer can see that customer's account only when an owner of that account allows it, read-only, for a limited time, and every such access is shown to the customer's owners. No system is perfectly secure; if a breach affects personal data, we will tell the customer without undue delay so they can meet their own obligations, and we will meet ours.
13. Your rights
Under the DPDP Act you can ask to see a summary of your personal data and how it is processed, correct or update it, erase it, nominate someone to act for you, and have a grievance resolved. If you are not satisfied, you may complain to the Data Protection Board of India.
- If you work at a property that uses Spotless: ask your employer, who controls your data in Spotless. You can also write to us and we will pass your request to them and help them answer it.
- For data we hold as Data Fiduciary: write to [[privacy contact]].
Deleting your account
Staff and managers' accounts are created and removed by the employer. To have yours removed, ask your employer, or email [[support@spotlessplatform.com]] with your name, the property and your phone number or email, and we will pass it to them and confirm when it is done. Removal signs you out at once and erases your name, phone number, email and PIN after the grace period described in section 11; the record of work done stays, without who did it.
14. Children
Spotless is for workplaces and is not meant for anyone under 18. We do not knowingly collect children's personal data. A guest under 18 should not send contact details in a problem report.
15. Cookies
The Spotless website uses only cookies it needs to work: to keep you signed in, to remember the property you last opened, and to remember light or dark mode. There are no analytics or advertising cookies. The public site at spotlessplatform.com sets no cookies.
16. Changes to this policy
We will post any change here with a new date and version. If a change materially affects how we handle personal data, we will tell our customers before it takes effect [[at least 30 days before]], and, where the law requires it, ask for consent again.
17. Contact
[[privacy contact email]] · [[postal address]] · Grievance Officer: [[name]]