Cookie Policy

Cookie Policy

Version dated 24 September 2026

1. Who we are and what this policy covers

The StayClean website and application are published by StayClean Global Services OÜ, a company incorporated under Estonian law and registered under number 17490333. Its registered office is at Tornimäe tn 5, 10145 Tallinn, Estonia.

This policy explains which cookies and other trackers are stored on, or read from, your device when you use:

• the website www.stayclean.io;

• the web application app.stayclean.io.

In this policy, "tracker" means cookies, but also browser local storage, pixels and mobile SDK identifiers.

This policy supplements our Personal Data Protection Policy, which describes all the processing of personal data we carry out.

2. In short

• We do not use any advertising cookies, audience measurement cookies or social media trackers.

• The only trackers we use are strictly necessary for the service you request: your session, your login, form security, your language choice and payment security.

• Under European rules, these trackers do not require consent: Article 5(3) of Directive 2002/58/EC on privacy and electronic communications, as transposed in each Member State. This is why no cookie banner is shown to you.

• If this changes, we will ask for your consent before placing any such tracker, and refusing will be as easy as accepting (see section 5).

3. Tracker inventory

Below is the full list of trackers stored on, or read from, your device. We update it whenever a technical change affects it.

PHPSESSID

• Provider and domain: StayClean, .stayclean.io (website and application)

• Purpose: maintaining your session, including your chosen language, form security and your login to your account

• Duration: 6 months

• Category: strictly necessary

__stripe_mid

• Provider and domain: Stripe, set by the payment module integrated into app.stayclean.io

• Purpose: preventing fraud during payment

• Duration: 1 year

• Category: strictly necessary

__stripe_sid

• Provider and domain: Stripe, set by the payment module integrated into app.stayclean.io

• Purpose: preventing fraud during payment

• Duration: 30 minutes

• Category: strictly necessary

These trackers are never used for advertising or profiling. Where some of our service providers transfer data outside the European Economic Area, those transfers are described in our Personal Data Protection Policy.

4. Third-party resources and external services

4.1 Libraries loaded from content delivery networks. Some pages of the website load icons and style sheets from jsDelivr (cdn.jsdelivr.net) and unpkg (unpkg.com). These services do not place any cookies. However, like any web server, they receive your IP address and your browser's characteristics in order to deliver these files to you.

4.2 Booking a demo. The "Book a demo" button redirects you to a booking page hosted by Cal.com (cal.com). At that point you leave our website, and any cookies Cal.com may place are governed by its own policy, which we invite you to read. The information you enter to book a slot is sent to us and processed in accordance with our Personal Data Protection Policy.

4.3 Payment. When you pay for a subscription, the payment form is provided by Stripe. Stripe's trackers are used solely to prevent fraud (see section 3).

5. If we add trackers that require consent

Should we ever use an audience measurement or marketing tool, we commit to the following rules:

• Prior consent. No tracker requiring consent will be stored or read before you have made your choice. A banner will present "Accept all" and "Reject all" buttons at the same level, along with a choice for each purpose.

• Your choice is respected. Continuing to browse or closing the banner will not count as consent. If you refuse, you will keep access to the service.

• Withdrawal at any time. A "Manage cookies" link in the footer will let you change your mind as easily as you made your choice.

• How long we keep your choice. We will keep your acceptance or refusal for 6 months, then ask you again.

• Exempt audience measurement. An audience measurement tool will only be exempt from consent if it meets all the conditions set by the competent supervisory authority: it must be used solely to measure traffic on our website, its data must not be combined with other processing or passed on to third parties, and its retention periods must be limited. In France, for example, these periods are no more than 13 months for the tracker and 25 months for the data.

• Updates. We will add any new tracker to the inventory in section 3 before activating it.

6. Configuring your browser

Your browser settings let you view, delete or block cookies. Instructions are available in your browser's help section (Chrome, Firefox, Safari, Edge or other).

Because our trackers are strictly necessary, blocking them may prevent you from logging in to your account, submitting a form or paying online.

7. Your rights, contact and complaints

Contact. For any question about cookies or your data, write to us at privacy@stayclean.io. We respond within one month. If your request is complex, or if we receive a large number of requests, this period may be extended by two further months; in that case we will inform you within the first month.

Your rights. You have, in particular, the rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw your consent at any time. Details of these rights and how to exercise them are set out in our Personal Data Protection Policy.

Complaints. If you believe your rights have not been respected, you may lodge a complaint with a supervisory authority, in particular in the country where you habitually reside, where you work or where the alleged infringement took place.

For cookies and other trackers, the competent authority is in principle the one in the country where the device concerned (computer, phone or tablet) is located. Depending on the country, this is either the data protection authority or another body, such as the electronic communications regulator.

The list of competent authorities and their contact details, country by country, is set out in our Personal Data Protection Policy. You may also write to us first at privacy@stayclean.io, and we will do our best to resolve your request directly.

Updates. We update this policy as soon as a tracker is added, changed or removed. The date of the latest version appears at the top of this document. An update never constitutes consent to a new purpose.

References: Article 5(3) of Directive 2002/58/EC; Articles 12 to 22 and 77 of Regulation (EU) 2016/679 (GDPR); national transposing provisions applicable in your country.

Version dated 16 September 2026.

1. Publisher, purpose and scope

This policy governs cookies and similar technologies on StayClean websites, applications and interfaces. The publisher is StayClean Global Services OÜ, an Estonian company registered under number 17490333, with its registered office at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia. Contact: william.rudent@stayclean.io.

It supplements the privacy policy. Acceptance of this document is not a basis for indiscriminately placing trackers. Each technology must be assessed according to its actual function, the information involved and the rules applicable to the user's device.

2. Technologies covered

A cookie is a file or identifier stored on, or read from, a device. Depending on their operation, local storage, session storage, pixels, tags, advertising identifiers, mobile SDKs, individualised links and fingerprinting techniques are also covered.

A technology remains subject to the relevant rules even if it does not use the word “cookie”, contains no directly identifying name or subsequently forwards events between servers. A pseudonymous identifier may be personal data where it enables an individual or device to be distinguished or linked.

3. Classification by purpose

Classification depends on actual purpose: essential operation, optional preferences, audience measurement or marketing. A technical provider, short lifespan or economic interest does not automatically make a tracker necessary.

This policy describes permitted categories and their activation conditions; it does not mean all categories are currently present on every page. A tool serving multiple purposes must be configured to respect the conditions for each. Optional tracking must not be concealed inside a security feature.

4. Strictly necessary technologies

Where genuinely essential to a service expressly requested, this category may include maintaining an authenticated session, preventing fraudulent requests, preserving a checkout process, necessary technical load balancing or remembering tracking choices.

An exemption from consent for storage or access does not remove transparency, minimisation, security or legal-basis requirements for associated personal-data processing. These tools must not be repurposed for advertising targeting or behavioural analysis without meeting the corresponding conditions.

5. Optional preferences and personalisation

Features may remember a language, display setting or interface preference. Classification depends on context: a preference needed to fulfil an explicit request is not equivalent to marketing personalisation or persistent recognition across services.

Where consent is required, these features remain disabled before a positive choice. Refusal must not remove essential functions that can operate without that personalisation. Users retain the ability to change their choice.

6. Audience measurement and usage analysis

Measurement tools, if deployed, may help understand traffic, errors or feature usage. They do not enjoy a blanket exemption merely because they improve the product or present aggregated results.

An exemption may be used only if all applicable local conditions are actually met, including limited purposes, tracking scope, recipients and duration. Otherwise, storage, access and events requiring consent remain blocked before authorisation. Anonymising information after collection does not cure unlawful collection.

7. Marketing, attribution and advertising

Conversion pixels, advertising identifiers, remarketing audiences and cross-site matching, where used, are optional and require the appropriate choices before activation. Subscribing to a newsletter or accepting a commercial contract does not constitute consent to these activities.

The entities involved and their purposes must be identified before the choice. No general consent to unidentified partners may be inferred from browsing. Rejecting marketing does not invalidate an already valid booking, cleaning job or subscription.

8. Third-party services and embedded content

Maps, videos, messaging, external sign-in, payment services and other modules may communicate with third-party domains. Their loading must be assessed before deployment. Where it involves optional tracking, the module must remain blocked or use a genuinely exempt mode until the relevant consent is obtained.

A third party's own policy does not discharge StayClean's obligations concerning the integration it chooses. Conversely, processing following a deliberate visit to a separate service is also governed by that service's information and responsibilities.

9. Obtaining a valid choice

Consent must be freely given, specific, informed and expressed through a positive action. Pre-ticked boxes, continued browsing, closing a banner or general acceptance of terms are insufficient. Optional purposes must be capable of being accepted or refused intelligibly.

Refusal must be as accessible as acceptance, without artificially discouraging steps. The interface must permit purpose-specific selection and, where required, selection of the entities involved. No technology requiring consent may be triggered while a choice is pending.

10. Withdrawal and preference changes

A permanent, easily accessible preference control must allow users to change their decision as easily as they accepted. Requests may also be sent to the stated contact, without this channel replacing a direct interface control where one is required.

Withdrawal stops future activation based on the relevant consent. Affected trackers are removed or disabled to the extent technically controlled; instructions may be needed for storage controlled directly by a third party. Withdrawal does not affect the lawfulness of earlier processing or require deletion of the limited consent evidence legally needed.

11. Lifespans and renewal of choices

Expiry periods must be defined for each technology, disclosed before activation and limited to what is necessary. Session cookies normally end with the session; persistent storage requires an explicit duration. Technical convenience alone cannot justify a lengthy lifespan.

The reference schedule under this policy provides for remembering acceptance or refusal for six months, unless different local requirements or a relevant change justify presenting the choice again. This is not a universal lifespan for all cookies. Evidence of a choice is retained separately and proportionately to compliance-demonstration needs. A new purpose or recipient requiring consent cannot be added retrospectively.

12. Inventory and deployment controls

Before optional technologies are activated, the inventory accessible from the preference interface must specify, for each relevant tool, its name or identifier, the entity placing or operating it, domain, purpose, duration, category and useful recipient or transfer information. Mobile versions and authenticated journeys must also be examined.

This classification is not a technical inventory resulting from a browser audit and does not claim to identify unverified cookies. An uninventoried optional technology must not be activated before the necessary information and choice are provided. Changes to tags, SDKs and suppliers require configuration review.

13. Cloud, CDNs and international routing

StayClean's declared infrastructure involves AWS, Vultr, DigitalOcean and Railway depending on the component. A content delivery network or traffic-protection service may process IP addresses and connection data to route or secure a request. That does not automatically make all its identifiers necessary.

International reach, technical replication or a CDN point of presence does not remove data protection duties. Access and transfers outside the European Economic Area must be governed by the privacy policy and applicable safeguards. Consent to a cookie is not indiscriminate permission to transfer every piece of data everywhere.

14. Server logs and separate processing

Some connection information reaches servers without placing a cookie. It may be needed to deliver the page, authenticate a user or maintain security. Where personal, it remains subject to minimisation, retention limits and a suitable legal basis.

Server-side tracking must not circumvent a refusal concerning an operation that still requires consent. An event needed for invoicing must not automatically be repurposed for advertising merely because it already exists in the system.

15. Browser and device settings

Browsers generally allow certain storage to be inspected, blocked or deleted. Deletion may erase a remembered choice and lead to a new request. Blocking necessary technologies may affect authentication or a specifically requested feature; refusing only optional tools must not artificially produce that result.

Device settings, preference signals and choices made in another browser do not necessarily synchronise. Their handling must comply with applicable obligations and features actually deployed. This policy does not claim unverified universal support for every technical preference signal.

16. Rights, complaints and changes

For questions, write to william.rudent@stayclean.io. Access, correction, deletion, restriction, objection, withdrawal and complaint rights are explained in the privacy policy. Estonia's data protection authority is Andmekaitse Inspektsioon; other authorities may be competent depending on your situation.

Estonian law and applicable European rules provide the reference framework without excluding mandatory territorial requirements, particularly on consent. This policy must remain aligned with actual deployments. No update constitutes consent to a new purpose or waiver of a statutory right.