Privacy Policy

1. Who we are and scope

This policy describes how CleanerFlow Academy handles personal data in the app and learning services. It applies to accounts created by email/password or Google sign-in. We voluntarily grant the rights of U.S. privacy laws (California CCPA/CPRA and similar state laws) to all users, regardless of state.

2. Age (18+) and children

The platform is intended only for people 18 and older. We do not knowingly collect data from children under 13 (COPPA); if we identify any, we delete it. We do not target the service to minors.

3. What data we collect, source, and purpose

Identifiers: email (required), display name (optional), password (hashed) or Google identifier. Approximate location: U.S. ZIP code (optional, for relevance only — not used for ads). Preferences: language and email preferences. Usage and learning data: lessons completed, your answers, certificate and badges (private). Audio/visual (sensitive): optional Practical Proof photos (see Section 8). Phone (optional): if you add a number in settings or claim the CleanerFlow Leads benefit, we store the number and a hashed version, used to confirm by SMS, unlock the benefit, and prevent duplicates — never for ads or marketing. We collect this directly from you (or from Google, if you use its sign-in).

We do NOT collect: SSN, government ID, immigration status, financial data (until payments are eventually activated), precise GPS location, biometric identifiers, or data revealing race, ethnicity, or health.

4. How we use data

We use data to: create, maintain, and secure your account; deliver content in your language; issue private certificate and badges; track progress; send service messages and, with your consent, preference-based emails (with unsubscribe at any time); maintain security and prevent fraud; and comply with the law. We do NOT build advertising profiles, do NOT sell data, and do NOT use Practical Proof photos for marketing or AI training without separate opt-in consent.

5. We do not sell or share for ads

We do not sell your personal information and do not share it for cross-context behavioral advertising, as defined by the CCPA and state laws. Because we do not do this, there is nothing to “opt out” of, but we honor requests and browser opt-out signals (such as Global Privacy Control) should this ever change.

6. Service providers (subprocessors)

We use trusted providers who process data only on our instructions and under contract, without selling it: hosting and database (Supabase), web hosting/CDN (Vercel, Cloudflare), transactional email (Amazon SES), authentication (Google), and, if/when payments exist, payment processing (Stripe). Data may be processed in the United States. A current list of subprocessors is available on request.

7. Your privacy rights

We grant all users: the right to know/access data; to correct; to delete; to port (receive a copy); to opt out of sale/sharing (not applicable, since we do neither); to limit the use of sensitive data; and to be free from discrimination for exercising rights. Many of these are already available in the app (edit profile, change language/preferences, delete account).

To exercise a right, email privacy@cleanerflowacademy.com. We may verify your identity and respond within 45 days (extendable as allowed by law). Authorized-agent requests and appeals are accepted at the same contact.

8. Photos and sensitive data: Practical Proof

Practical Proof photos are 100% optional and default OFF (opt-in only). They are stored privately on the server, never public, and visible only to you and the review team. Metadata (GPS, device, date) is stripped on the server at upload. They are never used for marketing or AI training without a separate, revocable opt-in consent. You can delete your photos at any time.

9. Cookies, analytics, and tracking

We use strictly necessary cookies (session/authentication) and preference cookies (language). We do NOT use ad pixels, third-party trackers, or cross-site behavioral tracking. If we use any analytics, it respects privacy and is never for advertising.

10. Data retention

We keep data only as long as needed to provide the service and meet legal obligations. Account and learning data are kept while the account is active; photos are kept until you delete them or close the account; after an account-deletion request, we remove data within 30 days, with backups purged on a rolling cycle.

11. Security

We adopt reasonable technical and administrative measures: encryption in transit and at rest, hashed passwords, access controls, row-level isolation (RLS), and photo metadata stripping. No system is 100% secure; in case of an incident, we will notify affected people and authorities as required by applicable law.

12. International users, changes, and contact

Data is processed in the United States; by using the service outside the U.S., you consent to this processing. We may update this policy; material changes will be communicated (in-app notice or email) and the date at the top updated. Continued use after the effective date means acceptance. Privacy questions and requests: privacy@cleanerflowacademy.com. This policy is not legal advice and is subject to attorney review.