Privacy Policy

1. Who we are and how to reach us

Turnkeep is a turnover coordination platform for short-term rental hosts and the cleaners and cleaning companies they work with. Turnkeep is operated from California, United States, and is the controller of the personal information described in this policy.

For any privacy question or request, whether access, correction, deletion, or a complaint, email help@turnkeep.app. We answer every request within 30 days, and we will tell you if we need longer for a complex request.

This policy applies to the Turnkeep website and app at turnkeep.app. It does not cover third-party sites we link to, such as Airbnb or your email provider.

2. What we collect

Account information. Your name, email address, and password (stored only as a secure one-way hash, which we never see). Your role: host, cleaner, or cleaning company administrator. A record of which version of these documents you accepted and when.

Property information. Hosts add properties, including name, address, check-out and check-in times, the areas within each property, reference photos showing the expected standard, checklist tasks, periodic task rules, and access notes, meaning practical entry details such as lockbox locations, key instructions, or alarm codes.

Turnover and job information. Scheduled turnovers, which cleaner or company is assigned, start and completion times, per-task completion, and the completion photos a cleaner uploads for each area.

Issue reports and inventory. Problems a cleaner reports during a turnover, including a description, severity, and any photos attached, plus inventory and supply photos where a host uses that feature.

Invitations and working connections. When a host invites a cleaner, we store the cleaner's name and email address so the invitation can be delivered and accepted, and we record the resulting connection. The same applies to connections between hosts and cleaning companies, and between companies and their cleaners.

Invoices. Where a cleaner or cleaning company raises an invoice to a host through Turnkeep, we store the amount, the jobs covered, the status, and a full history of any change to it, including who made the change and when.

Calendar connections. If you connect an Airbnb or VRBO calendar, we store the calendar URL you provide and the booking check-out and check-in dates it contains. We do not receive guest names, contact details, or payment information from those calendars.

Technical information. When you use Turnkeep we automatically receive your IP address, browser and device type, and the pages you visit, together with sign-in and security logs. We also use Google Analytics to measure aggregate usage (see section 6).

We do not collect payment card details, we do not use tracking for advertising, and we do not buy personal information about you from anyone else.

3. Why we use it, and our legal basis

Everything we collect is used to operate the service. Where the GDPR applies to you, the legal basis is shown in brackets.

• To create and run your account, show you the right workspace for your role, and keep you signed in. [Performance of our contract with you]

• To let hosts document turnover standards, and let the cleaners and companies they invite see exactly what is expected at each property, including access notes, so an assigned cleaner can get in and do the job. [Performance of our contract]

• To schedule turnovers, record their completion, handle issue reports, and keep a reliable record of what was done and when. [Performance of our contract]

• To deliver invitation emails, password resets, and other messages necessary to operate the service. [Performance of our contract]

• To record and display invoices between hosts and cleaners or companies, with an audit trail of changes. [Performance of our contract; legal obligation for accounting records]

• To sync the calendars you choose to connect and create turnovers automatically from them. [Performance of our contract]

• To compare a completion photo against a reference photo using AI, as an advisory aid for the host. [Legitimate interests: helping hosts review work efficiently; this never blocks a job and is visible only to the host]

• To keep the service secure, prevent abuse, diagnose faults, and understand aggregate usage so we can improve it. [Legitimate interests]

• To record your acceptance of these documents so we can show which version you agreed to, and ask you to re-consent when they change. [Legal obligation and legitimate interests]

• To comply with law, respond to lawful requests, and establish or defend legal claims. [Legal obligation; legitimate interests]

Where we rely on legitimate interests, we have considered the impact on you and limited what we do accordingly. You can object at any time by emailing help@turnkeep.app.

4. AI photo comparison

When a cleaner uploads a completion photo, we can compare it against the property's reference photo for that area using an AI image comparison feature. The comparison is processed through Lovable's AI gateway, which uses Google's Gemini model. Both photos are sent for that single comparison and are not made publicly accessible.

The result is advisory only. It never blocks, delays, or reverses a turnover being marked complete, and it is not a judgement of the cleaner's work. The host always makes the final call.

Only the property's host can see the result of a comparison. The cleaner who uploaded the photo cannot see it, and no other host, cleaner, or company can.

Your photos are not used to train Turnkeep's, Lovable's, or Google's models. We have opted out of platform-level model training, and the AI gateway is configured so that submissions are used only to return the comparison result.

If you would prefer no AI comparison to run on photos at your properties, email help@turnkeep.app and we will disable the feature for your account.

5. Sign in with Google

If you choose to sign in with Google instead of an email and password, Google shares with us your name, email address, and basic profile information from your Google account.

We use this information solely to create and authenticate your Turnkeep account, which is exactly the same purpose as signing up with an email and password, and nothing more.

This information is not shared with or transferred to any third party beyond what is already described in this policy. It is not used for advertising, it is not sold, and it is not used to train any AI or machine-learning model.

It is protected by the same security measures described in section 10, and the deletion process in section 9 applies to it in the same way: deleting your Turnkeep account deletes it.

If you originally created your account with an email and password and later sign in with Google using the same email address, both sign-in methods lead to the same single account.

6. Cookies and analytics

Essential storage. Turnkeep stores your sign-in session in your browser so you stay signed in and so the service can verify who you are on each request. This is required for the service to function and cannot be turned off while you are using it. Signing out clears it.

Analytics. We use Google Analytics to understand aggregate usage, such as which pages are visited, on what kind of device, and where errors occur. We do not use it to build advertising profiles, and we do not combine it with your property or photo data.

You can opt out of Google Analytics in any browser using Google's official opt-out add-on, or by using your browser's tracking protection. Turnkeep works normally either way.

We do not use advertising cookies, retargeting pixels, or third-party social tracking.

7. Who can see what

Hosts. A host can see their own account, their own properties and everything attached to them, the turnovers, photos, issues and invoices relating to those properties, and the cleaners and companies they are connected to. A host cannot see other hosts' data.

Cleaners. A cleaner can see the properties, reference photos, checklists and access details for the jobs they have been assigned and accepted, and nothing else. Access notes are available only while there is an active job at that property. A cleaner cannot see other hosts' properties, other cleaners, or the AI comparison results.

Cleaning companies. A company administrator can see the jobs hosts have sent to their company, the cleaners on their own roster, and their own invoices. They cannot see hosts' other properties or other companies' data.

Turnkeep staff. Only the small number of people needed to operate and support the service can access production systems, and only for that purpose.

These boundaries are enforced by the database itself on every single request, not just by what the screen shows.

8. Service providers and sharing

We never sell your personal information, we never share it for cross-context behavioural advertising, and we never pass it to anyone for their own marketing. We share it only with the providers that make the service work, each acting on our instructions under a contract:

• Hosting, database, authentication and file storage: the infrastructure that runs Turnkeep and stores your data.

• Email delivery: to send invitations, password resets and service notices.

• AI photo comparison: Lovable's AI gateway, using Google's Gemini model, for the single comparison described in section 4.

• Address lookup: Google Maps Platform, to turn what you type into a validated property address. Requests are made by our server, not your browser.

• Analytics: Google Analytics, as described in section 6.

We may also disclose information where the law requires it, to enforce our Terms of Service, or to protect the rights, property or safety of our users or the public. If Turnkeep is ever involved in a merger, acquisition or sale of assets, we will tell you before your information becomes subject to a different privacy policy.

9. Where your data is held, and how long we keep it

International transfers. Turnkeep is operated from the United States and your information is stored and processed there. If you are in the EU, the UK, or Switzerland, this means your data is transferred outside your country. We rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) with our providers, together with the security measures in section 10, to protect it. You can request more detail at help@turnkeep.app.

While your account is active. We keep your information for as long as your account exists, so the service can work: a property's photos and checklists stay available to the cleaners connected to it, and completed turnovers stay in your history as a record of the work.

Deletion. You can ask us to delete your account at any time by emailing help@turnkeep.app. Access ends immediately, and we permanently erase your data within 30 days of the request. For a host, that removes their properties, reference photos, checklists, task rules, access notes, turnovers, completion photos and issue reports. For a cleaner or company, it removes their profile and every connection, and the photos they uploaded remain with the host's property records as the record of work performed.

What we keep longer, and why. Invoice and transaction records are kept for up to seven years where accounting and tax law requires it. Policy acceptance records are kept for the life of the account plus two years, so we can show what you agreed to. Security and abuse-prevention logs are kept for up to 12 months. Nothing in this paragraph is used to contact you or to rebuild your account.

Unaccepted invitations expire automatically and are deleted after they lapse.

10. How we protect your information

We treat access notes (lockbox codes, alarm codes, entry instructions) as the most sensitive thing on the platform, and the service is built around limiting who can reach them.

• Access notes are encrypted at rest in a separate managed secrets store, not held as plain text alongside the rest of the property record.

• A cleaner can retrieve them only while they have an active, accepted job at that property, and every retrieval goes through a checked server routine.

• Every table enforces row-level access rules, so a request for data outside your role and your own records is refused by the database itself.

• All traffic is encrypted in transit. Passwords are stored only as salted one-way hashes. Changing your password signs out all other sessions.

• Photos are never publicly linkable; they are served only through the app to a signed-in user who is entitled to see them, and uploads are validated by file content, not just file name.

• Staff access to production systems is limited to those who need it to operate and support the service.

No online service can promise absolute security, but we design Turnkeep so that a mistake or misuse by one user exposes as little as possible. If a breach affects your personal information, we will notify you and the relevant regulator as required by law, without undue delay.

11. Your rights

Wherever you live, you can ask us to: give you a copy of the personal information we hold about you; correct anything that is wrong; delete your account and data; export your data in a portable format; stop or limit a particular use; or withdraw a consent you previously gave. Email help@turnkeep.app and we will respond within 30 days. We will never charge you or degrade your service for exercising a right.

When you are signed in you can also download a copy of your data yourself at any time. Open Your account from the menu and choose Download my data. The file is generated for your account only and downloads directly to your device.

If you are in the EU, the UK, or Switzerland (GDPR/UK GDPR), you also have the right to object to processing based on our legitimate interests, the right to restrict processing while a dispute is resolved, and the right to lodge a complaint with your local data protection authority. We do not make any decision about you that produces a legal or similarly significant effect based solely on automated processing. The AI photo comparison is advisory and always reviewed by a person.

If you are a California resident (CCPA/CPRA), you have the right to know the categories and specific pieces of personal information we collect, use and disclose; the right to delete it; the right to correct it; and the right to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for any purpose other than providing the service. You may use an authorised agent to make a request on your behalf; we will ask for proof of their authority. You may also complain to the California Attorney General or the California Privacy Protection Agency.

To protect you, we verify requests against the account they concern, usually by confirming control of the account's email address.

12. Children

Turnkeep is a tool for working adults and is not directed at children. You must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 18, and if we learn that we have, we delete it promptly. If you believe a child has given us information, email help@turnkeep.app.

13. Changes to this policy

If we change this policy we publish a new version with a new version tag and effective date at the top of this page.

For any material change, existing accounts are asked to review and accept the new version before continuing to use Turnkeep, and each acceptance is recorded with a timestamp so there is a clear, append-only history of what each account agreed to and when. Previous acceptances are never altered or deleted.

14. Contact

This policy is issued by Turnkeep, California, United States. Privacy questions, data requests and complaints all go to help@turnkeep.app, and we respond within 30 days.