Privacy Policy

Ivory & Cotswold Care Group LTD, trading as Ivory & Cotswold Co. ("we", "us", "our"), is a company registered in England and Wales, company number 17278427. We provide cleaning, linen and property care services across The Cotswolds, Worcestershire and the wider South West. We are the data controller responsible for your personal data.

Contact: hello@ivorycotswold.co.uk · Telephone 01452 905164 · Emergency line +44 7346 816674 · Mobile +44 7462 148679. Data protection enquiries should be marked for the attention of the Data Protection lead.

• Identity & contact data — name, email, telephone number, property address and access instructions.
• Booking data — service requested, property details, preferred date and time, and any message or notes you send us.
• Payment data — amount, invoice reference and payment status. Card details are entered on Stripe's secure checkout; we never receive or store your full card number.
• Service records — completed task checklists, cleaner notes and, where relevant to the work, before/after photographs of the areas cleaned.
• Ivy website chat data — the messages you exchange with Ivy, the page where the chat began and any name, email address or telephone number you choose to provide.
• Technical data — IP address, browser type and basic usage logs (strictly necessary cookies and server logs).

If you work for us or apply to, we also process your work email, telephone number, sign-in records, working hours, shift clock-in and clock-out times, and — while you are clocked on to a job — your device's approximate location, so we can confirm attendance, calculate pay and close shifts you forget to end. Location is used only during an active shift and is not tracked at any other time. The lawful basis is performance of your contract with us and our legitimate interests in running a safe, accountable service.

• To respond to your enquiry and provide a quote — steps taken at your request prior to entering a contract (UK GDPR Art. 6(1)(b)).
• To deliver and administer the service you book — performance of a contract (Art. 6(1)(b)).
• To take payment and issue invoices — performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
• To send service-related emails and messages (confirmations, agreements, reminders) — performance of a contract and our legitimate interests (Art. 6(1)(b) and (f)).
• To operate Ivy and answer website enquiries — steps taken at your request before a contract and our legitimate interests in responding efficiently, keeping a record of enquiries and arranging human follow-up (Art. 6(1)(b) and (f)).
• Optional analytics and marketing measurement — your consent (Art. 6(1)(a)), which you may withdraw at any time via Cookie settings.
• To meet legal, accounting and tax obligations — legal obligation (Art. 6(1)(c)).

We do not send marketing emails without your separate opt-in and we never sell your data.

Ivy is an automated, AI-powered assistant. Her replies are generated automatically and are not reviewed by a person before you see them. Ivy may identify when an enquiry needs a person and alert our office, but she does not make binding decisions about you. Prices are estimated guides only; a member of our office team confirms every quote and booking.

We record the conversation so we can answer your enquiry, provide continuity if a person takes over and deal with any query about the advice given. Providing your name, email or phone number is optional unless you ask us to contact you. Please do not share payment card details, health information or other sensitive personal information in the chat.

We only share personal data with trusted processors that help us run the business, each bound by written data-processing terms:

• Lovable Cloud — secure database, private file storage, authentication and website hosting.
• Lovable AI Gateway and its AI model providers — processes the recent messages needed to generate Ivy's reply. We instruct the gateway not to store the AI request.
• Stripe — card payment processing (Stripe is a controller in its own right for fraud prevention; see stripe.com/privacy).
• Resend — transactional email delivery.
• Google Firebase Cloud Messaging — push alerts to our cleaners' devices (staff data only).
• Google Workspace — internal booking and lead records.
• Cloudflare — website delivery and security.
• WhatsApp / Meta — only where you choose to message us on WhatsApp.
• Our vetted cleaners and drivers, who receive only the details needed to carry out your visit.

We may also disclose data where required by law, or to our accountants, insurers or legal advisers. Some providers, including the providers supporting Ivy, may process data outside the UK. Where they do, we use a UK adequacy regulation or contractual safeguards permitted under UK GDPR, such as the UK International Data Transfer Agreement or the UK Addendum to Standard Contractual Clauses. You may contact us for more information about the safeguards relevant to your data.

• Ivy chats and enquiries that do not become bookings: 12 months from the last message, then automatically deleted.
• Customer, invoice and payment records: 6 years from the end of the relevant financial year, where required for tax and accounting.
• Job photographs: 12 months, unless they are needed for an open complaint, payment dispute or legal claim.
• Email copies: full message content for 30 days, then delivery information and subject only where needed for the customer record.
• Staff hours and pay records: 6 years. Sign-in attempt logs: 12 months.

You may ask us to delete data sooner where no legal or contractual reason requires us to keep it.

You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time where processing is based on consent.

To exercise any right, email hello@ivorycotswold.co.uk. We respond within one month, free of charge.

You also have the right to complain to the UK Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113.

We use HTTPS/TLS in transit, encryption at rest with our hosting providers, row-level database access controls, private storage for job photographs, role-based access and the principle of least privilege. Access is removed immediately when a member of staff leaves. No system is 100% secure, but we take reasonable steps to protect your information and will notify you and the ICO of a qualifying breach without undue delay.

Our services and Ivy are intended for adults arranging property services. We do not knowingly collect children's data. A child should not use Ivy or provide contact details through the chat.

See our Cookie Policy for full details. We only set cookies and local storage that are strictly necessary for the website, bookings and payments to function — no advertising or analytics cookies are set without your consent, and you can withdraw consent at any time via Cookie settings in the footer.

We may update this policy from time to time. The "last updated" date at the top will always reflect the current version, and we will tell you directly about any change that materially affects your rights.