Privacy Policy

This Privacy Policy is issued by Nead, LLC, an Arkansas limited liability company doing business as DEV.co (“Nead,” “we,” “us,” or “our”). maid.co is one of our brand and marketing websites. It describes the erp.io software service for cleaning companies, which we also provide. We are the same company that operates erp.io.

Data Protection Officer. We have not appointed a Data Protection Officer. We have assessed that we are not required to under Article 37 GDPR: our core activities do not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special categories of data. Privacy matters are handled directly by our leadership team.

EU and UK representative. We have assessed that we are not currently required to appoint a representative under Article 27 GDPR or its UK equivalent, on the basis that our processing of EEA and UK personal data is occasional, does not include large-scale processing of special categories, and is unlikely to result in a high risk to individuals. If that assessment changes we will appoint a representative and publish their details here. Until then, EEA and UK individuals and supervisory authorities may contact us directly at the addresses above, and we will respond within the periods required by law.

Response times. We acknowledge privacy requests within five business days and respond substantively within the statutory period: one month under GDPR, extendable by two months for complex requests with notice; 45 days under most US state laws, extendable by a further 45 days with notice.

This distinction determines who you exercise your rights against, so it comes before everything else.

If your data is held by a cleaning company that uses our software. If you are a homeowner, tenant, or business that books cleaning, or a cleaner or other employee of a cleaning company, that company may keep information about you in erp.io: your name and contact details, your address and access instructions, notes about pets or preferences, photos and checklists from visits, invoices and payments, and, for staff, schedules and timesheets. The cleaning company decides what it collects and why. It is the controller; we process that data on its instructions and cannot lawfully act on your request without its authority.

Contact the cleaning company first. It can access, correct, export, or delete your information directly. If you contact us instead, we will promptly forward your request to that company and, unless legally prohibited, tell you we have done so. It helps if you tell us the company’s name. We will assist the company in responding as required by Article 28 GDPR and comparable US state law.

Signing up and using the software. Every “Start free trial” and “Log in” link on maid.co goes to app.erp.io. Creating an account, the free trial, billing, and all use of the software are governed by the erp.io Terms of Service and erp.io Privacy Policy, not by this policy.

This policy covers:

• the maid.co website, including its blog and its price calculator;
• contact with us by email about maid.co; and
• our business operations connected with maid.co, including vendor management.

The former maid.co cleaning service. maid.co previously operated as a house-cleaning service website. maid.co no longer provides cleaning services. If you dealt with the former service and have a question or a request about your information, write to [email protected] with “Privacy” in the subject line.

This section satisfies the notice-at-collection requirement under CCPA §1798.100(a) and comparable state law. It summarizes what we collect through maid.co, why, how long we keep it, and who we disclose it to. Detail follows in Sections 5 to 12.

What this website does not collect. Apart from the contact form, maid.co has no forms, and it has no accounts and no sign-in. It sets no cookies, runs no analytics, advertising pixels, or session recording, and loads no third-party scripts. Fonts are served from our own servers. We do not knowingly collect through this website: biometric identifiers; precise geolocation; government identification numbers; payment card numbers; financial account credentials; or special categories of data under Article 9 GDPR such as health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sexual orientation.

We do not collect or process sensitive personal information as defined by the CCPA for any purpose that would trigger a right to limit its use.

Information you provide. If you send the contact form, we receive your name, email address and message, the topic you choose, and, if you give them, your phone number, company name and team size. The form is delivered to our team by email through our transactional email provider, and we use it only to reply to you. If you email us instead, we receive your email address, your name as it appears in your email, the content of your message and any attachments, and anything else you choose to include. We keep our replies too. The contact form and email are the only ways information you provide reaches us through maid.co.

The price calculator runs locally. The calculator on maid.co runs entirely in your browser. Nothing you enter into it is transmitted to us or stored by us.

Information collected automatically. The site is hosted on our own cloud infrastructure behind a content delivery and security provider. As with any website, each request to maid.co reaches those systems with request metadata, which appears in server and security logs:

• IP address;
• browser user agent (browser type and version, operating system);
• the page or file requested, the time of the request, and the referring URL; and
• approximate location derived from IP address at country or region level, used by our security provider. We do not collect precise geolocation.

We use this information to deliver pages, keep the site running, and detect and block attacks and automated abuse. We do not use it to build profiles of visitors.

Blog content. Blog articles are served from our content management system. Reading an article does not send information about you to anyone other than our hosting and security providers.

Information from others. Where a partner, adviser, or customer introduces you to us, we receive the contact information they provide. Where a partner receives a referral fee, our partner terms require them to disclose that to you, and we will confirm it if you ask.

Records of processing. We maintain records of processing activities as required by Article 30 GDPR, covering both our controller and processor activities. These are available to a supervisory authority on request.

What we do not do:

• We do not sell personal information, and have not in the twelve months preceding the effective date.
• We do not share personal information for cross-context behavioral advertising.
• We do not use personal information collected through this website to train machine learning models.
• We do not engage in automated decision-making producing legal or similarly significant effects. See Section 19.
• We do not add you to a mailing list or a marketing sequence because you emailed us. A person reads your email and a person replies.
• We are not a data broker and are not registered as one in any state, because we do not sell data to third parties with whom the individual has no direct relationship.

We do not rely on consent for anything this website does, because it sets no cookies and runs no analytics or marketing technology.

Our legitimate interests assessment. Where we rely on legitimate interests, we have carried out a balancing assessment considering the purpose, necessity, and impact on you. In summary: the processing is limited to technical request data and business correspondence; where we hold correspondence, you initiated contact; the impact is minimal; and you can object at any time. A copy of the assessment is available on request. You have the right to object to processing based on legitimate interests as described in Section 15.

The maid.co website does not set cookies. It does not use local storage or similar technologies to identify you, and it does not use advertising cookies, retargeting pixels, analytics, session recording, or third-party tracking networks.

When you follow a “Start free trial” or “Log in” link you leave maid.co for app.erp.io. Cookies used there are described in the erp.io Privacy Policy.

Global Privacy Control. We honor the Global Privacy Control signal where transmitted, treating it as a valid opt-out of sale and of sharing for cross-context behavioral advertising, notwithstanding that we engage in neither. There is no common industry standard for Do Not Track browser signals, and we do not respond to them differently from GPC.

We share personal information only as described below. We do not sell, rent, or trade it.

• Service providers. Vendors processing on our behalf under written contracts restricting their use to providing services to us. Categories in Section 10.
• Professional advisers. Lawyers, accountants, auditors, and insurers, where reasonably necessary and subject to professional confidentiality.
• Legal requirements. Where required by law, regulation, court order, subpoena, or valid legal process, or where necessary to establish, exercise, or defend legal claims.
• Safety and enforcement. Where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Nead, our customers, or the public, including investigating fraud or security incidents.
• Corporate transactions. In a merger, acquisition, reorganization, financing, or sale of assets, personal information may transfer as a business asset. We will require the recipient to honor commitments in this policy and will notify affected individuals where required by law.
• Cleaning companies. Where you send us a request about data a cleaning company holds in erp.io, we forward it to that company as described in Section 3.
• With your direction. Where you ask us to share information with an adviser or partner you nominate.

Government and law enforcement requests. We will not disclose Customer Data to a government authority unless legally compelled. Where compelled, we will, unless legally prohibited, notify the affected customer before disclosing, give them a reasonable opportunity to seek protective relief, challenge the request where there are reasonable grounds to consider it unlawful, and disclose only the narrowest responsive set.

Each service provider is bound by a written agreement requiring appropriate security, restricting use to providing services to us, and, where the GDPR applies, meeting Article 28 requirements. For the maid.co website we use the following categories:

The erp.io service uses additional categories, including transactional email delivery, AI model providers, and payment processing. Named subprocessors used in providing the service, with processing locations, are maintained at erp.io/trust/subprocessors. Customers receive 30 days’ notice of changes and may object as set out in the Data Processing Addendum.

We are based in the United States and our infrastructure is primarily located there. If you are outside the United States, information you provide or that is logged when you visit will be transferred to, stored in, and processed in the United States, which may not provide the same level of protection as your home jurisdiction. Our content delivery and security provider may process request metadata at locations near you in order to serve the site.

Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on:

• the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum where the UK GDPR applies, and the Swiss adaptations where Swiss law applies;
• supplementary technical and organizational measures including encryption in transit and at rest and access controls; and
• the government-request commitments in Section 9.

We have conducted a transfer impact assessment. A copy, and copies of the safeguards we rely on, are available by writing to [email protected]. We may redact commercially sensitive terms. If the SCCs or UK Addendum are invalidated or become insufficient, we will implement an alternative lawful mechanism without undue delay.

Retention of Customer Data is governed by the customer agreement and the erp.io Terms of Service: deleted from live systems within 30 days of termination and from backups within 90 days, with written confirmation of dates on request.

Where we are subject to a legal hold, we retain relevant information for the duration of the hold notwithstanding the periods above, and process it only for the purpose requiring retention.

We maintain technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. The measures that protect Customer Data are described in full in Annex II of the Data Processing Addendum. For the maid.co website, they include:

• encryption in transit using TLS 1.2 or higher, and encryption at rest;
• a content delivery and security layer providing DDoS protection and a web application firewall;
• role-based, least-privilege access for our personnel;
• network segmentation, logging, and anomaly monitoring; and
• security assessment of vendors before engagement.

Because the website has no accounts or databases of visitor information, and contact-form messages are delivered by email rather than stored on the website, the personal information exposed through it is limited to request metadata. The contact form is protected by rate limiting and automated-abuse checks. No system is completely secure and we do not claim otherwise. Our certification status for the erp.io service, including the certifications we do not hold, is published at erp.io/trust/compliance.

If we become aware of a personal data breach, we will act as follows.

Notification will describe the nature of the breach, categories and approximate numbers affected, likely consequences, measures taken and proposed, and a point of contact. Where full information is not immediately available we provide it in phases rather than delaying the initial notification. We will not delay notification in order to determine fault, and notification is not an acknowledgement of liability.

Reporting a vulnerability. Write to [email protected] with “Security” in the subject line. We acknowledge within one business day and will not pursue legal action against good-faith research conducted within the bounds set out in our Acceptable Use Policy.

If you are in the EEA, UK, or Switzerland, you have the following rights in respect of personal data for which we are the controller:

• Access. Confirmation of whether we process your data and a copy of it, with information about the processing.
• Rectification. Correction of inaccurate data and completion of incomplete data.
• Erasure. Deletion where a ground in Article 17 applies.
• Restriction. Restriction of processing in the circumstances in Article 18.
• Portability. Data you provided, in a structured, commonly used, machine-readable format, and transmission to another controller where technically feasible.
• Objection. To processing based on legitimate interests, and at any time to direct marketing.
• Withdrawal of consent. At any time, without affecting the lawfulness of prior processing, where we rely on consent.
• Rights relating to automated decisions. See Section 19.
• Complaint. To a supervisory authority in your country of residence, place of work, or the place of an alleged infringement.

Exercising these rights. Write to [email protected] with “Privacy” in the subject line. For data a cleaning company holds about you in erp.io, see Section 3. We may ask for information to verify your identity, using data already in our possession where possible, typically confirming control of the email address on the record. We will not request government identification unless the sensitivity of the request requires it. Server logs are not linked to names, so for log data we may ask for the IP address and approximate time of your visit.

We respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies and why. There is no charge unless a request is manifestly unfounded or excessive, in which case we will explain the charge before proceeding.

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, and other states with comparable laws as they take effect have the rights below.

• Right to know or access. The categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties to whom it was disclosed.
• Right to delete. Deletion of personal information we collected from you, subject to statutory exceptions.
• Right to correct. Correction of inaccurate personal information.
• Right to data portability. A copy in a portable, readily usable format.
• Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We honor GPC signals regardless.
• Right to opt out of targeted advertising. We do not engage in targeted advertising.
• Right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. We do not conduct such profiling. See Section 19.
• Right to limit use of sensitive personal information. We do not collect or use sensitive personal information for purposes triggering this right.
• Right to non-discrimination. We will not deny services, charge different prices, or provide a different quality of service because you exercised a privacy right.
• Right to appeal. Where your state provides it, you may appeal a refusal. See below.

Verification and authorized agents. We verify identity using information already in our possession, typically by confirming control of the email address associated with the record. For requests involving deletion or specific pieces of information we may require additional confirmation proportionate to the sensitivity. An authorized agent may submit a request with written authorization signed by you. We may contact you directly to confirm the authorization and the request, unless the agent provides a valid power of attorney.

Appeals. If we decline a request, you may appeal by writing to [email protected] with “Privacy Appeal” in the subject line. We will respond within the statutory period, 45 days in most states, with a written explanation. If we deny the appeal, we will tell you how to contact your state attorney general.

Categories collected through maid.co in the preceding 12 months. Identifiers; internet or network activity; and professional or employment-related information where included in the contact form or an email to us. We have not collected biometric information, precise geolocation, or sensitive personal information through this website. We have not sold or shared any category.

Shine the Light (Civil Code §1798.83). California residents may request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes, and have not in the preceding calendar year. To make a request anyway, write to [email protected] with “Shine the Light” in the subject line. We will respond within 30 days.

Financial incentives (§1798.125(b)). We do not offer financial incentives, price differences, or service-level differences in exchange for the retention or sale of personal information. There is no loyalty program, no discount for providing data, and no premium charged for exercising a privacy right.

Notice of right to opt out. Because we do not sell or share personal information, we are not required to and do not provide a “Do Not Sell or Share My Personal Information” link. If that ever changes, the link will appear on this page and in the site footer before any such processing begins.

Minors under 16. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age, and we do not knowingly collect information from anyone under 16.

Data broker registration. We are not a data broker under California Civil Code §1798.99.80 or comparable law in any state, and are not registered as one, because we do not knowingly collect and sell personal information about consumers with whom we have no direct relationship.

Washington My Health My Data Act. We are physically located in Washington State. We do not collect, process, or share consumer health data as defined by the Washington My Health My Data Act through this website, and it is not designed to receive it. We therefore do not maintain a separate consumer health data privacy policy. If you believe consumer health data has reached us, write to [email protected] and we will investigate and delete it.

Nevada (NRS 603A). Nevada residents may submit a verified request directing us not to sell covered information. We do not sell covered information, but you may submit a request to [email protected] and we will respond within 60 days.

Colorado, Connecticut, Virginia, and universal opt-out. We honor universal opt-out mechanisms including Global Privacy Control as required by Colorado, Connecticut, and other state law, treating them as opt-outs of sale, sharing, and targeted advertising.

Illinois and Texas biometric laws. We do not collect, capture, purchase, or otherwise obtain biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act or the Texas Capture or Use of Biometric Identifier Act through this website.

Site and Business Information. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR. We do not use automated lead scoring to decide whether to respond to you. A person reads your email and a person writes the reply.

The erp.io service. The service includes automated features that act within settings a customer configures, such as an AI receptionist that answers a cleaning company’s calls, an AI sales developer, and AI drafting of quotes and messages. Where these process personal data, the customer is the controller and its own privacy notice governs. The service is not designed to make, and must not be configured to make, decisions producing legal or similarly significant effects concerning individuals, including credit, employment, housing, insurance, or benefits decisions. The erp.io Terms and Acceptable Use Policy prohibit such use.

The maid.co website itself has no AI features and sends nothing you do on it to an AI provider. The following commitments apply to the AI features of the erp.io service, and are set out in full in the erp.io Terms and Privacy Policy.

• We do not train models on Customer Data. We do not fine-tune, train, or otherwise use Customer Data, including a cleaning company’s client records, call recordings or transcripts, and messages, to develop or improve machine learning models, whether our own or a third party’s. This is a contractual commitment in the erp.io Terms, not a policy statement we could quietly change.
• We do not train models on Site and Business Information either. Emails to us and website requests are not used for model development.
• Provider agreements prohibit training. Our agreements with AI model providers prohibit use of content submitted through our service to train their models, and provide for zero or limited retention solely for abuse monitoring.
• Content is transmitted only to generate a response for a feature the customer has enabled, and only the content that feature requires. There is no background process streaming data to a third party.
• Improvements come from elsewhere. We improve AI behavior through prompts, policies, and evaluation sets built from our own synthetic and internal test data.
• AI features can be disabled entirely at the customer’s account level, in which case no data is transmitted to a model provider and the rest of the service continues to function.

Further detail is published at erp.io/trust/ai-data, and the current model provider is listed at erp.io/trust/subprocessors.

maid.co has no newsletter or email sign-up, and sending the contact form or emailing us does not subscribe you to anything. When you contact us, we reply directly. That reply is a business communication rather than marketing and comes from a person rather than an automated sequence.

If you create an erp.io account, any product or marketing email connected with that account is governed by the erp.io Privacy Policy. We do not sell or rent contact information, or share it with partners, sponsors, or event companies.

maid.co does not advertise jobs or accept job applications. It is not a staffing or cleaner-matching service. If you are looking for work as a cleaner, contact the cleaning company you want to work for directly.

maid.co and the erp.io service are directed to businesses and are not intended for children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16. We do not operate a website or online service directed to children under 13 within the meaning of the Children’s Online Privacy Protection Act.

If you believe a child has provided us with personal information, write to [email protected] and we will delete it promptly.

maid.co links to third-party websites, including the websites of products we compare ourselves with. We do not control those sites and are not responsible for their privacy practices. This policy does not apply to them.

Where the erp.io service connects to a third-party system at a customer’s direction, such as an accounting system, payment processor, payroll provider, or calendar, that provider’s handling of information within its own system remains governed by its own terms and privacy policy.

We do not embed third-party advertising, social media tracking pixels, or session recording tools on this site.

We aim to make this policy accessible. It is structured with headings, uses tables with header cells, and is designed to work with screen readers and at increased zoom.

If you need this policy in an alternative format, or have difficulty exercising a privacy right because of a disability, write to [email protected] with “Accessibility” in the subject line. We will provide the information in an accessible format and assist with the request at no charge.

This Privacy Policy and any dispute arising out of or relating to it are governed by the laws of the State of Arkansas, without regard to its conflict of laws principles. The exclusive venue for any action arising out of or relating to this policy is the state or federal courts located in Benton County, Arkansas, and you consent to the personal jurisdiction of those courts.

Where you have accepted our Terms of Use for this website or the erp.io Terms of Service, the dispute resolution provisions in those terms, including the arbitration agreement and its 30-day opt-out, apply to disputes arising under this policy.

Nothing in this section limits your right to lodge a complaint with a supervisory authority in your jurisdiction, to contact your state attorney general, or any mandatory consumer protection right available under the law of your country of residence that cannot be derogated from by agreement.

We may update this policy. When we do, we revise the “Last updated” date at the top. Where a change is material, we will provide additional notice on this site at least 30 days before it takes effect.

Where a change would permit a materially different use of personal information already collected, we will obtain consent where the law requires it rather than relying on continued use. We maintain prior versions and will provide a copy on request.

Write to [email protected] with “Privacy” in the subject line, or to Nead, LLC, 1425 Broadway 22689, Seattle, WA 98112, United States. Include enough detail for us to identify the relevant information. If your request is about data a cleaning company holds, include the company’s name.

If you are dissatisfied with our response you may lodge a complaint with your local supervisory authority or, if you are a US state resident, with your state attorney general. We would prefer you raised it with us first, and we will tell you what we can and cannot do rather than routing you through a process.

Related documents: Terms of Use · erp.io Terms of Service · erp.io Privacy Policy · Data Processing Addendum · Subprocessors