Privacy policy
Last updated: 24 October 2026 · 4cleanibiza.com
This page is a translation provided for convenience. In the event of any discrepancy, the Spanish version shall prevail.
Draft pending legal review. Details shown in square brackets will be completed before launch.
Your privacy is part of the service. Here we explain clearly how we process your data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on data protection (LOPDGDD).
1. Data controller
- Owner: [Razón social pendiente]
- Tax ID (NIF): [NIF pendiente]
- Address: [Domicilio social pendiente], Ibiza, Illes Balears
- Registration: [Datos de inscripción registral pendientes]
- Email: hola@4cleanibiza.com
- Website: 4cleanibiza.com
For any privacy matter, write to us at privacidad@4cleanibiza.com.
2. What data we process
Your account (all users): name, email and profile photo, which we manage with our sign-in provider, Clerk. If you sign in with an account from another service (for example, Google), we receive your name, email and photo from it. We also store your language so that we can write to you in it.
If you book services (clients): name, email and phone number; addresses or moorings where the service is provided, type and size of the home or boat, and access instructions; details of each booking, chat messages and reviews. Payments are processed by Stripe: you enter your card details in a Stripe form and they go directly to Stripe, so 4clean never sees or stores your full card number. We only store the identifiers Stripe assigns to your profile and to each payment, the amounts and their status (authorised, charged or refunded). Stripe saves your card, linked to your account, so that any extra hours you accept during a service can be charged.
If you offer services (professionals): name, photo, contact details, languages, nationality (optional), experience, specialities, areas, availability and rates; verification documents if we ask for them (DNI/NIE, the Spanish identity document or foreigner identification number; registration as self-employed or as a company; civil liability insurance if you provide it); the tax details required by law; bookings, earnings and ratings. To get paid, you sign up with Stripe Connect: Stripe collects and verifies your identity and bank account directly, and we only receive your Stripe account identifier and whether it can already receive transfers.
When you browse: technical data such as your IP address, browser and device, which are processed by Cloudflare, which hosts and protects the website; and the preferences you save in your own browser (see the Cookie policy). In the payment form, Stripe collects device and browsing data to prevent fraud. If you accept analytics, Microsoft Clarity records how you browse (clicks, scrolling and pages viewed) without saving what you type in forms.
Emails: we keep a log of the emails we send you about your bookings (recipient, type of notice, date and whether it was sent successfully).
In addition to the data you give us, we receive some data from third parties: from the account you sign in with, from Stripe (the status of your payments and, if you are a professional, of your payout account) and from other users (chat messages and reviews). The data we ask for as mandatory is necessary to create an account, book, pay or get paid: without it, we cannot provide that service to you.
We do not process special categories of personal data. Please do not include any in the chat or in the notes of a booking.
3. Why we use it, on what legal basis and for how long
| Purpose | Legal basis | Retention period |
|---|---|---|
| Creating and managing your client or professional account, including sign-in with Clerk | Performance of a contract (Art. 6(1)(b) GDPR) | While the account is active |
| Managing bookings, extra hours, cancellations, refunds and the chat for each booking | Performance of a contract (Art. 6(1)(b)) | For the duration of the relationship and, afterwards, for the limitation periods for legal claims |
| Collecting booking payments with Stripe: authorising your card when you send the request, charging it when the professional accepts, saving the card for any extra hours you accept, and issuing refunds | Performance of a contract (Art. 6(1)(b)) | For the duration of the relationship and, afterwards, for the limitation periods for legal claims |
| Transferring professionals their share through Stripe Connect, invoicing and accounting | Legal obligation (Art. 6(1)(c)) and contract | 6 years for accounting records (Art. 30 of the Spanish Commercial Code) and the applicable tax periods |
| Reporting to the Spanish Tax Agency (Agencia Tributaria) the income professionals earn on the platform (DAC7, Law 13/2023) | Legal obligation (Art. 6(1)(c)) | The period set by tax legislation |
| Verifying professionals' identity and legal right to work, and preventing fraud, including in payments (Stripe Radar) | Legitimate interest (Art. 6(1)(f)) and legal obligation | While the profile is active and up to 1 year after it is closed |
| Handling payment disputes and chargebacks, and defending our rights against claims | Legitimate interest (Art. 6(1)(f)) | Until they are resolved and for the limitation periods |
| Publishing reviews from verified clients (only after a completed booking) | Performance of a contract and legitimate interest | While the reviewed profile is published |
| Suggesting work teams to professionals based on areas, languages, services and schedule | Legitimate interest (Art. 6(1)(f)) | While the profile is active |
| Sending you emails about your bookings (request, confirmation, cancellation, extra hours…) and keeping a log of those emails | Performance of a contract (Art. 6(1)(b)) | Email log: while the account is active and, afterwards, for the limitation periods |
| Remembering your language (4clean_lang cookie and your account) to show you the website and send you emails and messages in that language | Legitimate interest (Art. 6(1)(f)) and performance of a contract | Cookie: 1 year; on your account, while it is active |
| Handling enquiries, incidents and complaints | Performance of a contract and legitimate interest | Until they are resolved and for the limitation periods |
| Sending you news and offers by email | Consent (Art. 6(1)(a)), which you can withdraw at any time | Until you withdraw your consent |
| Keeping the website secure and preventing abuse, with Cloudflare's protection | Legitimate interest (Art. 6(1)(f)) | Technical logs: 12 months maximum |
| Analysing how the website is used with Microsoft Clarity (heatmaps and browsing recordings) in order to improve it | Consent (Art. 6(1)(a)), which you give or withdraw in the cookie banner | Recordings: 30 days; aggregated data: up to 13 months |
4. Recommendations and suggested teams
We rank search results and suggest teams of professionals by combining availability, area, languages, services and ratings. These are only suggestions: each client chooses whom to book and each professional decides whether to accept a booking or join a team. We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR).
5. Advertising with Google Ads (not active yet)
Today we do not use advertising or advertising cookies. In the future we may advertise with Google Ads, from Google Ireland Limited, to measure which ads lead to a booking (conversions) and, possibly, to show 4clean ads to people who have already visited the website (remarketing).
If we activate it, it will only work with your consent (Art. 6(1)(a) GDPR), which you will be able to give or withdraw at any time from the cookie banner. We will use Google's consent mode (Consent Mode v2) with ad_storage, ad_user_data and ad_personalization denied by default, so Google Ads will not store cookies or receive your data for advertising until you accept. Google processes that data as an independent controller. Before activating it, we will update this policy and the Cookie policy, which will list the cookies used.
6. Who we share your data with
- Between client and professional. The professional sees your name and the booking details. The exact address and access instructions are only shown to them once they accept the booking; in a team booking, to every member who accepts it. Your phone number is not shown: you communicate through each booking's chat. If you leave a review after a completed service, it is published on the professional's profile with your first name and the initial of your surname.
- Providers. Those in the following table process data to provide their services to us, under a data processing agreement (Art. 28 GDPR), except where it says they act as controllers in their own right.
| Provider | What for | Role |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | Card payments, saved card, refunds, disputes and chargebacks, payments to professionals (Stripe Connect) and fraud prevention (Stripe Radar) | Processor when it processes payments on our behalf. Independent controller when it verifies professionals' identity (KYC), prevents fraud and meets its own legal obligations |
| Clerk, Inc. (USA) | Registration, sign-in and account security | Processor |
| Cloudflare, Inc. (USA) | Website hosting (Cloudflare Workers), database (Cloudflare D1), content delivery network and protection against attacks and bots | Processor |
| Resend (Plus Five Five, Inc., USA) | Sending the emails about your bookings | Processor |
| Microsoft Corporation (USA) | Analytics with Microsoft Clarity, only if you accept it | Controller, according to Microsoft |
| Google Ireland Limited | Google Ads, not active yet: only once we activate it and if you accept it (see “Advertising with Google Ads”) | Independent controller |
To create your payment profile, we give Stripe your name, email and language (and, if you are a professional, your profile name). Stripe processes this data in accordance with its privacy policy.
- Other providers we may need (for example, accounting and tax advisers), always under a data processing agreement.
- Public authorities where required by law, for example the Spanish Tax Agency (reporting obligation for digital platforms) or courts and law enforcement.
7. International transfers
Several providers are US companies or part of groups based there, so some data may be processed outside the European Economic Area:
- Stripe: your contract is with Stripe Payments Europe, Ltd. (Ireland), but some data is transferred to Stripe, Inc. (USA).
- Clerk, Cloudflare and Resend: may process data in the USA. Cloudflare also uses its global network of data centres to serve the website from the one closest to you.
- Microsoft (Clarity, only if you accept analytics) and Google (Google Ads, if it is activated and you accept it) may also process data in the USA.
These transfers are based on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified companies and, where it does not apply or as an additional safeguard, on the standard contractual clauses approved by the Commission, with supplementary measures. You can ask us for information about these safeguards or for a copy of them at privacidad@4cleanibiza.com.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw any consent you have given, by writing to privacidad@4cleanibiza.com. We will reply within one month at the latest. Withdrawing consent does not affect processing carried out before you withdrew it.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency, Agencia Española de Protección de Datos (www.aepd.es), or with the data protection authority of the European Economic Area country where you live or work, or where the alleged infringement took place (Art. 77 GDPR). You will find the list of authorities on the website of the European Data Protection Board (edpb.europa.eu).
9. Minors
4clean Ibiza is intended for people aged 18 and over. We do not knowingly collect data from minors.
10. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), access control, minimal exposure of addresses and access instructions, and activity logging. The website and database run on Cloudflare's infrastructure, which is protected against attacks, and card data is only handled by Stripe, which complies with the Payment Card Industry Data Security Standard (PCI DSS). If we detect a personal data breach that affects you, we will notify you as required by law.
11. Changes to this policy
If we make significant changes to this policy, we will let you know by email or with a notice on the platform before the change takes effect.