Last updated: November 2, 2026
Data controller: DusterBook
Product: DusterBook at https://dusterbook.com
Contact: hello@dusterbook.com
This privacy policy describes how DusterBook collects, uses, shares, and retains personal data when you use DusterBook marketing pages, create an account, or interact with public quote, invoice, and booking links sent by our customers.
Who we are
DusterBook provides software for cleaning businesses. Our customers (“Operators”) use DusterBook to manage their clients. Operators may store personal data about their customers (homeowners, facility managers, hosts) in a workspace. For workspace content, the Operator is often the data controller for end-customer data; DusterBook acts as a processor providing hosting and software.
For account holders (users who log in), DusterBook is typically the controller of account and billing data described below.
Data we collect
Account and profile data
When you register, we collect email address, name, password hash (for email sign-up), and optional profile image if you use Google sign-in. Google sign-in supplies identifiers and basic profile fields according to your Google account settings and the permissions you approve. We do not receive your Google password.
Workspace and business data
Operators enter business name, timezone, tax settings, customer names, addresses, phone numbers, email addresses, properties, quote and invoice line items, job schedules, uploaded logos, and internal notes. This may include personal data about third parties (your clients).
Public link interactions
People who open quote, invoice, or booking links you send may submit names, contact details, and messages without creating a DusterBook account. That data is stored in the Operator’s workspace and may generate server logs (IP address, timestamp, browser type) to help prevent abuse.
Billing data
Subscriptions are sold through Polar, which handles payment card processing. We receive subscription status, plan name, trial end dates, and billing event summaries—not full card numbers.
Email delivery
Transactional email (verification, password reset, quote/invoice notifications when you enable them) is sent through the SMTP or Resend mail setup on the server hosting your workspace. Those providers process recipient addresses and delivery logs.
Technical logs
We collect server logs, application errors, and security events (such as failed sign-ins). When enabled, repeated abuse may be slowed using Redis-backed throttling. Marketing pages may load optional third-party analytics only after cookie consent (see cookie policy).
Google Analytics 4
In production, we use Google Analytics 4 (GA4) on marketing pages and the logged-in app to understand aggregate usage (page views, general navigation patterns). GA4 may set cookies or use similar technologies in your browser. We configure GA4 not to send Google ad personalization signals, and we do not send customer names, email addresses, invoice contents, auth tokens, or other personally identifying data to Google. URLs and page titles sent to GA4 are sanitized (for example, a public quote link is sent without its secret token). You can opt out of GA4 on our deployment using environment configuration, or block analytics cookies using a browser extension or settings as described in our cookie policy.
Uploads
Team plans may upload logos stored on our infrastructure (filesystem or object storage depending on deployment). Do not upload unlawful content or sensitive data unrelated to your business branding.
How we use data
We use personal data to:
- Provide, maintain, and secure the service
- Authenticate users and apply workspace roles
- Send transactional messages Operators configure
- Process subscriptions and trials through Polar
- Respond to support requests
- Comply with law and prevent abuse
We do not sell personal data. We do not use Operator client lists to market unrelated products.
Legal bases (EEA/UK)
Where GDPR applies, we rely on: contract (providing the service you signed up for); legitimate interests (security, fraud prevention, product improvement, aggregated site analytics in production); consent (optional third-party analytics cookies where required); and legal obligation (tax and accounting records for our own billing).
Service providers and hosting
We use infrastructure providers to host the application and database (commonly a VPS or container platform with PostgreSQL). Key providers include:
- Polar — subscription checkout and receipts
- Email providers — outbound mail when configured on your server
- Google — optional Google sign-in
Customer invoice card payments are not processed by DusterBook today; do not submit end-customer card data expecting in-app processing.
International transfers
Data may be processed in the United States or other countries where our hosts operate. We use appropriate safeguards where required (standard contractual clauses or equivalent).
Retention
We retain account and workspace data while the subscription is active or during read-only trial expiry periods. Operators may export data from account settings. We delete or anonymize data when no longer needed for the service, legal holds, or dispute resolution. Server logs are rotated on a schedule appropriate to security needs (often 30–90 days unless investigation requires longer).
When an Operator deletes their account or workspace per in-app flows, we delete associated personal data subject to backup retention windows.
Security
See our security page for authentication, workspace isolation, and upload handling. No method of transmission is 100% secure; report suspected incidents to hello@dusterbook.com with subject “Security”.
Your rights
Depending on location, you may have rights to access, rectify, erase, restrict processing, object, and data portability. Operators should handle requests from their customers; DusterBook will assist Operators as processor where applicable.
Account holders may export data in-app and email hello@dusterbook.com for additional requests. We may verify identity before fulfilling erasure.
Children
DusterBook is not directed to children under 16. We do not knowingly collect data from children. Contact us to remove inadvertent submissions.
Cookies
See cookie policy for essential vs optional cookies and analytics consent.
Changes
We may update this policy. The “Last updated” date changes when we do. Continued use after changes constitutes acceptance where permitted by law.
Contact DusterBook
Privacy questions and data subject requests: hello@dusterbook.com or the contact form. EU/UK representatives: not appointed unless listed here in a future update.
California and US state notices
California residents may have additional rights under the CCPA/CPRA including knowing categories collected, deletion, and opting out of “sale” (we do not sell personal information). Nevada residents may opt out of certain data sales—we do not sell data as defined by Nevada law.
We do not use automated decision-making that produces legal effects about account holders without human review.
Questions
Email hello@dusterbook.com with the subject Privacy for data subject requests. We may ask you to verify control of the account email before exporting or deleting records on your behalf.
If you are an end customer of a DusterBook Operator (for example you received a quote link), direct privacy questions about how that business uses your data to the Operator first. We can help Operators locate or delete workspace records when they submit a verified request on behalf of their client.