Privacy and Data Governance Policy

Last updated: October 29, 2026

This policy explains what personal information Green Tangelo (“we”, “us”), a business based in the United States, collects through www.greentangelo.net (the “Platform”), why, who we share it with, how long we keep it and how we protect it. It also sets out how we govern data: the principles, responsibilities and controls we work to. It forms part of our Terms and Conditions.

1. Who is responsible

Green Tangelo decides how and why personal information on the Platform is used. Questions, requests and complaints go to our privacy officer at info@greentangelo.net.

2. The standards we follow

the Fair Information Practice Principles and the NIST Privacy Framework, for how we govern personal information;
the NIST Cybersecurity Framework and the practices of ISO/IEC 27001, which our security controls follow (we are not certified against them);
the Payment Card Industry Data Security Standard (PCI DSS), met by our payment partners, who handle all card details;
United States privacy laws where they apply, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), other state privacy laws, the California Online Privacy Protection Act and the Children’s Online Privacy Protection Act.

3. Our principles

We collect and use personal information openly and fairly; only for the purposes we state; limited to what we need; kept accurate; kept no longer than necessary; and protected against loss and misuse. We give you choices and access, and we are accountable for following this policy.

4. Responsibilities

Management is accountable for privacy, approves this policy and reviews it at least once a year.
The privacy officer keeps the record of what data we hold and why, answers your requests, assesses new uses of data before they start, manages security incidents and trains staff.
Administrators see only what their work needs, and keep it confidential.
Partner dry cleaners and delivery partners receive only what they need to serve a booking (for example, a Renter’s name, delivery address and phone number). They may use it only for that booking, must keep it confidential and secure, and must not keep it longer than needed.
Service providers who process data for us (section 8) do so under contract and only on our instructions.

5. What we collect, why, and how long we keep it

Information	Why we use it	How long we keep it
Account: username, name, email, phone, address, profile text, website and social links, profile photo, account type, country, and when you accepted our terms	To run your account and the bookings, listings or partner work it is for	While your account is open
Listings: description, photos, price, address and map position, and any contact details you add	To show your items to Renters (listings are public)	Until you remove the listing or close your account
Bookings and payments: dates, amounts, invoices, payment and refund status, booking notes, delivery address and phone. We never receive card numbers.	To take payment, deliver and return items, and keep accounts	Invoices, payments and payout records: seven years, or longer if the law requires. Notes and delivery addresses on finished rentals can be deleted on request.
Payout details: bank name, account name and account number (Listers and partner cleaners)	To pay out earnings and bonuses	While your account is open; the copy on each payout record is kept as an accounting record
Partner profiles: business name, phone, address, city, opening hours, description, map position and business registration number	To approve partners and show drop-off points (the registration number is never shown publicly)	While the partnership lasts
Item and inspection records: item status, inspection results, notes, deductions, and who made each change	To verify items, settle deposits and disputes, and prevent fraud	As long as the related listing and booking records
Messages between members, with the sender’s name, email and phone	To let members arrange rentals	Until you close your account or ask us to delete them
Reviews	To help others choose (reviews are public)	Until removed
Recommendations: the name, city, phone or email of someone a member recommends	To invite them and reward the member who recommended them	Until the recommendation is decided, and then as long as needed to record the reward. The person recommended can ask us to delete it at any time.
Newsletter: email, when you agreed and when you confirmed	To send the newsletter you asked for	Until you unsubscribe, which deletes it
Contact form: name, email and message	To answer you	90 days, then deleted automatically
Technical data: your IP address, used at the moment of your visit to find your country (it is not stored); a one-way scrambled form of it, kept for up to a day, to limit repeated attempts (such as sign-ins) and count listing views; your country cookie (section 6); our host’s server logs	To show prices in your currency, and to keep the Platform secure	Country cookie: 30 days. Security and view counters: up to 24 hours. Server logs: as set by our host.

Photos and files you upload but never use are deleted after 48 hours. The chat assistant answers from our own server and does not store your conversation there; if the site keeps a chat history, it stays in your own browser.

In the terms of the CCPA, these are identifiers, customer records, commercial information, internet activity, approximate location (your country) and the content you post. We collect them from you, from other members (for example, a recommendation or a booking), from our Partners (inspection and delivery records) and from your device. We do not use automated decision-making that has legal or similarly significant effects on you.

6. Cookies and similar technologies

gt_region remembers your country so prices show in your currency (30 days).
WordPress sign-in cookies keep you signed in, and a test cookie checks that your browser accepts cookies.
If you leave a comment, WordPress may remember your name and email in your browser.
If the chat assistant is set to keep history, it is saved in your browser’s local storage.

We use no advertising or analytics cookies, and we do not track you across other websites. Because we do not sell or share personal information, browser “Do Not Track” and Global Privacy Control signals do not change what we do, but we treat a Global Privacy Control signal as a request to opt out.

7. Sharing your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We disclose it only:

between the members and Partners of a booking, as far as the booking needs (for example, Partners see the Renter’s name, and delivery partners their address and phone);
publicly, where you choose to publish it: your listings, reviews and, for partner cleaners, the drop-off details on the map;
to our service providers (section 8);
to the police, regulators or courts where the law requires it, or to prevent fraud (see our Anti-Fraud and Collusion Policy);
to a buyer of our business, who must keep to this policy.

We do not share personal information with third parties for their own direct marketing (California’s “Shine the Light” law).

8. Service providers

Stripe (card payments): your email, the invoice number, the item’s name and the amount.
PayPal (PayPal payments): the invoice number, the item’s name and the amount.
Our web host and email service, which store the Platform’s data and send its emails.
OpenStreetMap map tiles and address search (and Google Maps, if we switch maps to it) are loaded by your browser, so these services receive your IP address.
Gravatar shows a profile picture for members who have not uploaded one, from a scrambled form of their email address.
Facebook, only if you choose to sign in with Facebook.

Our country database comes from DB-IP; we download it, and send them nothing about you.

9. Where your information is processed

We are based in the United States, and the Platform’s data is processed in the United States and by our service providers wherever they operate.

10. How we protect your information

The Platform is served over HTTPS.
Card details are entered only on our payment partners’ secure pages, which meet PCI DSS. We never see or store them, and we check the signature of every payment notification they send us.
The keys to our payment accounts are kept in the server’s configuration, not in the database.
Access follows the least-privilege principle: each member and Partner sees only their own data and what their bookings need. Full payout details and partners’ registration numbers are visible only to administrators; members see only the last four digits of their own account number.
Every form checks a security token and the user’s permissions, and sign-in, registration, messages, bookings and checkout are rate-limited.
Changes to items, bookings, refunds and payouts are logged with who made them.
We keep the Platform’s software up to date, keep regular backups, and train everyone with access to personal information.

11. Your privacy rights

Depending on the state you live in (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you have the right to:

know what personal information we collect, use and disclose, and get a copy in a portable format;
correct it (you can also edit your profile in your dashboard);
delete it (you can also close your account in your dashboard once any balance is settled);
opt out of its sale or sharing, targeted advertising and profiling (we do none of these);
not be treated differently for using these rights.

We give these rights to all our customers, wherever they live. To use them, write to info@greentangelo.net. We will confirm your identity by asking you to write from the email address on your account, or for other details. You can ask someone to act for you as your authorized agent; we will ask for proof of their authority. We reply within 45 days (or tell you if we need up to 45 more). If we turn down your request, you can appeal by replying to our answer; if we turn down the appeal, you can contact your state attorney general. We may keep information the law requires us to keep, such as invoices, even after a deletion request.

12. Children

The Platform is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, including children under 13; if we learn we have, we delete it.

13. Security incidents

We have a plan for responding to data breaches. If a breach affects your personal information, we notify you and the authorities as the breach notification laws of your state require, without unreasonable delay, with advice on protecting yourself.

14. Accountability and review

We keep a record of the personal information we process and why.
We assess the privacy risks before starting any new use of personal information that could put people at high risk.
We review this policy, our retention periods and who has access to what at least once a year.

15. Changes

We will post any changes here and update the date at the top. For significant changes we will also tell members by email or on the Platform.

16. Contact

Green Tangelo · info@greentangelo.net · Contact page