Privacy Policy

Who we are

Ménage is a private estate management service made up of the Ménage app for principals and residents, the Ménage Staff app for household staff, and the websites and services behind them (together, the "Service"). The Service is operated by Could Love (could.love), referred to here as "we", "us" or "our".

For personal data that you and your household put into the Service, we act as the data controller. Where a principal or household office uses Ménage to manage their own staff and residences, they also make their own decisions about that information and may have their own obligations towards the people involved.

What we collect

We only collect what we need to run the Service. Depending on how you use it, this includes:

Account information

• Your name, how you prefer to be addressed, email address and, if you add it, phone number.
• Your password (stored only as a secure hash), two-factor authentication settings and passkeys (we store the public key only).
• If you sign in with Google, Apple or Microsoft: your name, email address and the account identifier that provider shares with us. We do not receive your password for those accounts.
• Profile and cover photos, if you add them.

Household and residence information

• Residences you add or are invited to: name, address, map location, time zone, seasons, photos and generated house artwork.
• Who belongs to a household and in what role (principal, resident, member, staff), including staff job titles and, where entered, pay details.
• Invitations you send, including the name, email address or phone number of the person you invite.
• If you subscribe to a paid plan, billing details are handled by our payment provider; we keep a record of the subscription, not your full card number.

Content you create

• Tasks, checklists, task updates, presets and notes.
• Messages, direct messages, reactions and attachments in channels.
• Photos, videos and files you upload, and voice recordings you dictate.
• Your conversations with the AI assistant.

Location (Ménage Staff and residence setup)

• In Ménage Staff, if you allow it, we use your device location to detect when you arrive at and leave a residence you work at, so your check-in can be recorded. This may run in the background, but only around the residences you are assigned to. We store the check-in times and the coordinates at check-in, not a continuous track of where you go.
• In the Ménage app, location is used only while you use the app, for example to place a residence on the map.
• You can turn location access off at any time in your device settings. Check-ins then stop working automatically.

Device and technical information

• Push notification tokens, device platform and device name, so we can send notifications.
• IP address, browser or app user agent, sign-in times and sign-in method.
• Server logs and diagnostics needed to keep the Service secure and working. We do not use third-party analytics, advertising or crash-reporting SDKs.

Camera, photos and microphone

The apps ask for camera, photo library and microphone access only so you can take or attach photos and dictate messages. We only receive the photos, videos and recordings you choose to send. We do not access your contacts or calendar.

How we use it

• To create and secure your account and sign you in.
• To provide the Service: show your residences, assign and track tasks, deliver messages, store media and record staff check-ins.
• To send notifications, invitations and service emails (for example email verification, password resets, security notices and important changes).
• To power optional AI features such as the assistant, dictation, suggestions and house artwork.
• To process payments if you subscribe to a paid plan.
• To keep the Service safe: prevent abuse, investigate problems and enforce our Terms of Service.
• To improve and fix the Service, using aggregated or technical information.
• To comply with the law.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your content to train AI models.

Legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases under the GDPR:

• Contract: to provide the Service you signed up for, including account, household, messaging, tasks and media.
• Legitimate interests: to keep the Service secure, prevent abuse, and improve it, where those interests are not overridden by your rights.
• Consent: for device permissions such as location, camera and microphone, and for optional features you switch on. You can withdraw consent at any time.
• Legal obligation: where we must keep or disclose information by law.

AI features

When you use the assistant, dictation, suggestions or house artwork, the relevant content is sent to our AI providers to generate a response. This can include your request, voice recording, and the household context needed to answer it, such as task, preset, residence and staff names. Before onboarding text is classified, we strip email addresses, phone numbers and street addresses from it.

Our AI providers process this data on our behalf under their business terms, which do not allow them to use it to train their models. AI output can be wrong; see our Terms of Service.

Sharing and processors

Information you add to a household is visible to the other people in that household according to their role. For example, a principal can see tasks and messages in their residences, and staff see what is shared with them.

We use trusted service providers ("processors") who handle data on our behalf, only to provide the Service and under contracts that protect it:

We may also share information if required by law or to protect the rights, safety or property of our users, the public or us, and with a successor if Could Love is involved in a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

International transfers

Some of our providers are based in, or process data in, the United States and other countries outside your own. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, where the provider is certified.

Retention

• We keep account and household data for as long as your account is active.
• Messages, tasks and media stay in a household until they are deleted, the residence is removed, or the household's account is closed.
• Staff check-in records are kept as part of the household's records until the household deletes them or closes its account.
• Technical logs are kept for a short period, normally no longer than 90 days, unless needed to investigate a security issue.
• We may keep limited information longer where the law requires it, for example billing records.

Security

We protect your data with encryption in transit (HTTPS/TLS), hashed passwords, optional two-factor authentication and passkeys, private media storage served through short-lived signed links, and role-based access inside each household. No system is perfectly secure, so please use a strong password and tell us straight away at info@could.love if you think your account has been compromised.

Children

The Service is not intended for children. You must be at least 16 years old to create an account (or the higher age of digital consent where you live). We do not knowingly collect personal data from children under 13, or under 16 in the EEA and UK. If you believe a child has given us personal data, contact us and we will delete it.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing.

You can update most of your information directly in the apps. For anything else, email info@could.love. We may need to verify your identity, and we will reply within one month (or the time the law in your region requires). If you are in the EEA or UK and are unhappy with our response, you can complain to your local data protection authority; in the Netherlands, that is the Autoriteit Persoonsgegevens.

If your information was added by a household you work for, we may refer your request to that household's principal where appropriate.

Deleting your account

You can delete your account from the app settings at any time, or ask us by email. When you delete your account, we remove your sign-in methods, passkeys, device tokens and profile photo, and erase your name, email address and phone number. Messages and tasks you contributed to a household stay with that household so its records still make sense, but they are shown as from "Deleted user". If you own a residence, you need to hand it over or remove it before your account can be deleted.

US state privacy rights

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose; to request access to or deletion of it; to correct it; and not to be treated differently for exercising these rights. The categories we collect are described in What we collect, and the purposes in How we use it. We do not sell or share personal information as those terms are defined under the CCPA, and we do not use sensitive personal information (such as precise location) for anything other than providing the Service. To make a request, email info@could.love. You may use an authorised agent.

Cookies

Our websites use only strictly necessary cookies: a session cookie to keep you signed in and secure, a security token to protect forms, and a preference cookie that remembers light or dark appearance. We do not use advertising or analytics cookies, so we do not show a cookie banner. The mobile apps store sign-in tokens securely on your device.

Google user data

If you sign in with Google, we receive your name, email address, profile picture and Google account identifier. We use this only to create your account, sign you in and show your name and picture inside the Service. We do not request access to your Gmail, Drive, Calendar, Contacts or other Google data.

Ménage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or use it to train AI models, and we do not allow humans to read it except with your consent, for security purposes, or where required by law.

Changes to this policy

We may change, update or modify this Privacy Policy at any time, at our sole discretion. Changes take effect when we post the updated policy here, and the "Last updated" date at the top will change. If a change is material, we will also tell you in the app or by email where reasonably possible before it takes effect. If you keep using the Service after a change takes effect, you accept the updated policy. If you do not agree, stop using the Service and delete your account.

Contact

Questions or requests about privacy: info@could.love.

Could Love, could.love