Privacy Policy
This policy explains what information Wash42 collects through its mobile app, web app, and related services, how we use it, and the choices you have.
Summary. Wash42 collects information to provide you with car wash services, manage your Wash Club membership, process payments, and improve our platform. We do not sell your personal information. We share data only with service providers who help us operate, and only as described in this Policy.
1. Overview
Wash42 Ventures, LLC ("Wash42," "we," "our," or "us") operates the Wash42 mobile application, progressive web application, and related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services.
By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, please do not use our Services. This Policy should be read alongside our Terms of Service.
Our Services are intended for users who are 16 years of age or older. We do not knowingly collect information from children under 16.
2. Information We Collect
We collect information you provide directly, information collected automatically when you use our Services, and information from third parties.
Information you provide directly
- Account registration: name, email address, phone number, and password when you create an account.
- Profile information: vehicle details (make, model, license plate) associated with your account.
- Payment information: billing address and payment card details (processed securely via our payment processor; see Section 5).
- Wash Club membership: subscription preferences and membership tier selections.
- Communications: messages you send us through support channels, surveys, or feedback forms.
- Social sign-in: if you sign in using Google or Apple, we receive your name, email address, and a unique identifier from those providers.
Information collected automatically
- Usage data: pages visited, features used, wash transactions initiated, session duration, and in-app actions.
- Device information: device type, operating system version, app version, unique device identifiers, and mobile network information.
- Location data: precise GPS location when you use location-based features to find wash locations (see Section 6).
- Log data: IP address, browser type, referring URLs, and error logs.
- Cookies and similar technologies: session tokens, preference cookies, and analytics identifiers.
- Push notification tokens: device tokens used to deliver service notifications (receipts, membership confirmations, wash alerts).
Information from third parties
- Payment processors: transaction confirmations, subscription status, and billing event notifications from our payment processor (ValorPay).
- Identity providers: profile data from Google or Apple when you use social sign-in.
- Analytics providers: aggregated usage insights to help us improve the Services.
3. How We Use Your Information
We use the information we collect for the following purposes:
| Purpose | Description | Legal Basis |
|---|---|---|
| Service delivery | Processing wash purchases, managing Wash Club membership, sending receipts and confirmations | Contract performance |
| Account management | Creating and maintaining your account, authenticating your identity, managing preferences | Contract performance |
| Payment processing | Charging your payment method, managing subscription billing cycles, handling refunds | Contract performance |
| Customer support | Responding to inquiries, resolving disputes, troubleshooting issues | Legitimate interest |
| Service improvement | Analyzing usage patterns, diagnosing technical problems, developing new features | Legitimate interest |
| Communications | Sending service updates, renewal notices, and (with your consent) promotional messages | Consent / legitimate interest |
| Safety & security | Detecting fraud, preventing abuse, enforcing our Terms of Service | Legitimate interest |
| Legal compliance | Complying with applicable laws, responding to lawful requests, maintaining required records | Legal obligation |
We do not use your personal information to make automated decisions that produce legal or similarly significant effects without human review.
4. Sharing & Disclosure
We do not sell, rent, or trade your personal information. We share your information only in the following circumstances:
Service providers
We share information with trusted third-party vendors who assist us in operating the Services, subject to confidentiality obligations. These include:
- Payment processors (ValorPay) for billing and subscription management.
- Cloud infrastructure providers (Microsoft Azure) for hosting and data storage.
- Identity providers (Google, Apple) for social authentication.
- Push notification services (APNs for iOS, FCM for Android) for service alerts.
- Analytics providers for aggregated usage analysis.
- Map service providers (Apple Maps, Google Maps) for location features.
Business transfers
If Wash42 is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.
Legal requirements
We may disclose your information if required to do so by law or in response to valid legal process (such as a subpoena or court order), or to protect the rights, property, or safety of Wash42, our users, or the public.
With your consent
We may share information with third parties when you have given us explicit consent to do so.
5. Payment Information
All payment card information is processed directly by our payment processor, ValorPay, using industry-standard encryption and tokenization. Wash42 does not store full card numbers, CVV codes, or other sensitive payment credentials on our servers.
We receive and store transaction records, including masked card details (last four digits), transaction IDs, amounts, and subscription status. This information is used to manage your membership, process recurring billing, handle disputes, and maintain required financial records.
Wash Club subscription renewals are processed automatically. You will receive email confirmation for each renewal. You may cancel your subscription at any time through the app or by contacting our support team; cancellations take effect at the end of the current billing period.
6. Location Data
We collect precise location information when you use location-based features, such as finding nearby wash locations or enabling automated entry at a wash site. Location access requires your explicit permission through your device's operating system.
- You can grant or revoke location permissions at any time in your device settings.
- We collect location only while you are actively using the app and have granted permission; we do not track your location in the background unless you have explicitly enabled that feature.
- Location data is not shared with third parties for advertising purposes.
- Historical location data is retained only as long as needed to deliver features and resolve disputes.
7. Data Retention
We retain personal information for as long as necessary to provide the Services and fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 2 years after deletion request |
| Transaction records | 7 years (financial compliance requirements) |
| Wash history | 3 years from transaction date |
| Support correspondence | 3 years from case closure |
| Location data | 90 days from collection |
| Log and diagnostic data | 90 days from collection |
| Marketing consents | Until withdrawn + 3 years |
When your information is no longer needed, we securely delete or anonymize it in accordance with our data disposal practices.
8. Security
We implement technical and organizational measures designed to protect your information against unauthorized access, loss, alteration, or disclosure. These measures include:
- Encryption of data in transit using TLS 1.2 or higher.
- Encryption of sensitive data at rest.
- Secrets management via Azure Key Vault.
- Multi-factor authentication for account access.
- Regular vulnerability assessments and dependency scanning.
- Role-based access controls limiting employee access to personal data.
- Webhook signature verification (HMAC-SHA256) for all payment provider integrations.
While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant authorities as required by applicable law.
9. Your Rights
Subject to applicable law, you have the following rights regarding your personal information:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data, subject to legal retention obligations.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interest or for direct marketing.
- Restriction: Request restriction of processing in certain circumstances.
- Withdraw consent: Withdraw consent at any time where processing is based on consent.
- Do Not Sell: Opt out of any sale or sharing of personal information (we do not sell data).
To exercise any of these rights, please contact us using the information in Section 13. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.
You will not be discriminated against for exercising your privacy rights.
10. Children's Privacy
Our Services are not directed to children under the age of 16. In compliance with the Children's Online Privacy Protection Act (COPPA) and applicable state laws, we do not knowingly collect personal information from children under 16.
We implement age verification to restrict access by users under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will delete that information promptly. If you believe we may have collected information from or about a child under 16, please contact us immediately.
11. California Residents
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.
Categories of personal information collected
In the past 12 months, we have collected the following categories of personal information as described in the CCPA: identifiers; personal information under Cal. Civ. Code §1798.80(e); commercial information; internet or other electronic network activity; geolocation data; and inferences drawn from the above.
Your CCPA/CPRA rights
- Right to Know: Request disclosure of the categories and specific pieces of personal information collected, the sources, the business purposes, and the third parties with whom we share it.
- Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under CPRA.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.
Submitting a California privacy request
California residents may submit requests to know, delete, or correct using our contact information in Section 13. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.
We responded to 100% of verifiable California consumer requests within the required 45-day window in the prior calendar year.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this Policy.
- Notify you via email (to the address associated with your account) and/or in-app notification at least 30 days before material changes take effect.
- In cases where changes require your consent, request your affirmative agreement before they take effect.
Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Policy, to the extent permitted by law. We encourage you to review this Policy periodically.
13. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how we handle your information, please contact us:
- Entity: Wash42 Ventures, LLC
- Email: privacy@wash42.com
- Subject: Use "Privacy Request" or "Privacy Policy" in the subject line.
- Response: We aim to respond within 30 days.
If you are a California resident and wish to submit a request under the CCPA/CPRA, you may also send a written request to the entity above marked "California Privacy Request."