Privacy Policy
1. Information We Collect
We collect: full name, email address, phone number, GPS location (only while using the app), vehicle information, service history, and verification documents for Affiliates (driver's license, vehicle registration, insurance, a photo of the work vehicle, and one identity verification photo of the Affiliate's face). Customers are never asked for a photo of their face. We do not sell your data to third parties.
2. How We Use Your Information
We use your information to: connect customers with nearby Affiliates, process payments, send service notifications, improve the platform, and comply with legal obligations (including 1099 tax reporting).
3. Location
Customers: we access your GPS location only with your explicit permission and only while you are actively using the app. We never track a customer's location in the background. Affiliates: while you are on your way to a booking and until you mark it complete, the app reports your location in the background. This is what lets the customer watch you approach on the map, and it stops when the service ends. Outside an active booking we do not track you. Affiliates only see a customer's approximate location until they accept the service request.
4. Data Sharing
We share data with: Stripe (payment processing), Supabase (data infrastructure), Mapbox (maps), Google, Meta and TikTok (website analytics and ad measurement, see section 10), and authorities when required by law. We never sell your information to third parties for advertising purposes. Text messages are sent through Twilio. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text-messaging originator opt-in data and consent will not be shared with any third parties. See our SMS Policy at washb.app/sms.
5. Your Rights (CCPA/GDPR)
You have the right to: access, correct, delete, and export your data. To exercise these rights, contact us at info@washb.app. We process requests within 30 days.
6. Security
All data is transmitted with TLS encryption. Passwords are stored with bcrypt hashing. Verification documents are stored in private encrypted storage and are only accessible by the review team.
7. Identity Verification Photo (Face Data)
Only Affiliates — the independent service providers who perform washes — are asked to take one frontal photo of their face during account verification. Customers are never asked for one. WHAT WE COLLECT: a single still photograph of the Affiliate's face, taken with the device camera or chosen from the photo library. Nothing else is derived from it. HOW IT IS USED: a member of the WASHB review team looks at the photo and visually compares it with the government-issued driver's license that the same Affiliate uploaded, to confirm they are the same person. This is a manual, human review. WASHB does not perform facial recognition, does not create or store face templates, face maps, faceprints or any other biometric identifier, and runs no automated or machine-learning face matching of any kind. The photo is never used to identify anyone outside this one-time check, and never for advertising, profiling or training. SHARING: the photo is not shared with any third party. It is not sent to any identity verification vendor, analytics provider or advertiser. Our hosting provider (Supabase) stores the file on our behalf as infrastructure and does not access or process it. STORAGE: the photo is stored in a private, encrypted storage bucket, transmitted over TLS. It is not publicly accessible. It can only be opened through a signed link that expires after one hour, and only by the Affiliate who uploaded it and the WASHB review team. RETENTION AND DELETION: the photo is kept while the Affiliate account exists, so that verification can be re-checked if documents expire. It is deleted within 30 days of the account being closed or rejected. An Affiliate may request deletion at any time by writing to info@washb.app, and we delete it within 30 days of the request.
8. Data Retention and Account Deletion
We keep your account data while your account is open. When you delete your account, we delete your profile (name, email, phone), saved cars and addresses, credits, rewards and notification tokens. Each booking is a transaction between a customer and an Affiliate. To resolve disputes, chargebacks, damage or safety claims, and to meet legal, tax and accounting obligations, we keep a de-identified record of past bookings (service, date, status, amounts, before/after photos of the vehicle, the in-app chat messages exchanged about that booking, reviews and related support tickets) for up to 3 years after the service. After you delete your account, this record no longer shows your name or contact details, it is no longer visible to the other party, and only authorized WASHB staff can access it. Payment records are kept as required by financial and tax law (up to 7 years). Affiliates who received payouts must keep their tax records (Form 1099) for the period required by the IRS, so their account is closed by our team on request. In-app chat messages are kept as part of the booking record so either party can rely on them in a dispute. They cannot be edited or deleted after they are sent. To keep payments, support and safety inside WASHB, the chat automatically detects and blocks phone numbers, emails and social media handles, including when they are split across messages or written in words; blocked attempts are recorded and reviewed by our team.
9. Minors
WASHB is not intended for persons under 18 years of age. If you are under 18, please do not use this platform.
10. Cookies, Analytics and Ad Measurement (website only)
On our website we use Google Analytics and measurement tags from Google Ads, Meta and TikTok. They use cookies or similar technologies to understand how visitors use the site and to measure whether our ads work, for example whether a visit that started from an ad led to an app download, a new account or a booking. These providers receive technical data such as pages viewed, device and browser type, approximate location derived from your IP address, the ad click identifier, and the action taken (for example "sign up" or "booking", with the booking amount). We do not send them your name, email, phone number or address. Our mobile apps do not include these tags and do not track you across other companies' apps or websites. You can opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout), manage Google ad settings at adssettings.google.com, and block or delete cookies in your browser settings.