Privacy Policy

1. Who We Are and What This Policy Covers

WashConsole INC (“WashConsole”, “we”, “us”) makes software that car wash operators use to run their sites. This policy explains what information we handle, why, and the choices people have. It covers our website, the WashConsole web app, our iPhone, iPad and Android apps, our kiosk and connected devices, and the public pages we host for our customers, such as complaint forms and job postings.

We handle information in two different roles:

• Our own information. For people who visit our website, contact us or book a demo, and for the businesses that buy WashConsole and the people who sign in to it, we decide how the information is used. Section 2 describes it.
• Information our customers put into WashConsole. The car wash businesses that use WashConsole (our “Customers”) store information about their employees, job applicants and their own customers. For that information (“Customer Data”), the Customer decides what is collected and how it is used, and we process it on the Customer's behalf under our Data Processing Addendum. Section 3 describes it.

If you work for, applied to, or are a customer of a car wash that uses WashConsole, that car wash's own privacy practices apply to you, and questions or requests about your information should go to them first. We will help them respond.

2. Information We Collect for Our Own Purposes

Information you give us

• Contact details when you contact us, book a demo, register for a webinar or download a resource: your name, business, email and phone number.
• Your car wash's name, phone and email, if you add an email to one of our free tools, such as the damage claim kit, and print. We add that email to our product news list. Everything else you type into a free tool stays in your browser.
• Account details when your business signs up: the business name, its sites and their addresses, and the account owner's name, email and mobile phone number.
• Sign-in details for everyone who signs in: name, email and role. Passwords are stored by Firebase Authentication in hashed form, never in plain text.
• A mobile phone number, if you turn on text-message two-step verification (Section 12).
• Payment details, which Stripe processes. We do not receive or store full card numbers.
• Support requests and bug reports, including any screenshot you choose to attach.

Information collected automatically

• Device and browser details, operating system, app version and IP address.
• How the Service is used: the pages and features used, performance measurements and error reports.
• Session replays. To find and fix problems, our error-monitoring provider, Sentry, records replays of a sample of web app sessions and of sessions in which an error occurs. A replay shows the page layout and where you clicked; it masks all text on the screen and blocks images and video.
• Cookies and similar technologies (Section 8).

3. Information We Process for Our Customers

Which of the following a Customer collects depends on the features it uses and how it sets them up. The Customer is responsible for telling the people concerned and for any consent the law requires (see our Terms of Service).

About employees and other team members

• Profile details: name, email, phone, job title, role, sites, hire and rehire dates, pay rates, profile photo, and date of birth if the employer enters it.
• Time clock records: clock-in and clock-out times, breaks, edits and approvals, and the device used. A kiosk PIN is stored only as a one-way hash.
• Location at clock-in and clock-out. When someone clocks in or out in the app or a browser, it records the device's GPS location at that moment, if the device allows location access. The employer can use it to check that the punch happened at the site. We do not track location in the background.
• Clock-in photos. If the employer turns on photo capture, a photo is taken at clock-in or clock-out. These photos are stored privately, only people the employer authorizes can view them, and we do not use facial recognition on them.
• Schedules, availability, time-off requests and shift swaps.
• Payroll information: hours, overtime, pay rates and payroll exports.
• Personnel records the employer uploads, such as tax forms (for example, W-4s), certifications, signed agreements, performance reviews and disciplinary documents, and electronic signatures.
• Safety records: incident and injury reports, which can include health information, date of birth and emergency contacts, and workers' compensation tracking.
• Training records: course progress, quiz answers, certificates and acknowledgments.
• Messages, photos and videos shared in team chat, announcements and surveys, and photos attached to checklists and completed work.

About job applicants

• Applications and résumés submitted through a Customer's job posting page.

About a car wash's own customers

• Complaints and damage claims, entered by the car wash or submitted through its public complaint form: name, phone, email, address, vehicle details such as plate and VIN, the last four digits of the card used to pay, photos and videos, and any amounts paid.
• Camera footage the car wash attaches to a complaint from its own UniFi Protect cameras.
• Public Google reviews of the car wash's sites, including each reviewer's public name.
• If the car wash uses WashConsole's customer messaging tools: members' contact details, their consent records, the messages sent to them, and whether they tapped the links in those messages.

Operational records

• Equipment, inventory, chemicals, work orders, checklists and inspections.

Information collected from connected devices

If you operate WashConsole's optional connected hardware ("Devices"), each Device transmits operational data to WashConsole over the network you provide. The categories of data collected are:

• Device identity and configuration: hardware identifier, model/type, firmware version, and pairing relationships between Devices (e.g., a sensor and its gateway).
• Operational measurements generated by the Device, which may include level, distance, temperature, humidity, leak/wet state, battery level, electrical power and energy use, switch/relay state, and outdoor environmental conditions. The specific measurements depend on Device type.
• Network and connectivity metadata: local IP address and signal/connectivity indicators used to determine whether a Device is online.
• Lifecycle events: when a Device was first discovered, last seen, claimed, archived, or removed.
• Command and alert history: for Devices that can be controlled remotely, a record of commands issued (who issued them, when, and the outcome); for Devices that emit alerts, a record of alert events and acknowledgements.

Devices do not collect audio, video, images, location of individuals, or biometric data.

Retention. Live device state is retained for the life of the account. Detailed historical readings (e.g., per-minute or per-hour samples) are retained for up to 90 days. Long-term operational summaries (such as daily rollups) and command/alert audit records are retained for the life of the account as part of your operational record.

Use. This data is used to operate the Device, deliver alerts, execute commands and schedules you configure, render dashboards and reports, support troubleshooting, and improve reliability of the Service.

Limitations. Measurements are estimates produced by consumer-grade hardware and are intended for operational awareness only. They are not certified for regulatory, fiscal, environmental, or insurance use.

4. How We Use Information

Our own information

• To provide, secure and support the Service, and to manage accounts and billing.
• To send service messages about accounts, security and billing.
• To send product news and marketing email, which you can unsubscribe from at any time.
• To understand how the Service is used and to improve it.
• To detect and prevent fraud, abuse and security incidents.
• To comply with the law and enforce our terms.

Customer Data

We use Customer Data only to provide the Service to the Customer that controls it and as that Customer instructs, which includes keeping it secure, supporting the Customer, fixing problems and complying with the law. We do not sell Customer Data, share it for advertising, or use it to build profiles for anyone else. We may use information that has been aggregated and de-identified, so that it no longer identifies a person or a Customer, to understand and improve the Service.

5. AI Features

Some features use artificial intelligence, including the AI Coach, WashBot help, photo checks on completed work, schedule drafts, matching names mentioned in reviews to team members, reading receipts for vehicle expenses, and help writing courses and inspections. When you use one, the information that feature needs is sent to Google's Gemini API.

• We use Google's paid service, under which Google does not use the information we send or the results to improve its products. Google may keep them for a limited time to detect abuse.
• We do not use Customer Data to train our own or anyone else's general-purpose AI models.
• AI results are suggestions. AI in WashConsole does not hire, fire, discipline or promote anyone, or set anyone's pay; the Customer's managers make those decisions. A schedule the AI drafts is not shared with the team until a manager publishes it.
• Photo checks look at the work shown in a photo, and are instructed not to identify or describe the people in it.
• Receipt reading sends a receipt photo taken in the web app to Google Cloud Vision to read its text; the phone apps read the text on the device. Gemini sees only the receipt's text, with card numbers and the cardholder's name masked, and only when a field is unclear.

6. How We Share Information

• Within a Customer's account. Information is visible to other people in the same Customer account according to the roles and settings the Customer chooses. For example, managers can see their team's time records.
• Service providers. Companies that help us run the Service, under contracts that limit how they use the information (Section 7).
• At a Customer's direction. When a Customer connects another service, such as QuickBooks Online, Netchex payroll, UniFi Protect cameras or an AI agent through the WashConsole MCP connector, we send it the information the Customer chooses, and that service handles it under the Customer's own agreement with it. The same goes for exports the Customer downloads.
• Legal requirements and safety. When the law requires it, or to protect the rights, property or safety of our users, the public or WashConsole.
• Business transfers. In connection with a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. Service Providers

These companies help us run the Service. The ones that may process Customer Data, and how we tell Customers before adding a new one, are listed in our subprocessor list.

• Firebase/Google Cloud (Hosting, database, file storage, sign-in, push notifications, and text-message sign-in codes)
• Google Gemini API (AI features)
• Google Cloud Vision (Screening photos sent with complaints for unsafe content)
• Google Maps Platform (Maps, address suggestions, and site locations)
• Apple Maps (Address suggestions in the iPhone and iPad app)
• Google reCAPTCHA (Blocking spam on sign-in and public forms)
• SendGrid (Sending notification and account email)
• Sentry (Error reports, bug reports, and session replays)
• EMQX Cloud (Messaging for connected devices)
• Outscraper (Collecting public Google reviews of your sites)
• NHTSA vPIC (U.S. government vehicle database that decodes VINs on complaints)
• Google Analytics (Website and web app usage statistics)
• Stripe (Payments and billing)
• Intuit Mailchimp (Product news and marketing email)
• Calendly (Booking demos)

8. Cookies and Analytics

We use cookies and similar browser storage to keep you signed in, remember your preferences and protect the Service. Our website and web app also use Google Analytics to count visits and see which pages are used. When you are signed in, we send Google Analytics your login's internal ID, so that visits from your different devices count as one person. You can block or delete cookies in your browser settings, but blocking all of them will stop you from signing in.

9. Data Security

We use technical and organizational measures to protect information, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access controls enforced on our servers by role and site, and audit logging
• Private storage for sensitive files such as clock-in photos, shown only through short-lived links
• Kiosk PINs stored as one-way hashes, and optional two-step verification for sign-in
• Secure authentication with automatic session timeout
• Regular security assessments

No system is perfectly secure. If we learn of a security incident that affects your information, we will notify the affected Customers and people as the law requires.

10. Data Retention and Deletion

We keep information for as long as the Customer's account exists, unless a shorter period is stated in this policy or the Customer deletes it sooner. Customers can delete many records themselves, such as a team member's profile.

• Ending a subscription does not delete data. When a subscription ends or is suspended, the account's data stays in place. The account owner can ask us for a copy of it at any time while we hold it, and we will provide it within 30 days.
• Deleting an account. The account owner can ask us to delete the account and its data in the app or at washconsole.com/delete-account. After a 48-hour period in which the request can be cancelled, we delete the data from our active systems, ordinarily within 30 days. Copies in our backups are deleted automatically within 100 days.
• Deleting your own login. Anyone else who signs in can delete their own login the same way. Records their employer keeps about their work stay with the employer.
• Records we must keep. We keep billing and tax records, records the law requires us to keep, and information needed to resolve disputes or prevent fraud for as long as those purposes require.
• Records Customers must keep. Employers must keep many employment records, such as payroll and time records, for years. WashConsole is not a substitute for that, so Customers should export and keep the records the law requires them to keep.

11. Your Rights and Choices

• If your information is Customer Data (you work for, applied to, or are a customer of a car wash that uses WashConsole), contact that car wash. If you contact us instead, we will refer your request to them and help them respond.
• For information we hold for our own purposes, you can ask to access, correct or delete it, or to receive a copy, and you can unsubscribe from marketing email at any time. Depending on where you live, you may have other rights under local law. We will not treat you differently for using them.

To make a request, email contact@washconsole.com. We may need to verify your identity, and someone you authorize can make a request for you. If we decline a request, you can ask us to reconsider by replying to our response.

13. Email and Notifications

We send service messages, such as sign-in, security, billing and account notices, to people who use WashConsole; these cannot be turned off while you have an account. Notifications about work in an account, such as a schedule change, can be managed in the app's notification settings and on your device. Product news and marketing email can be stopped at any time with the unsubscribe link in each message.

14. Children and Young Workers

WashConsole is a business tool and is not directed to children. Car washes may use it to manage employees under 18 where the law allows them to work, and the employer is responsible for any consent the law requires for those workers. We do not knowingly collect information from children under 13. If you believe a child under 13 has an account, contact us and we will delete it.

15. Where Information Is Stored

We store information in the United States, on Google Cloud. Some of our service providers may process it in other countries where they operate, under contracts that protect it.

16. Changes to This Policy

We may update this policy. Before a material change takes effect, we will tell account owners by email or in the app. We will also update the "Last updated" date above.

17. Contact Us

Questions about this policy or our data practices: WashConsole INC, 12022 Sprite Lane, Orlando, FL 32832, United States · contact@washconsole.com · (412) 927-4677