Privacy Policy

CarwashManage ("we", "us") provides car wash management software as an online service at carwashmanage.com. Our contact address is Nairobi Garage Westlands, 4th Floor, Westlands, Nairobi, Kenya, phone +254 705 091 683, email support@carwashmanage.com.

This policy explains what personal data we handle, why, and your rights under the Kenya Data Protection Act, 2019 and its regulations. It applies to our website, the CarwashManage app, the public car-tracking page and our support channels.

We are the data controller for information about our own customers - the car wash owners, managers and staff who create accounts - and about visitors to our website.

When a car wash uses CarwashManage to record its own customers (for example a driver's name, phone number, number plate, vehicle photos, wash history, loyalty points and payments), the car wash is the data controller and we act as its data processor. We process that data only on the car wash's instructions, to provide the service, and we do not sell it or use it to market to those customers ourselves. A car wash's customers who want to exercise their rights should contact that car wash first; we will help the car wash respond.

Account and business data:

• Name, phone number, email address and role of owners, managers and staff
• Business name, branches, location, services and prices, and Till or Paybill numbers
• Login and security data such as sign-in times and device or browser type

Operational data that a car wash enters into the app:

• Customer names, phone numbers and number plates; vehicle type; before and after photos; number-plate photos used for scanning
• Washes, carpet jobs, staff assignments, commissions, inventory, expenses, loyalty and membership records
• Payment records, including M-Pesa transaction details such as the payer's phone number, name as returned by M-Pesa, amount, transaction code and time
• CCTV camera connection details where the car wash adds them (we display the feed; we do not record it)

Website and support data: messages you send us by WhatsApp, phone, email or forms, and - only if you accept analytics cookies - anonymous usage statistics about how the website is used.

When a car wash sends an M-Pesa STK Push or connects its till through Safaricom's Daraja API or Kopo Kopo, payment requests and confirmations pass between Safaricom (or Kopo Kopo) and our servers so the payment can be matched to the right wash. Money goes directly to the car wash's own till; we never hold customer funds. A car wash's API keys for its till are stored encrypted and are only used by our servers to request and confirm its payments.

Subscription payments to us are processed by Paystack (by M-Pesa or card) or made directly to our M-Pesa Paybill/Till. Card details are entered on Paystack's secure checkout - we never see or store full card numbers, PINs or CVV codes. If you pay by card with auto-renew switched on, Paystack gives us a reusable payment token together with the card's brand and last four digits, which we use only to renew your plan; you can switch auto-renew off at any time on the Billing page. For manual M-Pesa payments we receive the transaction code you submit and use it to confirm your payment.

If you take part in our referral programme, we keep the M-Pesa number you give us for commission payouts and show you the names of the businesses you referred and the status of each commission.

We use personal data only for specific purposes and on a lawful basis under the Act:

• To provide and secure the service, and to process data on car washes' instructions (performance of a contract)
• To bill subscriptions, prevent fraud and keep financial records required by Kenyan law, including tax records (legal obligation and legitimate interests)
• To provide support, send service messages such as receipts and "car ready" WhatsApp notifications that a car wash triggers, and tell you about important changes (contract and legitimate interests)
• To email account owners about their subscription - payment receipts, trial and renewal reminders, and overdue notices. These are service messages that are part of the contract, not marketing
• To send marketing about our own service to business customers, which you can opt out of at any time (consent or legitimate interests)
• To measure website traffic, only with your consent through the cookie banner

We share data only with service providers that help us run the service and are bound to protect it:

• Our web hosting provider, which runs our servers, database and email
• Google Firebase, for sign-in and account security
• Paystack, for subscription payments by M-Pesa and card
• Safaricom (M-Pesa Daraja) and Kopo Kopo, for car washes' own customer payments
• Meta (WhatsApp Business), when a car wash sends WhatsApp notifications
• OpenAI, only when a user chooses to scan a vehicle photo to fill in its details - the photo is sent for that one request
• Google Analytics, only where you have accepted analytics cookies

We may disclose data where required by Kenyan law or a lawful request from a public authority, or to protect our rights and users' safety. We never sell personal data.

Some of our service providers store or process data on servers outside Kenya. Where that happens we rely on the safeguards allowed under the Data Protection Act, 2019 and its General Regulations, such as providers with appropriate security and contractual protections, and we transfer only what is needed to run the service.

We use encrypted connections (HTTPS), access controls by role and branch, authenticated sign-in, and restricted administrative access. Car wash owners control which staff can see which branches and data. No system is perfectly secure; if a personal data breach is likely to put people at risk, we will notify the Office of the Data Protection Commissioner (ODPC) and affected car washes as the law requires.

We keep account and operational data for as long as the car wash's account is active. After an account is closed, we delete or anonymise operational data within a reasonable period unless the car wash asks for an export first, except where we must keep records longer - for example billing and tax records, which Kenyan law generally requires to be kept for several years.

Under the Data Protection Act, 2019 you have the right to:

• Be informed about how your data is used
• Access the personal data we hold about you
• Have inaccurate data corrected and, where it applies, deleted
• Object to processing, including direct marketing
• Data portability, for example an export of your records

To use these rights, contact us at support@carwashmanage.com or +254 705 091 683. We may need to confirm your identity. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya.

The app uses browser storage that is necessary for it to work, such as keeping you signed in and remembering your selected branch. Analytics and advertising cookies are only set if you accept them in the cookie banner; you can decline and the site still works.

CarwashManage is a business tool for adults and is not directed at children. We do not knowingly collect personal data about children for our own purposes.

We may update this policy as the service or the law changes. We will post the new version here with a new date and tell account holders about significant changes. Questions about privacy? Contact CarwashManage, Nairobi Garage Westlands, 4th Floor, Westlands, Nairobi, Kenya, +254 705 091 683, support@carwashmanage.com.