Privacy Policy

1. Who we are and scope

WashProof is operated by Himara LLC, Kansas, USA (“Himara”, “we”, “us”). This Privacy Policy explains what information we collect through the WashProof apps, the site device app, our websites and related services (the “Service”), how we use and share it, and the choices you have.

WashProof is a business service. Our customers are wash companies (“Customers”). They decide who uses the Service on their behalf, including their managers, their crew members (“Employees”) and the companies whose trailers they wash (“Vendors”). For information a Customer puts into the Service about its people and operations, we act as a service provider (sometimes called a processor) and handle it on the Customer’s instructions. If you are an Employee or Vendor User and have questions about how your employer or business partner uses WashProof, please contact them as well as us.

We do not sell personal information, and we do not share it for targeted advertising.

2. Information we collect

Information provided by Customers and users

• Account information: name, email address, role, company, the Locations a person can access, language preference and notification preferences of managers and Vendor Users. Passwords are handled by our authentication provider and stored only in hashed form.
• Employee information: Employee names, the Locations they work at, a personal PIN (stored only as a one-way hash, which we cannot read), and clock-in and clock-out times.
• Wash records: trailer unit numbers, the trailer’s owning company, service performed, Location, start and finish times, who logged, started and finished each wash, notes, approval and decline decisions with the person, time and reason, edits and the reasons for them, and messages between managers and Vendor Users.
• Photos: photos of trailers taken at the wash bay as proof of each wash, and company or service images uploaded by managers. Wash photos are meant to show the trailer and its unit number but may incidentally capture people, other vehicles or license plates in the background.
• Communications: messages you send us, such as support emails.

Information collected automatically

• Device and app data: device model, operating system, app version, language setting, the Location a Site Device is paired to, sync status and error logs, and the IP address used to connect.
• Push notification tokens: an identifier from Apple or Google that lets us send alerts to a device.
• Security and audit logs: sign-ins, sensitive actions (for example edits, deletions and administrative access) and the time they happened.
• On-device storage: the apps store data on the device (including records and photos waiting to sync, and your session) so they work offline. This data stays on the device until it is synced or removed.

We do not collect precise GPS location, contacts, health information, payment card numbers or Social Security numbers through the Service.

3. How we use information

• To provide the Service: logging washes, reading unit numbers, routing approval requests, showing dashboards and reports, generating PDFs and CSV exports, and syncing offline devices.
• To send alerts and messages that users turn on, such as new approval requests, finished washes and daily summaries, and to send account emails such as invitations and password resets.
• To bill Customers for active Locations.
• To secure the Service, prevent fraud and abuse, keep audit trails, and troubleshoot problems.
• To provide support and respond to requests.
• To improve the Service, using aggregated or de-identified information where possible.
• To comply with law and enforce our Terms of Service.

We do not use Customer Data for advertising, and we do not use the AI provider’s output to make decisions about individuals.

4. AI processing of photos

To read a trailer’s unit number, the wash photo is sent from our servers to OpenRouter, an AI routing service, which passes it to a vision model from Google (Gemini) or, as a backup, inclusionAI. We send only the image and an instruction to read the unit number; we do not send names, email addresses or other account details with it. The model returns the number it reads, which the user can correct. These providers process the image under their own terms and privacy policies. We may change AI providers over time and will update this policy when we do.

5. How we share information

Within the Service

• Within a Customer: managers and owners see information for the Locations their role allows, including Employee names and time records.
• With Vendors: a Vendor User sees wash records of their own company’s trailers, including photos, unit numbers, services, times, Location names, the names of crew members recorded on those washes, approvals, edits and messages. Vendors do not see a Customer’s other customers, Employee hours or billing.

Service providers

We use the following providers to run the Service. They may process personal information only to provide their services to us.

Other sharing

• Legal reasons: when required by law, subpoena or court order, or to protect the rights, safety or property of our users, the public or Himara.
• Business transfers: as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.
• With permission: when a Customer or user asks us to.

6. How long we keep it

• Wash records and photos are kept for as long as the Customer’s account is active, unless the Customer chooses a shorter retention period in its settings or asks us to delete them. Proof of past washes is the purpose of the Service, so by default photos are kept indefinitely while the account is active.
• Account information is kept while the account is active and deleted when the account is deleted, as described below.
• Push tokens are removed when a user signs out, turns off notifications, or the token stops working.
• Security and audit logs are kept for as long as needed to protect the Service and the integrity of wash records, and for at least the life of the related records.
• After a Customer cancels, we delete its data from active systems within 90 days after the 30-day export window described in our Terms, and from backups as they expire on their normal schedule.

We may keep information longer when the law requires it or to resolve disputes and enforce agreements.

7. Deleting your account and data

• In the app: managers and Vendor Users can delete their own account from the app’s settings.
• By email: anyone can ask us to delete their account or personal information by emailing himarallc@gmail.com. We will confirm the request and verify your identity before acting.
• Employees do not have sign-in accounts. To have Employee information corrected or removed, ask your employer (the Customer), who can do it in the app, or contact us and we will work with your employer.

Deleting a personal account removes the sign-in account and personal settings. Wash records belong to the Customer and may keep showing the name of the person who logged, washed, approved or edited them, because those records are business records the Customer and its Vendors rely on.

8. Security

We protect information with encryption in transit (HTTPS/TLS), encryption at rest provided by our hosting provider, database rules that keep each Customer’s data separate, hashed passwords and PINs, multi-factor authentication for our own administrative access, least-privilege access for our staff, and audit logs of sensitive actions. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify affected Customers and individuals as the law requires.

9. Where data is stored

We store Service data in the United States. Some service providers, such as AI and push notification providers, may process data in other countries. When they do, we rely on their contractual commitments to protect it.

10. Children

The Service is a workplace tool for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

11. California residents

If you live in California, the California Consumer Privacy Act, as amended (“CCPA”), gives you rights regarding your personal information. Where we process information as a service provider for a Customer (for example, Employee information), please direct requests to that Customer; we will help them respond.

Categories collected in the last 12 months: identifiers (name, email, device identifiers, IP address, push tokens); professional or employment-related information (role, Location, clock-in and clock-out times, wash activity); internet or other electronic network activity (app usage, logs); audio, electronic or visual information (wash photos); and account log-in credentials (sign-in details and hashed PINs). The sources, purposes and recipients are described in Sections 2, 3 and 5. We use account credentials only to authenticate users, so the right to limit use of sensitive personal information does not apply.

Your rights:

• to know what personal information we collect, use and disclose, and to get a copy;
• to delete personal information, subject to legal exceptions;
• to correct inaccurate personal information;
• to opt out of the sale or sharing of personal information (we do not sell or share it as those terms are defined in the CCPA);
• not to be discriminated against for exercising these rights.

To make a request, email himarallc@gmail.com. We will verify your request by confirming information we already hold, such as access to your account’s email address. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity directly. We will respond within the time the law requires (generally 45 days).

12. Other U.S. states

Residents of other states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) may have similar rights to access, correct, delete and port their information and to opt out of targeted advertising, sale or profiling. We honor these requests as the law requires; email us to make one. If we deny a request, you may appeal by replying to our response, and we will explain the outcome of the appeal.

13. This website and cookies

This marketing website does not use advertising or analytics cookies and does not track you across other sites. It stores a single setting in your browser (your light or dark theme choice) if you change it. Our hosting provider, Cloudflare, processes your IP address and request details to deliver and protect the site. If you email us, we use your message only to reply and keep a record of the conversation.

If you send the demo, pricing or waitlist form, we store what you enter (name, company, work email, number of wash sites, your message) to reply to you and to tell you when WashProof is available to you. We also store a one-way hash of your IP address and a shortened browser description to stop spam and abuse; we do not store your IP address itself. The form is protected by Cloudflare Turnstile, which checks that a person is sending it. We do not add you to a mailing list or share these details with anyone. To have them deleted, email us.

14. Changes to this policy

We may update this policy. We will post the new version here with a new “Last updated” date and, for material changes, notify Customer account owners by email or in the app before the change takes effect.

15. Contact

Questions or requests about privacy: himarallc@gmail.com
Himara LLC, Kansas, USA