Customer Portal Privacy Notice
Last updated: September 10, 2026
This notice explains what information the WaxStak customer portal holds about you and what is done with it. The portal is the website you use to view your appointments, vehicles, invoices and photos with a car-care business you booked with. It is reached at that business’s own web address, such as yourdetailer.portal.waxstak.com.
This notice covers the customer portal only. The WaxStak Privacy Policy covers the waxstak.com website and the WaxStak Technician app used by businesses’ field staff.
Two different relationships
WaxStak makes the software. The business you booked with uses it to run their operation.
- The business owns your records. Your contact details, vehicles, appointments, invoices and photos belong to the business that serves you. WaxStak stores and processes them on that business’s instructions, as their service provider. The business decides what to collect, how long to keep it, and who on their staff can see it.
- WaxStak operates the portal itself — signing you in, keeping the service secure, and diagnosing faults.
Because of this split, a request to correct or delete your information is normally the business’s to answer. See Your choices and rights below for how to make one either way.
You do not create a portal account
There is no sign-up. The business enters you as a customer in their own system, and the portal is a window onto the record they already hold. Booking through the portal does not ask you for your name, email address or phone number — you sign in first, and the booking is attached to the record that already exists.
What the portal holds about you
| Category | What it includes |
|---|---|
| Contact and identity | Your name or business name, email address, phone number, preferred language (English or Spanish), and the service addresses where work is performed. |
| Vehicles | Type, make, model, year, color and license plate of the vehicles the business services for you. |
| Appointments and jobs | Services booked, appointment dates and times, status, and any notes recorded about the work. |
| Photographs | Before-and-after photos of your vehicle taken by the technician who performed the work. |
| Invoices and payments | Amounts, dates, status, downloadable invoice PDFs, and your payment history with that business. |
| Saved cards | The card brand, the last four digits and the expiry date — never the full card number. See Payments. |
| Reviews | Any rating and review you choose to submit about a completed job. |
| Messaging preferences | Your text-message consent record, and whether you have opted out of review requests or marketing email. |
| Sign-in records | Whether your email address or phone number has been confirmed by a successful sign-in, and when you last signed in. |
How you sign in
There is no password. You enter your email address and we email you a six-digit code. The code is valid for ten minutes, allows five attempts, and is destroyed the moment it is used. We store only a scrambled (hashed) form of it, never the code itself.
Signing in with Google or Apple is offered as an alternative. When you use it, we ask Google or Apple for one thing only: your email address. We do not request or receive your name, profile, photo, contacts, calendar or anything else from those accounts. Signing in this way proves you control an email address the business already has on file — it cannot create a new account, and if the address is not already on the business’s records the sign-in simply does not succeed.
Staying signed in. After a successful sign-in your browser is given a sign-in token, stored in your browser’s own local storage on your device. It expires after 24 hours. Signing out removes it. It is not shared with anyone and is not an advertising identifier.
Cookies. The portal sets no advertising or tracking cookies. One cookie is used, and only while a Google or Apple sign-in is actually in progress: a short-lived security cookie that prevents someone from forging a sign-in on your behalf. It is deleted as soon as the sign-in finishes, successfully or not.
We do not confirm whether an address is on file. The sign-in screen gives the same response either way, so the portal cannot be used to discover who is a customer of a business.
Payments
Payments are processed by Finix, our payment provider.
When you enter card details, you are typing them into fields hosted and operated by Finix, embedded in the page. The card number never reaches WaxStak’s systems or the business’s. Finix returns a substitute token, and that is all our software ever handles. This is deliberate, and it is why we are able to keep your card details out of our infrastructure entirely.
What we keep so you can recognize a saved card is the brand, the last four digits and the expiry date. We also record when you authorized a card to be charged again in future, and when you withdrew that authorization.
To pay an invoice or set up recurring billing we send Finix your name, email address and phone number so they can identify you as the payer.
Removing a saved card disables it rather than erasing it. The record that you once authorized charges on that card has to survive, because it is the evidence of an agreement you made. A disabled card cannot be charged.
Photographs of your vehicle
Technicians photograph vehicles as a record of the work. Those photos appear in your portal against the job and the vehicle.
Photos are held in private storage and shown to you through links that expire after a short period — they are not published and cannot be reached by anyone who does not have access to your record.
Camera and location data is removed on the technician’s device, before the photo is uploaded. Every job photo is captured through a single path in the technician app, which strips EXIF metadata — including GPS coordinates — out of the image while it is still on the phone. That information therefore never reaches our storage at all. The smaller display copies the system generates afterwards are re-encoded, which removes such data a second time.
Text messages and email
Messages come from the business you booked with, not from WaxStak, and the program is transactional only — appointment confirmations, reminders, a notice that your technician is on the way, and a notice that your vehicle is ready. No promotional texts are sent through it. Full details are in the SMS Terms & Program Disclosure.
Consent to text messages is given by ticking a box on the booking form. The box is unticked by default and the booking can be completed without it. The exact wording you were shown is stored alongside your decision, along with the date and how it was given. These consent records are kept permanently and are never altered, because they are the record of what you agreed to.
Link tracking. Links inside text messages and review-request emails are recorded when they are clicked, so the business can tell whether a message reached you and was acted on. This records the click on that link only — it does not follow you around the web and does not observe anything you do elsewhere.
Opting out. Reply STOP to any text message to stop texts from that business. Review requests and marketing email each carry their own one-click opt-out link. These three are separate: opting out of review requests does not stop appointment reminders, and unsubscribing from marketing email does not stop invoices or receipts, which are records of a transaction rather than marketing.
Analytics and error monitoring
The portal uses PostHog to record which pages are viewed and to receive a diagnostic report when something in the site fails. We want to be specific about what that does and does not involve, because these tools are often assumed to do more than they do.
What is collected: which portal page was viewed, and the technical details of any error.
What is deliberately switched off or discarded:
- Your IP address is discarded before the record is sent — it is not stored.
- No session or screen recording. Your session is never replayed or watched.
- No click or form tracking. Individual clicks and typing are not captured.
- No profile is built about you. Your name, email address and customer record are never attached. The only identifier attached is which business’s portal was in use.
- Web addresses are stripped before recording. Query strings are removed and identifiers inside the address are replaced with placeholders — specifically so that one-time payment links, quote links and job links sent to you can never be transmitted to a monitoring service.
- No advertising identifiers, ad networks, or third-party trackers of any kind.
Apart from the payment fields described above, PostHog is the only third-party service the portal page loads.
What we never do
- We do not sell your personal information, and we never have.
- We do not share it for advertising or cross-context behavioral advertising.
- We do not send you marketing on our own behalf. WaxStak’s relationship is with the business, not with you.
- We do not use your information to train machine-learning models that serve anyone other than the business you booked with.
Who else can see your information
- The business you booked with — its owner and the staff they authorize, including the technician assigned to your vehicle, who sees your name, contact details, service address, vehicle and job.
- Service providers who help operate the platform, each only to the extent needed: our cloud hosting provider (Amazon Web Services, United States), Finix for payments, our email and text-message delivery providers, and PostHog for error monitoring.
- Legal and safety recipients, where required by law or to protect our rights, our users, or the public.
- A successor, if WaxStak is involved in a merger, acquisition or sale of assets — in which case we will post notice of any change to how information is handled.
Your information is never shown to another business on the platform. Each business’s records are isolated from every other’s, and a signed-in customer can reach only their own records.
Reviews you publish
If you submit a review and the business displays it publicly, it appears with your first name only, or as “Anonymous” if no name is available. Your surname, email address and phone number are never published. You can edit or delete a review you submitted at any time from the portal.
Keeping and deleting information
Records are kept for as long as the business’s account with WaxStak exists, including while it is dormant, so that nothing is lost if they return. We do not delete records on a timer.
When a record is deleted it is marked as deleted and stops being shown or used. Some records are deliberately retained even then:
- Consent records — the evidence of what you agreed to, and when.
- Financial records — invoices, payments and accounting entries are retained for the periods tax and business-records law require.
Your choices and rights
Depending on where you live you may have the right to access, correct, delete, or limit the use of your personal information, to receive a copy of it, and to opt out of certain processing. Residents of California (CCPA/CPRA) and of the EU and UK (GDPR) have these rights. We will not treat you differently for exercising them.
To make a request:
- Contact the business you booked with first. They control the record and can act on it directly. This is usually the fastest route.
- Or email support@waxstak.com. We will respond within 30 days. Where the information belongs to the business, we will pass the request to them and act on their instruction.
Please note that the portal does not currently provide a self-service button to export or delete your account — those requests are handled by the routes above.
Some things you can do yourself in the portal today: view and download your invoices, edit or delete a review you submitted, disable a saved card, withdraw authorization for recurring charges, pause or cancel a recurring plan where the business allows it, and opt out of review requests and marketing email.
Children
The portal is intended for adults arranging vehicle services and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us and we will delete it.
Where information is held
WaxStak is based in the United States and stores and processes information there. If you use the portal from another country, your information will be transferred to and processed in the United States, where data-protection laws may differ from those where you live.
Security
Access to the portal requires a code sent to an address the business already holds for you. Connections are encrypted. Card numbers are never in our possession. Sign-in codes are stored only in scrambled form. Access is withdrawn immediately when a business deactivates or removes a customer record.
Some links we email or text you — to pay an invoice, approve a quote, or view a job — grant access on their own without a sign-in, so that you do not have to sign in to act on them. Treat those links as you would a password and do not forward them.
Changes to this notice
We may update this notice. When we do we will revise the date at the top, and significant changes will be posted on this page.
Contact
Questions about this notice or about your information: support@waxstak.com.
WaxStak LLC