Privacy Policy

Last Updated: October 26, 2026

This Privacy Policy explains how WaxStak (“WaxStak,” “we,” “us,” or “our”) handles personal information across three places: the waxstak.com website, the WaxStak platform used by the businesses that subscribe to it, and the WaxStak Field mobile app used by those businesses’ field staff.

If you are a vehicle owner who books with a business that uses WaxStak, the customer portal has its own, separate notice: see the Customer Portal Privacy Notice.

By using the waxstak.com website, the WaxStak platform, or the WaxStak Field app, you consent to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, business name, and password when you create an account
• Billing Information: Payment card details, billing address, and transaction history
• Business Data: Customer information, job details, schedules, invoices, and other data you enter into the Service
• Communications: Information you provide when contacting our support team or participating in surveys

When you contact us through the website. If you email us or submit a form on waxstak.com, we receive what you choose to share — typically your name, email address, business name, and the contents of your message. You decide what to send; please do not include sensitive information you would rather we did not hold.

1.2 Information Collected Automatically

When you use the Service, we automatically collect certain information, including:

• Device Information: Device type, operating system, browser type, and unique device identifiers
• Usage Data: Features accessed, pages viewed, actions taken, and time spent on the Service
• Location Data: General location based on IP address; precise location only with your consent for field service features
• Log Data: IP address, access times, and error logs
• Sign-in Information: When you sign in, the IP address, the approximate country derived from it, and the type of device and browser used, so we can recognize a sign-in from a new device or country and alert you

1.3 Information from Third Parties

We may receive information about you from third parties, including:

• Authentication providers (Google, Apple) if you choose to sign in with those services
• Payment processors for transaction verification
• Security and fraud-prevention services that tell us the country and network type (for example, a VPN or data center) associated with an IP address
• Integration partners when you connect third-party services to your account

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send technical notices, updates, security alerts, and support messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyze usage trends to improve user experience
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Protect accounts from unauthorized access, including checking passwords against known data breaches and alerting you to sign-ins from a new device or country. The breach check never sends your password, or enough of it to recover it, outside our systems
• Detect and stop spam, phishing, and other abuse of the email and text messaging sent through the Service, as described in our Terms of Service (Section 4.2)
• Personalize and improve your experience
• Send promotional communications (with your consent where required)
• Comply with legal obligations

2.1 Message Abuse Detection

Businesses use WaxStak to send email and text messages to their own customers. To protect those recipients and the shared sending infrastructure, we monitor signals about that messaging: volume, bounces, complaints, the shape of recipient lists, and recent security changes to the account. Only when those signals indicate possible abuse do we review a small sample of the account’s recent messages, and only to decide whether they are spam, phishing, or otherwise abusive. We do not review message content for any other purpose, and we do not use it for advertising or profiling. The result is kept with the abuse record for that account.

3. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, we process your personal data based on the following legal grounds:

Purpose	Legal Basis
Providing the Service	Performance of contract
Processing payments	Performance of contract
Sending service communications	Legitimate interest
Improving the Service	Legitimate interest
Marketing communications	Consent
Legal compliance	Legal obligation
Account security and messaging abuse prevention	Legitimate interest

4. How We Share Your Information

We may share your information in the following circumstances:

4.1 Service Providers. We share information with third-party vendors who perform services on our behalf, such as payment processing, data hosting, analytics, and customer support. These providers are contractually obligated to protect your information.

4.2 Business Transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.3 Legal Requirements. We may disclose information if required by law or in response to valid legal process, such as a subpoena, court order, or government request.

4.4 Protection of Rights. We may disclose information to protect our rights, privacy, safety, or property, or that of our users or others.

4.5 With Your Consent. We may share information with third parties when you give us explicit consent to do so.

We do not sell your personal information.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of the Service. These technologies help us analyze trends, administer the Service, track user movements, and gather demographic information.

Types of Cookies We Use:

• Essential Cookies: Required for the Service to function properly
• Analytics Cookies: Help us understand how users interact with the Service
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

We use Google Analytics to understand how visitors use the Site so we can improve it. Google Analytics sets cookies and processes usage data on our behalf; see Google’s Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on, and you can block or delete cookies in your browser settings. Doing so may affect how parts of the Site work.

Advertising on our website. Our marketing website (waxstak.com) uses the Meta Pixel, a tool from Meta Platforms, to measure how our ads perform and to show our ads to people who have visited the Site. It records visits and actions such as joining our beta list, using cookies and similar technology. When you join our beta list, it also sends Meta a hashed (scrambled) copy of the name, email address and phone number you enter, so Meta can match the signup to an ad you saw; Meta does not receive them in readable form. It is not used in the WaxStak platform or the WaxStak Field app. See Meta’s Privacy Policy; you can control ads based on your activity in your Meta ad preferences, and you can block or delete cookies in your browser.

6. The WaxStak Field Mobile App

This section describes the WaxStak Field app for Android and iOS. It applies in addition to the rest of this policy, and it governs only the app — not this website.

WaxStak Field is a workforce app for businesses that subscribe to WaxStak. It is used by those businesses’ own staff working in the field, and is not offered to the general public. Two different relationships apply. We are the controller of your account information and use it to operate the app. The customer, vehicle, job and scheduling records you see in the app belong to the business that employs you; we process those on that business’s instructions, as their service provider. Requests to correct or delete your employer’s records go to them, and we act on their instruction.

6.1 What the app collects

• Account and profile information — your name, work email address, and the role and permissions your employer assigns you.
• Work you record — jobs you complete, line items, notes, quotes, clock-in and clock-out times, breaks, and odometer readings you enter at the start and end of a route.
• Photographs you take — before-and-after photos of the vehicles you service, which you choose to capture and which are attached to the job record.
• Precise location, only when you ask for it — described below.
• Device and diagnostic information — device model, operating system version, app version, and error reports if the app fails.
• A notification token — if you allow notifications, your device’s push token, so we can tell your device when a job is assigned to you. It is tied to your signed-in session and dropped when you sign out.
• Card details you enter for a customer — when you take a card payment, the card number is typed into a form hosted by our payment processor and goes directly to them. It never passes through our servers; we receive only a single-use token that stands for the card.

6.2 Location

Location is used for one thing: to set the starting point of your route when you choose to. If you tap Current location, the app reads your device’s location at that moment and sends those coordinates to us so the route can be planned from where you actually are.

The app reads your location only while it is open and only in response to that action. It does not run in the background, does not follow you between jobs, and is not used to check your attendance or to verify that you arrived anywhere. You can decline the location permission and keep using the app — the route start point can be set to your employer’s office, your home address, or chosen manually instead.

6.3 Photographs

The camera is used only when you choose to photograph a vehicle you are servicing. The app does not access your photo library, does not take photographs on its own, and never records video or audio.

Photographs are uploaded to our storage and attached to the job. Your employer can see them, and they may be included in a job completion summary sent to the vehicle’s owner. Photographs are stripped of camera and location metadata on your device, before they are uploaded — so the coordinates of where a photograph was taken never reach us at all.

6.4 Information stored on your device

The app is built to keep working without a signal. To do that it keeps a copy of your employer’s working records on the device — jobs, customers and their contact details and service addresses, vehicles, routes, pricing and catalog information — so you can work through a shift with no connection and sync afterwards. Because you may be sent to any of your employer’s customers, this copy is not limited to the jobs currently assigned to you.

It is held in the app’s private storage, which other apps cannot read. It is removed when you sign out and when your employer revokes your access. Your sign-in credential is held separately, in the secure key storage your device provides, protected by your device’s screen lock or biometric unlock.

6.5 Fingerprint and face unlock

If you turn on biometric unlock, your device asks for your fingerprint or face before releasing your saved sign-in credential. That check happens entirely on your device, by the operating system. We never receive, see or store your fingerprint, face data, or any biometric template — the app is only told whether the check passed.

6.6 Crash and error reporting

When the app hits an error it sends a diagnostic report to PostHog, our error-monitoring provider, so we can find and fix the fault. A report contains the technical details of the failure and an identifier for your employer’s account. It does not contain your name or email address, we do not record your screen or session, and we do not use this for product analytics or advertising.

The barcode and VIN scanner uses Google’s on-device scanning library, which sends Google technical performance information — device model, operating system and app version, and how long a scan took. The camera image is processed on your device and never leaves it.

6.7 Notifications

The app can notify you when a job is assigned to you. If you allow notifications, your device registers with your phone’s push service — Apple’s on iPhone, Google’s Firebase Cloud Messaging on Android — and we store the resulting token with your signed-in session. A notification carries only the job reference needed to open it. If you decline, or the push service is unavailable, the app raises the same notice itself when it next syncs.

6.8 What the app does not do

The app does not collect your contacts, calendar, call history, SMS messages, health data, or files outside its own storage. It does not use your microphone. It does not track your location in the background. It does not use advertising identifiers, and contains no advertising or third-party trackers. It does not store the card numbers you enter for a customer. We do not sell your information and we do not share it for advertising.

6.9 Keeping and deleting app information

We keep your employer’s records for as long as their account with us exists, including while an account is inactive or dormant, so that nothing is lost if they return. We do not delete records on a timer.

When an account is closed, your employer can ask us to anonymize their information. Anonymization irreversibly overwrites the data that identifies people — names, email addresses, phone numbers and addresses — and cannot be undone. Financial records are not deleted: invoices, payments and accounting entries are retained for the periods tax and business-records law require, and afterwards in a form that no longer identifies anyone. The copy held on your device is cleared when you sign out or when your access is revoked.

To ask about, access, correct, export or delete personal information, email support@waxstak.com. We respond within 30 days. Where the information belongs to your employer, we will pass the request to them and act on their instruction.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

When you close your account, you can ask us to anonymize your information. Anonymization irreversibly overwrites the data that identifies people — names, email addresses, phone numbers and addresses — both yours and your customers’. It is permanent and cannot be undone.

We do not delete your financial records. Invoices, payments and accounting entries are retained for the periods tax and business-records law require, and beyond, in a form that no longer identifies anyone. Accounting entries are immutable by design and are never altered or removed.

8. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures
• Breached-password checks, sign-in alerts for new devices and countries, and optional two-factor authentication

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights and Choices

9.1 All Users

• Account Information: You can update your account information through your account settings
• Marketing Communications: You can opt out of marketing emails by clicking “unsubscribe” or adjusting your notification preferences
• Cookies: You can manage cookie preferences through your browser settings

9.2 EEA, UK, and Swiss Residents (GDPR)

If you are in the EEA, UK, or Switzerland, you have the following additional rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data (“right to be forgotten”)
• Restriction: Request restriction of processing of your personal data
• Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent where processing is based on consent

9.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)
• Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights

To exercise any of these rights, please contact us at privacy@waxstak.com. We will respond to your request within the timeframes required by applicable law.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country.

When we transfer data internationally, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or we transfer to countries that have been deemed to provide an adequate level of protection.

11. Children’s Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

WaxStak
Privacy Team
Email: privacy@waxstak.com

For general support inquiries: support@waxstak.com