Privacy Policy

Last Updated: September 10, 2026

This Privacy Policy explains how WaxStak (“WaxStak,” “we,” “us,” or “our”) handles personal information across three places: the waxstak.com website, the WaxStak platform used by the businesses that subscribe to it, and the WaxStak Technician mobile app used by those businesses’ field staff.

If you are a vehicle owner who books with a business that uses WaxStak, the customer portal has its own, separate notice: see the Customer Portal Privacy Notice.

By using the waxstak.com website, the WaxStak platform, or the WaxStak Technician app, you consent to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

Account Information: Name, email address, phone number, tenant name, and password when you create an account
Billing Information: Payment card details, billing address, and transaction history
Business Data: Customer information, job details, schedules, invoices, and other data you enter into the Service
Communications: Information you provide when contacting our support team or participating in surveys

When you contact us through the website. If you email us or submit a form on waxstak.com, we receive what you choose to share — typically your name, email address, business name, and the contents of your message. You decide what to send; please do not include sensitive information you would rather we did not hold.

1.2 Information Collected Automatically

When you use the Service, we automatically collect certain information, including:

Device Information: Device type, operating system, browser type, and unique device identifiers
Usage Data: Features accessed, pages viewed, actions taken, and time spent on the Service
Location Data: General location based on IP address; precise location only with your consent for field service features
Log Data: IP address, access times, and error logs

1.3 Information from Third Parties

We may receive information about you from third parties, including:

Authentication providers (Google, Apple) if you choose to sign in with those services
Payment processors for transaction verification
Integration partners when you connect third-party services to your account

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Process transactions and send related information
Send technical notices, updates, security alerts, and support messages
Respond to your comments, questions, and customer service requests
Monitor and analyze usage trends to improve user experience
Detect, investigate, and prevent fraudulent transactions and other illegal activities
Personalize and improve your experience
Send promotional communications (with your consent where required)
Comply with legal obligations

3. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, we process your personal data based on the following legal grounds:

Purpose	Legal Basis
Providing the Service	Performance of contract
Processing payments	Performance of contract
Sending service communications	Legitimate interest
Improving the Service	Legitimate interest
Marketing communications	Consent
Legal compliance	Legal obligation

4. How We Share Your Information

We may share your information in the following circumstances:

4.1 Service Providers. We share information with third-party vendors who perform services on our behalf, such as payment processing, data hosting, analytics, and customer support. These providers are contractually obligated to protect your information.

4.2 Business Transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.3 Legal Requirements. We may disclose information if required by law or in response to valid legal process, such as a subpoena, court order, or government request.

4.4 Protection of Rights. We may disclose information to protect our rights, privacy, safety, or property, or that of our users or others.

4.5 With Your Consent. We may share information with third parties when you give us explicit consent to do so.

We do not sell your personal information.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of the Service. These technologies help us analyze trends, administer the Service, track user movements, and gather demographic information.

Types of Cookies We Use:

Essential Cookies: Required for the Service to function properly
Analytics Cookies: Help us understand how users interact with the Service
Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

We use Google Analytics to understand how visitors use the Site so we can improve it. Google Analytics sets cookies and processes usage data on our behalf; see Google’s Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on, and you can block or delete cookies in your browser settings. Doing so may affect how parts of the Site work.

6. The WaxStak Technician Mobile App

This section describes the WaxStak Technician app for Android and iOS. It applies in addition to the rest of this policy, and it governs only the app — not this website.

WaxStak Technician is a workforce app for businesses that subscribe to WaxStak. It is used by those businesses’ own staff working in the field, and is not offered to the general public. Two different relationships apply. We are the controller of your account information and use it to operate the app. The customer, vehicle, job and scheduling records you see in the app belong to the business that employs you; we process those on that business’s instructions, as their service provider. Requests to correct or delete your employer’s records go to them, and we act on their instruction.

6.1 What the app collects

Account and profile information — your name, work email address, and the role and permissions your employer assigns you.
Work you record — jobs you complete, line items, notes, quotes, clock-in and clock-out times, breaks, and odometer readings you enter at the start and end of a route.
Photographs you take — before-and-after photos of the vehicles you service, which you choose to capture and which are attached to the job record.
Precise location, only when you ask for it — described below.
Device and diagnostic information — device model, operating system version, app version, and error reports if the app fails.

6.2 Location

Location is used for one thing: to set the starting point of your route when you choose to. If you tap Current location, the app reads your device’s location at that moment and sends those coordinates to us so the route can be planned from where you actually are.

The app reads your location only while it is open and only in response to that action. It does not run in the background, does not follow you between jobs, and is not used to check your attendance or to verify that you arrived anywhere. You can decline the location permission and keep using the app — the route start point can be set to your employer’s office, your home address, or chosen manually instead.

6.3 Photographs

The camera is used only when you choose to photograph a vehicle you are servicing. The app does not access your photo library, does not take photographs on its own, and never records video or audio.

Photographs are uploaded to our storage and attached to the job. Your employer can see them, and they may be included in a job completion summary sent to the vehicle’s owner. We generate resized copies for display, and those copies carry no camera or location metadata.

6.4 Information stored on your device

The app is built to keep working without a signal. To do that it keeps a copy of your employer’s working records on the device — jobs, customers and their contact details and service addresses, vehicles, routes, pricing and catalog information — so you can work through a shift with no connection and sync afterwards. Because you may be sent to any of your employer’s customers, this copy is not limited to the jobs currently assigned to you.

It is held in the app’s private storage, which other apps cannot read. It is removed when you sign out and when your employer revokes your access. Your sign-in credential is held separately, in the secure key storage your device provides, protected by your device’s screen lock or biometric unlock.

6.5 Fingerprint and face unlock

If you turn on biometric unlock, your device asks for your fingerprint or face before releasing your saved sign-in credential. That check happens entirely on your device, by the operating system. We never receive, see or store your fingerprint, face data, or any biometric template — the app is only told whether the check passed.

6.6 Crash and error reporting

When the app hits an error it sends a diagnostic report to PostHog, our error-monitoring provider, so we can find and fix the fault. A report contains the technical details of the failure and an identifier for your employer’s account. It does not contain your name or email address, we do not record your screen or session, and we do not use this for product analytics or advertising.

6.7 Notifications

The app can notify you when a job is assigned to you. These notifications are generated on your device when it syncs — they are not push messages sent from outside, and they contain only the reference needed to open the job.

6.8 What the app does not do

The app does not collect your contacts, calendar, call history, SMS messages, health data, or files outside its own storage. It does not use your microphone. It does not track your location in the background. It does not use advertising identifiers, and contains no advertising or third-party trackers. We do not sell your information and we do not share it for advertising.

6.9 Keeping and deleting app information

We keep your employer’s records for as long as their account with us exists, including while an account is inactive or dormant, so that nothing is lost if they return. We do not delete records on a timer.

When an account is closed, your employer can ask us to anonymize their information. Anonymization irreversibly overwrites the data that identifies people — names, email addresses, phone numbers and addresses — and cannot be undone. Financial records are not deleted: invoices, payments and accounting entries are retained for the periods tax and business-records law require, and afterwards in a form that no longer identifies anyone. The copy held on your device is cleared when you sign out or when your access is revoked.

To ask about, access, correct, export or delete personal information, email support@waxstak.com. We respond within 30 days. Where the information belongs to your employer, we will pass the request to them and act on their instruction.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

When you close your account, you can ask us to anonymize your information. Anonymization irreversibly overwrites the data that identifies people — names, email addresses, phone numbers and addresses — both yours and your customers’. It is permanent and cannot be undone.

We do not delete your financial records. Invoices, payments and accounting entries are retained for the periods tax and business-records law require, and beyond, in a form that no longer identifies anyone. Accounting entries are immutable by design and are never altered or removed.

8. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption of data in transit (TLS/SSL) and at rest
Access controls and authentication requirements
Regular security assessments and monitoring
Employee training on data protection
Incident response procedures

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights and Choices

9.1 All Users

Account Information: You can update your account information through your account settings
Marketing Communications: You can opt out of marketing emails by clicking “unsubscribe” or adjusting your notification preferences
Cookies: You can manage cookie preferences through your browser settings

9.2 EEA, UK, and Swiss Residents (GDPR)

If you are in the EEA, UK, or Switzerland, you have the following additional rights:

Access: Request a copy of the personal data we hold about you
Rectification: Request correction of inaccurate personal data
Erasure: Request deletion of your personal data (“right to be forgotten”)
Restriction: Request restriction of processing of your personal data
Portability: Request a copy of your data in a structured, machine-readable format
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent where processing is based on consent

9.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: Request information about the categories and specific pieces of personal information we have collected
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)
Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights

To exercise any of these rights, please contact us at privacy@waxstak.com. We will respond to your request within the timeframes required by applicable law.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country.

When we transfer data internationally, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or we transfer to countries that have been deemed to provide an adequate level of protection.

11. Children’s Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

WaxStak
Privacy Team
Email: privacy@waxstak.com

For general support inquiries: support@waxstak.com