ShineCrew1. Who is responsible for your data
ShineCrew is operated by Hello World Technologies LLC ("we", "us"), a limited liability company formed in the State of Wyoming, United States, at 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Reach us at support.carwash@helloworldtech.com.
Two different relationships, because ShineCrew has two kinds of user:
- Car wash owners and their staff. We are the controller for your account, your subscription and your use of the software.
- Customers who book a wash. The car wash business you booked with is the controller of your booking data; we are its processor, holding and handling that data on its instructions. If you want your booking history deleted, that business decides — but write to us and we'll help make it happen.
We are also the controller for this marketing website, covered in section 6.
2. What we collect
Account details
- Name, email address, phone number, and the role you hold (owner, cleaner or customer).
- A password, stored only as a salted hash — we cannot read it, and neither can anyone who gets the database.
- For customers: the service address where the car will be cleaned.
- For cleaners: an employee reference, listed skills, and the running rating and job count their washes have earned.
- An optional profile photo.
- When you last signed in, so we can spot unused accounts.
Booking and vehicle details
- Vehicle make, model, year, colour, size and registration plate.
- The date and time, the address, the street the car is parked on, and any notes you or the cleaner add.
- Photos and video of the vehicle, including the before & after pair captured on every job. These are taken at the address you gave, so treat them as location-revealing.
- Tyre-pressure readings, where the cleaner recorded a check.
- The status trail — assigned, accepted, started, completed or cancelled, and by whom, plus the reason if a cleaner declined.
Payments
- For a wash: the amount, currency and whether the booking has been marked paid. ShineCrew does not take card payment for washes — the customer settles with the car wash directly — so there is no card data of any kind attached to a booking.
- For a car wash owner's own ShineCrew subscription: a RevenueCat subscriber identifier (which is the car wash's own account id), the store product bought, and whether the subscription is active, trialling or expired.
- Never the card number, and never a payment method at all. The subscription is an in-app purchase: Apple or Google takes the payment inside their own sheet, and we are told only whether it succeeded.
Feedback and notifications
- Your rating out of five and any comment you leave, tied to the wash and the cleaner who did it.
- Notifications we've sent you in the app, and whether you read them.
- A OneSignal player identifier for your device, if push notifications are on, so booking updates can reach you.
What we do not collect
3. Why we use it, and on what legal basis
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account | Name, email, phone, password hash, role | Performance of a contract |
| Schedule and carry out a wash | Address, vehicle details, date, notes, photos | Performance of a contract |
| Record wash takings and confirm the subscription | Payment records, RevenueCat subscriber and product identifiers | Performance of a contract; legal obligation (tax records) |
| Send booking updates | Device push identifier, booking status | Performance of a contract; consent for push, given at the OS prompt |
| Show ratings and handle complaints | Feedback, booking history | Legitimate interest in service quality |
| Keep the service secure and prevent abuse | Sign-in times, rate-limit records | Legitimate interest in security |
| Reply to support enquiries | What you wrote to us, plus app version and platform | Legitimate interest in answering you |
4. Who can see it
Your data is scoped to one car wash. Every request to our API is filtered by the business the signed-in account belongs to, on the server — not merely hidden in the interface. One car wash cannot read another's bookings, customers, cleaners or photographs.
Within your car wash:
- The owner sees bookings, customers, cleaners, payments and feedback.
- A cleaner sees only the jobs assigned to them, with the car brief and the address needed to do the work.
- A customer sees only their own bookings.
The processors we use
| Who | For | What they receive |
|---|---|---|
| Apple and Google | Selling and billing the owner's ShineCrew subscription in-app | The payment details, taken directly by them — we never see them |
| RevenueCat | Telling us whether that subscription is active | The car wash's account id and the store's purchase records |
| OneSignal | Push notification delivery | A device identifier and the notification text |
| [YOUR HOSTING PROVIDER] | Servers, database and uploaded photos | Everything stored, at rest — they do not use it |
| Discord | Where support and website enquiries land | Your name, email and the message you sent |
| Umami (self-hosted) | Website analytics only | Aggregate page views — no personal data, no cookies |
Beyond these, we disclose data only where the law requires it, or to a buyer if the business is sold — in which case this policy travels with it.
Commitments we'll hold ourselves to
- We never sell personal information, and we never share it for cross-context behavioural advertising.
- We never use your data, your customers' data or your job photos to train third-party AI models.
- We never use booking data for advertising, profiling or automated decisions with legal effects.
5. Security and retention
- Access requires authentication, and every tenant-scoped query is locked to one business on the server.
- Passwords are salted and hashed; nobody at ShineCrew can read yours.
- Card data never reaches our systems.
How long we keep things:
- Account: while it's open, and 30 days after closure so it can be restored if closed by mistake.
- Bookings and job photos: for as long as the car wash needs them for its own records, then deleted on request.
- Payment records: six years, because tax law requires it. This one we cannot delete on request.
- Support messages: 24 months.
- Website analytics: aggregate only, 24 months, not linked to anyone.
6. This website
The marketing site you are reading sets no cookies and shows no ads. We use Umami, self-hosted at analytics.helloworldtech.com, which is cookieless: it records the page viewed, the referrer, browser, device type, language and country, and which links were clicked, all in aggregate. Your IP is used momentarily to derive a country and a rotating salted identifier, and is never written to the analytics database.
Contact form contents are never sent to analytics. Your name, email and message are deliberately excluded from every event. When you submit the form your IP is held in memory for a few minutes purely to rate-limit spam, and never written to disk. See the Cookie Policy for why there is no consent banner.
7. Your rights
Wherever you are, you can ask us for a copy of your personal data, correct it, delete it, restrict or object to how we use it, ask for it in a portable format, or withdraw consent where consent is what we relied on. We are a US company and not every one of those is a statutory right in every state — but we honour all of them for everyone rather than checking your address first. Where UK, EU or US state privacy law does grant you a right, it applies on top of this and is not limited by it.
Some of it you can do yourself, immediately:
- Edit your name, email and phone in Profile → Edit Profile.
- Turn push notifications off in your device settings.
- Write to us from Profile → Support without leaving the app.
For anything else, email support.carwash@helloworldtech.com and we'll respond within one month — usually within 2 business days. If you booked a wash, we may need to pass the request to the car wash that holds it, and we will tell you when we do.
If you think we've got it wrong, tell us first — we would rather fix it than argue about it. You can also complain to a regulator: in the United States, the U.S. Federal Trade Commission (ftc.gov) or your state Attorney General. If you are in the UK or EU, your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
If you are in California
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. You have the right to know, to delete, to correct, and not to be discriminated against for exercising any of them.
8. Children
ShineCrew is not for children. Accounts are for people aged 18 or over, and we don't knowingly collect data about children. If you believe a child's data has reached us, tell us and we'll remove it.
9. Where your data is processed
We are based in the United States, and your data is processed there and wherever the processors listed in §5 — our hosting provider, RevenueCat, Apple, Google, OneSignal and Discord — operate. Using ShineCrew from outside the US means your data is transferred to the US.
If you are in the UK or EU, those transfers are made under the UK Addendum and the European Commission's standard contractual clauses, or an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified under it. Ask us at support.carwash@helloworldtech.com and we'll tell you which one applies to a given provider.
10. Changes
If what we collect changes, we'll update this page and the effective date at the top. Material changes are called out here and notified in the app rather than slipped in quietly.
Contact
Questions about this document, or anything else, go to one monitored inbox — we aim to reply within 2 business days.
Hello World Technologies LLC
30 N Gould St, Ste N
Sheridan, WY 82801
United States
Email: support.carwash@helloworldtech.com
You can also write to us from inside the app — Profile → Support — or use the contact form on this site.