CARWASH CONNECT — PRIVACY POLICY

Effective Date: August 6, 2026
Last Updated: August 6, 2026

1. INTRODUCTION

This Privacy Policy explains how Flying Fish Auto Wash, LLC, a Texas limited liability company doing business as CarWash Connect ("CarWash Connect," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use our website, mobile applications, and related services (collectively, the "Platform").

CarWash Connect is a marketplace that connects Customers who want their vehicles washed with independent Washers who perform the work. Because the Platform is two-sided, some of your information is necessarily shared with the other party to a job. Section 6 explains exactly what each side sees.

This Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

If you do not agree with this Policy, do not use the Platform.

2. SCOPE AND ROLES

This Policy applies to:

• Customers who request vehicle wash services;
• Washers who apply to and perform services; and
• Visitors who browse the Platform without an account.

We act as the controller of the personal information described here. Our payment and identity-verification provider, Stripe, Inc., acts as an independent controller for the information it collects directly from you, under its own privacy policy.

This Policy does not cover the independent practices of Washers or Customers. A Washer who saves your address in their own phone, for example, is acting outside our systems and outside this Policy.

3. INFORMATION WE COLLECT

3.1 Information You Provide — All Users

3.2 Information You Provide — Customers

3.3 Information You Provide — Washers

Because Washers may take custody of and drive other people's vehicles, we collect more from them:

We store the outcome of each verification step (approved, in review, or declined) and the approval date. We do not store your bank account number, full government ID number, or the raw identity images on our own systems — those are held by Stripe. See Section 3.6.

3.4 Information Collected Automatically

3.5 Information About Transactions

For every job, we record: the parties involved, the vehicle, the service mode (on-site or pickup), the pickup and drop-off locations, the wash price, service fee, platform commission, tip, total price, the amount paid to the Washer, payment and refund status, dates, and the Stripe identifiers associated with the payment, charge, transfer, and any refund.

3.6 What We Do Not Collect

• We never receive or store your full payment card number, CVV, or bank account number. Card data is transmitted directly to Stripe, which returns only a token and limited metadata (such as card brand and last four digits) that we associate with your account.
• We do not store raw government ID images or the identity selfie on our systems. Stripe Identity processes those and returns only a verification result and reference identifier.
• We do not knowingly collect information from anyone under 18. See Section 12.

3.7 Information From Third Parties

• Stripe — verification results, payment status, payout status, refund status, and error details.
• Vehicle data provider — vehicle year, make, and model reference data used to populate selection menus. This is reference data about vehicle models generally, not about you.
• Mapping and geocoding provider — conversion of addresses into coordinates, distance and proximity calculations, and map display.
• Background screening provider — screening results for Washer applicants.

4. SENSITIVE AND BIOMETRIC INFORMATION

Please read this section carefully.

Washer verification involves an identity selfie that is compared against a government-issued identification document. This facial-comparison process may involve the capture or use of a biometric identifier under laws including the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001) and similar laws in other states.

Our practices:

• Purpose. The selfie and document comparison is used solely to verify that a Washer applicant is who they claim to be, to reduce fraud, and to protect Customers who entrust their vehicles to Washers.
• Consent. We request your informed consent before this verification begins. You are not required to become a Washer. If you do not consent, you may not complete Washer verification, but you may still use the Platform as a Customer.
• Processor. The comparison is performed by Stripe Identity, not by CarWash Connect. We receive only the result (verified, pending, or failed) and a reference identifier.
• No sale or disclosure. We do not sell, lease, trade, or otherwise disclose biometric identifiers to any third party, except to Stripe as our verification provider, or as required by law or to respond to a warrant or subpoena.
• Retention. Biometric identifiers are retained by Stripe under Stripe's retention practices and are destroyed within a reasonable time and in any event no later than the period required by applicable law after the purpose for collection has been satisfied.

We also collect other information that some laws treat as sensitive, including precise geolocation and government identification documents. We process these only for the purposes described in Section 5, and we do not sell them or use them for targeted advertising.

5. HOW WE USE INFORMATION

We use personal information to:

Provide the service

• Create and maintain your account and authenticate you
• Match job requests to Washers whose service areas cover the request location
• Send job alerts to eligible, available Washers nearby
• Display live tracking of a Washer en route to or with a vehicle
• Enable pickup and drop-off photo documentation
• Record job status, duration, and completion

Process payments

• Authorize your payment method when you book, and capture the charge when a job completes
• Calculate the wash price, service fee, platform commission, and tip
• Transfer payouts to Washers through Stripe Connect
• Issue refunds and process disputes

Verify and protect

• Verify Washer identity, driver's license, insurance, and background
• Review and approve, hold, or decline Washer applications
• Investigate disputes using job records, photographs, timestamps, and location data
• Detect and prevent fraud, misuse of vehicles, unauthorized access, and abuse
• Enforce our Terms of Service and protect the safety of Users and their property

Communicate

• Send transactional notifications about job status, payments, verification, and disputes, by push notification, SMS, and email
• Respond to support requests
• Send marketing communications, subject to your right to opt out (Section 9)

Improve and comply

• Analyze usage to improve the Platform, pricing, and matching
• Maintain financial, tax, and accounting records
• Comply with legal obligations and respond to lawful requests

We do not use your personal information for automated decisions that produce legal or similarly significant effects without human involvement. Washer approval decisions are reviewed by a person.

6. HOW WE SHARE INFORMATION

6.1 Between Customers and Washers

This is the sharing most likely to matter to you.

When a Washer accepts your job, that Washer can see:

• Your name, profile photo, and phone number
• The service location and drop-off location for the job
• Your vehicle's year, make, model, color, and license plate number
• The job details, price, and status

When you book a job as a Customer, you can see:

• The Washer's name, profile photo, and phone number
• The Washer's approval status and availability
• The Washer's live location while they are en route or performing your job
• The Washer's rating and the photographs they capture

Both parties can see: the job record, its status history, the pickup and drop-off photographs, and the price breakdown.

We share the minimum necessary to complete a job. Washers who have not accepted your job receive an alert containing the general job area and the price offered — not your identity, exact address, or license plate.

6.2 Administrators

CarWash Connect administrators can access full job records, user profiles, verification statuses, payment and payout details, disputes, and platform statistics in order to review Washer applications, resolve disputes, issue refunds, and operate the Platform.

6.3 Service Providers

We share information with vendors who process it on our behalf, under contract, and only for the purposes we specify:

6.4 Legal and Safety

We may disclose information when we believe in good faith it is necessary to: comply with law, subpoena, warrant, or court order; enforce our Terms; investigate suspected fraud, theft, or unauthorized use of a vehicle; respond to an accident, injury, or emergency; protect the rights, property, or safety of any person; or cooperate with law enforcement or insurers in connection with an incident involving a vehicle.

6.5 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change in control that materially affects your information.

6.6 Aggregated and De-identified Information

We may create and share aggregated or de-identified information — such as total washes completed or average job duration by area — that cannot reasonably be used to identify you. We will not attempt to re-identify it.

6.7 We Do Not Sell Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We do not sell your biometric information or your precise geolocation.

7. LOCATION DATA

Location is central to how the Platform works, so we describe it separately.

• Customers. We collect the location you set for your vehicle — by address entry or by positioning a map pin — and, if you permit, your device location to help you set that pin accurately. This location is shared with the Washer who accepts your job.
• Washers. We collect your device location while you are available for jobs and while you are performing one. We use it to match you to nearby requests, to confirm arrival, and to show the Customer live tracking. We also record the actual location associated with the job.
• Precision. Location collected for matching and tracking is precise.
• Your control. You can disable location permissions at any time in your device settings. If you do, core features will stop working — Washers cannot receive or perform jobs without location access, and Customers will lose live tracking.
• We do not track Washers when they are unavailable and not on a job, and we do not use location data for advertising.

8. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for essential purposes: keeping you logged in, maintaining your session, remembering your preferences, and protecting against fraud and abuse. Our mobile applications use device storage for the same purposes.

We do not currently use third-party advertising or cross-site tracking cookies on the Platform. Some third-party services we embed — such as maps and payment forms — may set their own cookies under their own policies.

Most browsers let you refuse or delete cookies. Blocking essential cookies will prevent you from logging in or completing a job. We do not currently respond to browser "Do Not Track" signals, but we honor recognized opt-out preference signals such as Global Privacy Control where required by law.

9. COMMUNICATIONS AND YOUR CHOICES

Message and data rates may apply. Opting out of marketing does not stop transactional messages.

10. DATA RETENTION AND ACCOUNT DELETION

10.1 How to Delete Your Account

You may request deletion through the in-app account deletion request or by contacting us at the address in Section 15.

10.2 What Happens When You Request Deletion

1. Immediately. Your account is archived. You can no longer log in, receive jobs, or be matched with other Users, and your profile stops appearing to other Users.
2. After 30 days. Your user record is permanently deleted from our active database and your session is terminated. The 30-day window lets you change your mind and lets us complete any pending payment, payout, refund, or dispute.

If you have a job in progress, an open dispute, or a pending payment or payout, we will complete or resolve it before deleting your record.

10.3 What We Retain After Deletion

Deleting your account does not erase every trace of your activity. We retain the following, because we are legally or operationally required to:

• Transaction and financial records — job records, prices, commissions, payouts, refunds, and associated Stripe identifiers — for at least seven (7) years, to satisfy tax, accounting, audit, and financial reporting obligations.
• Job photographs and job status history, as evidence supporting completed jobs, resolved disputes, and any reimbursement decision.
• Dispute records, for the duration of any applicable limitations period.
• Verification outcomes for Washers (approved, declined, and date), to prevent a removed Washer from re-applying and to defend against claims.
• Records we are required to preserve by law, subpoena, litigation hold, or regulatory obligation.
• Aggregated or de-identified data, which is not linked to you.

Where practicable, we disassociate retained records from your identifying profile. Records held by Stripe are retained under Stripe's own retention schedule, which we do not control; contact Stripe directly regarding data it holds.

10.4 General Retention Standard

We keep personal information only as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

11. YOUR PRIVACY RIGHTS

11.1 Rights Available to All Users

Regardless of where you live, you may:

• Access the personal information in your profile, vehicles, jobs, and photographs through the app
• Correct your name, phone number, profile photo, vehicle details, and service areas directly in the app
• Delete your account as described in Section 10
• Opt out of marketing communications
• Withdraw device permissions for location, camera, and notifications

11.2 Texas Residents — Texas Data Privacy and Security Act

If you are a Texas resident, you have the right to:

• Confirm whether we process your personal data and access that data
• Correct inaccuracies in your personal data
• Delete personal data you provided or that we obtained about you
• Obtain a portable copy of your data in a readily usable format
• Opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects

We do not sell personal data, engage in targeted advertising, or conduct such profiling, so the opt-out right has no current application — but you may still submit a request.

Consent for sensitive data. We obtain your consent before processing sensitive data, including biometric identifiers and precise geolocation, as described in Sections 4 and 7.

How to exercise. Submit a request using the contact details in Section 15. We will respond within 45 days, extendable once by an additional 45 days with notice.

Appeals. If we decline your request, we will explain why. You may appeal by writing to us at the same address with "Privacy Appeal" in the subject line. We will respond to an appeal within 60 days. If we deny the appeal, you may contact the Texas Attorney General at texasattorneygeneral.gov to file a complaint.

11.3 California Residents

If you are a California resident, you have rights under the CCPA/CPRA to know, access, delete, correct, and obtain a portable copy of your personal information, to limit the use of sensitive personal information, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA. We will not discriminate against you for exercising your rights. To exercise these rights, contact us as described in Section 15.

11.4 Other States

Residents of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Oregon, Montana, and others — have comparable rights. We honor those rights on the same terms described above.

11.5 Verification of Requests

To protect your information, we will verify your identity before acting on a request, typically by confirming control of the email address on your account. An authorized agent may submit a request on your behalf with written proof of authorization.

12. CHILDREN'S PRIVACY

The Platform is intended solely for users 18 years of age or older. We do not knowingly collect personal information from children. If we learn that we have collected information from someone under 18, we will delete it promptly. If you believe a child has provided us information, contact us at the address in Section 15.

13. SECURITY

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit using TLS
• Password hashing — we never store plaintext passwords
• Role-based access controls that restrict what Customers, Washers, and administrators can see, enforced at the database layer
• Tokenized payment handling, so card and bank data never touch our systems
• Restricting administrator access to personnel who need it
• Logging of workflow activity and errors for security monitoring

No system is perfectly secure. We cannot guarantee absolute security, and you share information at your own risk. If we become aware of a breach affecting your personal information, we will notify you and applicable regulators as required by law.

Please help protect your account: use a strong, unique password, do not share your credentials, and notify us immediately if you suspect unauthorized access.

14. INTERNATIONAL USERS AND DATA TRANSFERS

The Platform is operated in the United States and is intended for users located in the United States. If you access the Platform from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. By using the Platform, you consent to that transfer.

15. CONTACT US

For privacy questions, requests, or appeals:

Flying Fish Auto Wash, LLC d/b/a CarWash Connect
Attn: Privacy
[Street Address]
[City], Texas [ZIP]
Email: [privacy@flyingfishautowashconnect.com]
Support: [support@flyingfishautowashconnect.com]

Please include the email address associated with your account and describe your request. Mark privacy appeals "Privacy Appeal."

16. CHANGES TO THIS POLICY

We may update this Policy from time to time. We will post the revised Policy with an updated "Last Updated" date. For material changes — such as collecting a new category of sensitive information or sharing information with a new category of recipient — we will provide advance notice through the Platform, by push notification, or by email at least fourteen (14) days before the change takes effect, and where required by law we will obtain your consent.

Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

CarWash Connect Protection is a limited reimbursement program offered by CarWash Connect. It is not insurance. See Section 13.4 of our Terms of Service.