Privacy policy

The data controller is [Full legal name of the company] (identification code [Identification code], [Registered address]). For any question or request about your data, email [Contact email]. [Contact of the personal data protection officer, if appointed.]

We process only what is needed to provide the service:

• Account: full name, email address, phone number, and your password (stored only as a one-way hash — we never know the password itself).
• Vehicle and subscription: registration plate, chosen plan and location, the subscription price, limits, status and periods.
• Wash history: when, at which location and in which bay the vehicle was washed, and the outcome. The station camera reads the plate; we store the plate text, not a photo.
• Station video: the station is under video surveillance for safety and to investigate complaints.
• Payments: amount, status, the token Flitt issues and the masked card number. We never see the full card number, expiry date or CVV.
• Technical data: your IP address, stored only as a one-way hash (to limit abuse and excessive requests), your browser identifier (user agent), and campaign UTM parameters if you arrived through a tagged link.
• Communications: your email if you subscribe to updates; for a business enquiry, the company name, contact person, phone, email and number of vehicles.

• Performing our contract with you: running your account, selling and renewing the subscription, recognising your vehicle at the station and checking its limit, and transactional emails (registration, payment, renewal).
• Legitimate interest: preventing fraud and abuse, station security, handling complaints, and improving the service from aggregated statistics.
• Legal obligation: keeping accounting and tax records.
• Consent: marketing emails and news. You give it with a separate checkbox and can withdraw it at any time — through the link in any such email or by contacting us.

We do not sell personal data. We share it only with service providers that process it on our instructions under contract:

• Flitt — card payments and recurring charges.
• Mailgun (EU region) — sending email.
• [Database and hosting providers and their region — e.g. Neon, Railway.]
• Umami — anonymous website statistics (see below). [Self-hosted or Umami Cloud — to confirm.]
• Cloudflare Turnstile — protecting forms from bots, when enabled.

We use only cookies the site needs to work: your account session (secure, HttpOnly), a signed-in indicator and your chosen language. We use no advertising or tracking cookies.

For website statistics we use Umami, which sets no cookies and cannot identify you. It counts page views and events such as a button click or a completed form step — it does not collect what you type into forms.

We keep data only as long as the purpose requires:

• Account, vehicle and subscription — while the account exists and for [period] after it is closed.
• Wash history — [period].
• Payment records — for the period required by law [period].
• Station video — [period], unless it is needed to investigate a complaint.
• Enquiries that did not become a subscription, and business enquiries — [period].
• Newsletter subscription — until you unsubscribe.

Connections to the site are encrypted (HTTPS). Passwords and IP addresses are stored only as one-way hashes, and card data never enters our systems at all. Only authorised staff can reach the admin panel, each with a personal account, and every change is recorded in an audit log.

Under the Law of Georgia on Personal Data Protection you have the right to:

• be told whether wash processes your data, and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted, or its processing stopped, once there is no longer a basis for keeping it;
• ask for processing to be restricted;
• withdraw your consent at any time — this does not affect processing carried out before you withdrew it;
• complain to the Personal Data Protection Service of Georgia or to a court if you believe your rights have been breached.

Send your request to [Contact email] from the email address on your account. We reply within the time limits set by law. Some data cannot be deleted while we are legally required to keep it (payment records, for example) — if so, we will explain why.

When this policy is updated, the effective date on this page changes. Account holders are told about material changes by email.