Privacy Policy

The short version

• We make software that car wash and detail businesses use to run their teams and serve their customers. We handle data for those businesses.
• We never sell personal data. We do not show ads in our app, and we do not track you across other companies’ apps or websites. The Suds Software app does not use advertising IDs.
• The app only asks for your location, camera, microphone, or notifications when a feature needs them. You can say no, and you can change your mind later in your phone’s settings.
• You can delete your account yourself, inside the app, at any time. See Delete your account.
• To see, get a copy of, correct, or delete your information, make a privacy request. We confirm it’s you by email and respond within 45 days.

1. Who we are

Suds Software LLC (“Suds Software,” “we,” “us”) is an Alabama limited liability company in the United States. We provide operations software for car wash and detail businesses (the “Service”). It is available at sudssoftware.com, at each business’s own web address, and as the Suds Software mobile app for iPhone and Android. Reach us at support@sudssoftware.com.

Our role: we work for the business

The car wash or other business that uses Suds Software (we call it the “business” or “operator”) decides what information to put into its workspace and why. For that information, the business is in charge (privacy laws call it the “controller”), and we process it for them, on their instructions (we are the “processor” or “service provider”). If you work for a business that uses Suds Software, or you are one of its customers, that business’s own policies also apply to you, and many requests about your data are best sent to them first.

We are in charge of a smaller set of data ourselves: our own customers’ billing and contact details, our marketing website, our support conversations, and the error and usage records we use to keep the Service working and secure.

2. Who this policy covers

• Operators — businesses that subscribe to Suds Software, and the people who manage their accounts.
• Team members — a business’s owners, managers, and staff who use the Service, including through the Suds Software staff app.
• Applicants — people who apply for jobs with a business through our hiring tools.
• Customers of a business — people who buy memberships, wash plans, gift cards, or other services from a business, or use its customer portal.
• Visitors — anyone browsing sudssoftware.com.

3. What we collect from team members and the staff app

Your employer creates your account. There is no public sign-up in the app. Here is what the Service holds about you, and where it comes from.

Account and profile

• Your name, email address, phone number, password (stored only as a scrambled “hash”), and two-factor settings.
• Your role, permissions, and which locations you work at.
• Profile details you or your employer add on My info: date of birth, home address, and emergency contact.

Work and HR records

• Schedules, shift swaps, time-off requests, and availability.
• Time clock punches and timecards, pay rates, commissions, and payroll hours your employer enters or that are calculated from your punches.
• Training, performance, attendance, and employee survey records. If a survey is set up as anonymous, managers see only grouped results.
• Government ID numbers for payroll (your Social Security Number) are not collected by the app and are not stored by us. See Section 5.

Location at clock-in and clock-out

When you tap Clock in or Clock out, the app asks your phone for one location reading. If you allow it, that reading (latitude, longitude, and how accurate it is) is saved with that punch, along with whether it was inside your work site’s boundary. Your employer can see it.

• We do not track your location in the background or between punches.
• You can deny location access. Whether you can still clock in then depends on your employer: if they require clock-ins to happen at the work site, a punch without location may be refused, and you will need to ask a manager to record it.
• Employers are responsible for telling their staff that location is recorded at clock-in and clock-out, as the law requires where they operate.

Photos, camera, and files

With your permission, the app uses your camera or photo library so you can attach pictures to work orders, checklists and tasks, incident reports, damage claims, chemical counts, and chat messages. Photos and files you attach are uploaded to our file storage and linked to that record in your employer’s workspace. Scanning a vehicle’s VIN or a barcode reads the image on your device to fill in the number. We only receive a photo if you attach it.

Microphone and recordings

Managers who use the hiring tools can record a job interview after the applicant agrees to it on screen. The audio is sent to an AI provider to be turned into text, and the recording is deleted automatically after 90 days. The app does not use your microphone for anything else.

Messages and content you create

• Team chat messages, announcements, comments, task and work-order notes, forms, and help-desk tickets. These are visible to the coworkers and managers your employer gives access to.
• Messages and emails you send us for support.

Notifications and device information

• If you turn on notifications, we store a push notification token for your device (from Apple Push Notification service on iPhone, or Firebase Cloud Messaging on Android), which device type it is (iOS or Android), the app version, and when it was last used. Browsers that turn on web notifications get a similar browser subscription. See Section 8.
• For each sign-in we keep the browser or device description (the “user agent”) and when it was last active, so you can see your devices and sign them out from Account & legal → Devices & sessions.
• Face ID / fingerprint app lock (optional) is handled by your phone. We never receive your face or fingerprint data.

Usage, error, and diagnostic data

• Activity trail. To help us fix problems, the Service records which screens you open, which buttons you press to save or submit something (with how the server answered and how long it took), and any error message the app shows you. It never records what you type. Only Suds Software support staff can see it, and it is deleted after 30 days.
• Error monitoring. We use Sentry to find and fix crashes and errors. It receives technical details such as the error, the page, your browser or device type, your IP address, and app performance data. For a small share of sessions, and when an error happens, it also records a replay of the screen with all text masked and all images blocked, so typed values, names, and photos are not captured. We remove request contents and other personal details from error reports before they are sent.

4. What we collect about a business’s customers

Businesses use Suds Software to sell memberships and other services and to run their customer portal. For those customers, the business is in charge of the data and we process it for them. Depending on which features the business uses, this can include:

• Contact details: name, email address, phone number, and mailing address.
• Membership and purchase history: plans, wash books, gift cards, visits, receipts, and invoices.
• Vehicles: license plate, VIN, make, model, year, and color — used to match a membership to a car.
• Payments: card payments are handled by Stripe (or, for some businesses, Square). The payment company holds the card number; we keep only a reference to it, the last four digits, and the payment status.
• Text messages and email: we send receipts, sign-in codes, reminders, and — only if you agreed to them — marketing messages. Texts go through Telnyx and email through Resend. We record when and how you agreed to receive texts. Reply STOP to any text, or use the unsubscribe link in a marketing email, to opt out.
• Damage claims: details and photos a customer submits about vehicle damage.
• Business advertising tools: a business may choose to connect its own Meta (Facebook) advertising account to its public pages. If it does, sign-ups and leads on that business’s pages may be reported to Meta for that business’s ads, with email and phone scrambled (hashed) first. This is the business’s choice and is covered by its own privacy policy. The Suds Software staff app never does this.

Some businesses on our platform run childcare centers. Those centers may use the Service to keep records about the children in their care — such as names, dates of birth, attendance, authorized pickups, daily notes, incident reports, health and medication records, photos (only with a parent’s photo consent), and messages with parents. That information is entered by the center’s staff or by a parent or guardian, not collected from children. The center is in charge of it, and we process it only to provide the Service to the center.

5. Payroll onboarding & Netchex

When an operator adds a new hire, the employee receives an emailed link to a secure onboarding page that opens in their own web browser. This page is not part of the Suds Software app; even with the app installed, the link opens in the browser. There the employee may enter the details their employer and its payroll require, including a Social Security Number.

• Businesses that use Netchex for payroll: the SSN is encrypted on the employee’s device before it leaves it, passed through to Netchex, and is not stored, retained, or logged by Suds Software. Bank-account, direct-deposit, and W-4 tax details are collected by Netchex directly through its Employee Self-Service and never pass through our systems.
• Businesses without a connected payroll provider may use our onboarding paperwork feature instead. There the employee completes their federal Form W-4, state withholding form, Form I-9 Section 1, direct-deposit details and policy acknowledgements in Suds Software, and signs them electronically. The SSN is encrypted on the employee’s device in transit; the SSN, bank account number and I-9 answers are then stored encrypted, and the signed forms are kept in the business’s encrypted document vault. They are shown only to the business’s authorised payroll and HR staff (the full bank account number is never shown in the app), and they are retained as employment and tax law requires. They are not logged.
• We do store ordinary employment-record fields (job title, hire date, date of birth, home address, emergency contact) to run operations, and we send hours worked and related payroll data to Netchex when the business uses it.

6. Hiring & AI features

For hiring, we process application answers, resumes, interview notes, and (with the applicant’s agreement) interview recordings to help businesses review candidates. Where a business turns them on, Suds Software uses the AI providers Anthropic and OpenAI for features such as AI phone screens, candidate summaries, suggested interview questions, resume reading, interview transcription, summaries of written employee-survey answers, and drafting marketing posts and replies to online reviews.

AI output assists people; it does not make decisions. Businesses remain responsible for hiring decisions. We limit the personal information sent to AI providers, and those providers are contractually restricted from using it to train their public models except as our agreements permit. We never use this data for advertising and we never sell it.

A business can choose to automatically delete rejected or withdrawn applicants’ data after a set number of months (Hiring settings). Interview recordings are deleted after 90 days.

7. How we use information

• To provide the Service — run each business’s workspace, the time clock, chat, tasks, payroll, memberships, payments, and the integrations it turns on.
• To send messages you need — sign-in codes, notifications, receipts, and messages your employer or a business sends through the Service.
• To support you — answer questions and fix problems, using the activity trail and error reports described above.
• To keep the Service secure — prevent fraud and abuse, and protect accounts.
• To improve the product — using grouped, de-identified statistics.
• To follow the law — keep records the law requires and respond to lawful requests.

We do not use a business’s data for our own marketing to that business’s staff or customers.

8. Push notifications

• Notifications are opt-in. After you sign in, the app explains what notifications are for and then your phone asks for permission. You can tap Not now, and the app works fully without them.
• They carry work information you need — for example a task assigned to you, a chat mention, or a schedule change. They are never used for advertising or marketing.
• Turn them off at any time in your phone’s Settings → Notifications → Suds. When you sign out, we stop sending to that device, and if you delete your account we delete its notification tokens.

9. Who we share information with

We share information only to run the Service. We use the service providers below. Each is bound by contract to use the data only to provide its service to us (or, for payment processors and payroll providers, also as their own laws and terms require):

• Vercel — hosting the website and app, and file and photo storage (United States)
• Neon — our encrypted database (United States)
• Sentry — error and crash monitoring (United States)
• Resend — sending email
• Telnyx — text messages and phone calls
• Stripe and Square — payments and subscription billing
• Netchex — payroll and new-hire processing (Section 5)
• Anthropic and OpenAI — AI features (Section 6)
• Apple Push Notification service and Google Firebase Cloud Messaging — delivering push notifications to iPhone and Android
• Google Maps Platform (Places and geocoding) and Mapbox — address lookup, time zones, and maps of work sites
• Amazon Web Services — managing the encryption keys that protect stored documents

Services a business chooses to connect

A business can connect other services to its workspace, such as QuickBooks Online (Section 12), Google Business Profile, Google or Microsoft email, Slack, Meta (Facebook and Instagram), job boards, and car wash point-of-sale systems. When it does, information moves between Suds Software and that service as the business directs. That service’s own privacy policy applies to what it receives.

Other sharing

• Within your workspace: your employer and the coworkers it gives access to can see the information described in Section 3.
• When the law requires it, or to protect people’s safety or our rights.
• If our company is sold or merged, with notice to our customers first.

10. No selling, no ads, no tracking

• We do not sell personal data, and we do not “share” it for cross-context behavioral advertising.
• The Suds Software app has no ads, uses no advertising IDs (such as Apple’s IDFA or Google’s advertising ID), and contains no third-party advertising or analytics trackers.
• We do not track you across apps or websites owned by other companies, and we do not give your data to data brokers.

11. Cookies

We use cookies that are needed for the Service to work: to keep you signed in, to protect forms against forgery, to remember settings, and (in the app) to remember which device to stop notifying when you sign out. We do not use advertising cookies on our own site or in the app. A business’s public pages may use advertising tools if that business turns them on (Section 4).

12. QuickBooks Online & accounting data

Operators can optionally connect their business’s QuickBooks Online company to Suds Software (Settings → QuickBooks) to review and correct their financials inside the Service. If you connect it, here is exactly what we access, how we use it, and how we protect it:

• What we access: using the QuickBooks Accounting scope, we read your Profit & Loss and Profit & Loss Detail reports, and the account, class, and transaction data needed to display and review them. When you approve a coding correction, we update the account or class on the specific transaction you approved.
• How we use it: solely to provide the Suds Software financial-review features you connected — displaying your reports, letting your team flag miscoded transactions, and applying the corrections you explicitly approve back to QuickBooks. We do not use your QuickBooks data for advertising, and we never sell it.
• Your control: Suds Software only writes changes to QuickBooks that an authorized manager explicitly approves, after a confirmation that states the exact change. You can disconnect QuickBooks at any time from Settings → QuickBooks.
• How we protect it: your QuickBooks access and refresh tokens are encrypted at rest (AES-256-GCM) and are never exposed to your browser or to other tenants. Pulled reports are stored in your own tenant’s encrypted database records.
• Retention & deletion: when you disconnect QuickBooks — or close your Suds Software account — we delete the stored QuickBooks tokens. Pulled report data is removed when the account is closed, under Section 13.

Our use of information received from the QuickBooks/Intuit APIs adheres to Intuit’s developer terms and applicable API data policies. Intuit is an independent service; its handling of your data is governed by Intuit’s Privacy Policy.

12A. Bank data from Plaid (Suds Finance)

A business using Suds Finance can choose to connect its own bank, credit card and loan accounts (Finance → Books settings). We use Plaid Inc. to make that connection. Plaid asks you to sign in to your bank inside Plaid’s own window; Suds Software never sees or stores your bank username or password.

• What we receive: with your permission, the connected accounts (their names, type and the last few digits of the account number), their balances, their transactions (date, amount, description, merchant and Plaid’s spending category), and, where your bank provides them, card and loan details such as the interest rate, minimum payment, due date and last payment. We do not request your full account and routing numbers or the account owner’s identity details.
• How we use it: only to show your business’s balances and transactions inside Suds Finance for the people your business allows to see the books. Bank data is never sold, never used for advertising, and never shared with other businesses on Suds Software. Access is read-only: Suds Software cannot move money.
• Consent: before a bank is connected, the person connecting it confirms their identity with two-factor authentication and agrees to this sharing. We keep a record of that consent (who, when, what was shown, and the IP address) for as long as the connection lasts and for three years after it ends.
• How we protect it: the credential Plaid gives us for each connection is encrypted at rest (AES-256-GCM) with a key used only for this purpose, and is never sent to your browser. Each business’s bank data is kept separate from every other business’s.
• Disconnecting and deletion: you can disconnect a bank at any time from Finance → Books settings. When you do, we tell Plaid to end the connection and we delete the accounts, balances, transactions and card/loan details we stored from that bank (immediately, and in any case within 30 days). The same happens if you revoke access at your bank, delete your Suds Software account (for connections you made), or your workspace is deleted.

Plaid is an independent service. Its handling of your data is governed by the Plaid End User Privacy Policy.

13. How long we keep information

We keep information only as long as we need it to provide the Service or as the law requires, and then we delete it or make it anonymous. Some specific rules:

• Activity trail (screens and buttons): deleted automatically after 30 days.
• Interview recordings: deleted automatically after 90 days.
• Applicant data: if the business turns on its retention setting, rejected and withdrawn applicants are deleted automatically after the number of months it chooses. Otherwise it is kept until the business deletes it.
• Push notification tokens: turned off when you sign out or when Apple or Google reports the token is no longer valid, and deleted when you delete your account.
• Clock-in location: recorded once when you clock in or out, stored with that time punch, and kept as part of the time records below. We never track your location in the background.
• Your Social Security Number: never stored by us when your employer uses Netchex for payroll. If your employer has no connected payroll provider and uses our onboarding paperwork, it is stored encrypted, together with your signed tax and I-9 forms, for as long as tax and immigration law require your employer to keep them (Section 5).
• Workspace data (chat, tasks, photos, schedules, customer records, and so on): kept while the business’s account is active, because the business decides what to keep. When a business closes its account, its data is deleted or anonymized within 90 days, except what the law requires us to keep.
• Time and pay records: employers are required by law (for example, the federal Fair Labor Standards Act) to keep payroll and time records for years after employment ends. These records stay with the business even after you delete your account, but are no longer linked to your login, name, email, or phone number in our systems.
• Error reports are kept by our error-monitoring provider for a limited time under its retention settings, and backups of our database are kept for up to 30 days so we can recover from mistakes, then overwritten.

14. Deleting your data and withdrawing consent

Team members (staff app users)

You can delete your account yourself, inside the app: open the Menu → Account & legal → Delete my account, and type the confirmation word. It takes effect immediately. We:

• remove your name and email from your login and make it impossible to sign in to again;
• sign you out on every device;
• permanently delete your employee profile (date of birth, home address, emergency contact) and clear your email and phone number from your employment record;
• delete your devices’ push notification tokens.

Your employment record and work history (time punches, pay records, and the audit trail) stay with your employer, detached from your login, because the law requires them to keep it. If you are the only owner of a workspace, you must add another owner first. If you cannot sign in, email support@sudssoftware.com from the address on your account and we will complete the deletion within 30 days. Full details are on our public Delete your account page.

Customers of a business

To delete your customer account, membership, vehicles, or other records, contact the business you buy from — it controls that data and can delete it. You can also make a privacy request or email support@sudssoftware.com; we will pass your request to the business and help it carry the request out. Some records, such as payment and tax records, may have to be kept by law.

Businesses

To close a whole workspace and remove its data, an owner can write to support@sudssoftware.com. You can export your data before you close.

Withdrawing consent

Where we rely on your permission, you can take it back at any time, and we stop collecting that data from then on:

• Location, camera, photos, microphone, notifications: turn them off in your phone’s Settings for the Suds app. The app stops collecting that data right away. (Turning off location may stop you from clocking in from the app if your employer requires it.)
• Text messages: reply STOP.
• Marketing email: use the unsubscribe link.

Information collected before you withdrew consent is kept and deleted under Section 13, unless you also ask us to delete it.

15. Security

We protect data with encryption in transit (HTTPS/TLS) and at rest, hashed passwords, optional two-factor sign-in and app lock, strict separation between each business’s data, access controls for our own staff, and audit logs. Sensitive items such as connected accounts’ access keys are encrypted separately. No system is perfectly secure, but if we discover a breach affecting your data we will notify affected businesses without undue delay, and no later than 72 hours after we confirm it, and notify people as the law requires. The notice will say what happened, what data was involved, what we are doing about it, and what you can do. We keep a written incident response plan and monitor for signs of misuse, such as repeated failed sign-ins and unusual bulk downloads, so we can act quickly.

16. Where data is stored

Suds Software is based in the United States, and our servers and database are in the United States. If you use the Service from another country, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live.

17. Your privacy rights

Depending on where you live, you may have the right to know what personal information we have about you, to get a copy, to correct it, to delete it, and to opt out of its sale or use for targeted advertising. Residents of California and other states with privacy laws (such as Colorado, Connecticut, Texas, Virginia and others) have these rights under their state laws. We do not sell personal data or use it for targeted advertising, and we will not treat you differently for using your rights.

You can view and correct much of your information yourself in the Service. For anything else, make a privacy request (below).

Make a privacy request

Use our privacy request form to ask for access to or a copy of your information, or to have it deleted or corrected. You can also email support@sudssoftware.com with the subject “Privacy.”

• We confirm it’s you. We email a link to the address you give us, and we act only after you open it and confirm. This stops someone else from getting or deleting your information.
• We respond within 45 days of your confirmation. If we need more time, we may extend this once, by up to 45 more days; if we do, we will email you before the first deadline and tell you why.
• If the request is about data a business controls (for example, a car wash’s customer records, or a job application), we will send it to that business and help it respond.
• You may use an authorized agent where the law allows.
• If we refuse your request, we will tell you why. You can appeal by replying to that email with “Appeal” in the subject. We will answer the appeal within 60 days, and if we still refuse, we will tell you how to contact your state attorney general.

18. Children

The Suds Software app and Service are made for businesses and their staff, not for children. Business accounts must be opened by someone at least 18 years old. We do not knowingly collect personal information directly from children under 13. Where a childcare center uses the Service to keep records about the children in its care (Section 4), that information comes from the center or the child’s parent or guardian, and the center is responsible for any consent required. If you believe a child has given us personal information directly, email support@sudssoftware.com and we will delete it.

19. Changes to this policy

We may update this policy as the Service changes. We will change the “Last updated” date at the top. If a change is material, we will email the contact address on each business account at least 30 days before it takes effect.

20. Contact

Questions or requests? Use our privacy request form, email support@sudssoftware.com with the subject “Privacy,” or write to Suds Software LLC, Alabama, United States.