Privacy policy

Last updated: 2026-05-18

This policy is not a substitute for legal advice tailored to your jurisdiction. If you operate or use the service from a region with stricter privacy law than is summarized here, contact us and we’ll work in good faith to meet that standard.

DetailingStack ("we", "us", "our") operates the detailingstack.com web app and the iOS / Android mobile apps. This policy describes what personal information we collect, why we collect it, how we use it, with whom we share it, and the rights you and your customers have over it. Questions or privacy requests: email [email protected].

Who this policy covers

Detailers (our direct customers).Auto-detailing businesses that subscribe to DetailingStack to run bookings, invoices, reminders, and customer messaging. Under GDPR they are the "data controller" for their end customers’ data; we act as their "data processor."
End customers (your customers). The people who book detail services with a detailer that uses DetailingStack. We process their data on behalf of the detailer who serves them.

Categories of personal information we collect

Cross-walked to the CCPA / CPRA categories so California residents can map their statutory rights against this list directly:

Identifiers: name, email address, phone number, business name, account IDs, IP address.
Customer records: billing address, service address (when entered), vehicle make / model / VIN, photos.
Commercial information: services purchased, deposits paid, invoices, subscription history.
Internet / network activity: pages visited, feature usage, device type (analytics — opt-in via cookie consent).
Geolocation (approximate): city / region derived from IP for analytics; precise coordinates only when a detailer or customer explicitly enters an address.
Audio / electronic / visual: photos detailers upload for work orders.
Inferences: we do not generate behavioral inferences for ad targeting or profile-building.
Sensitive personal information (CPRA): account credentials (password hash). We do not collect government IDs, race, religion, health, biometrics, sexual orientation, union membership, precise geolocation (sustained tracking), or messaging contents.

Sources of personal information

Directly from detailers (account creation, settings).
Directly from end customers (booking forms, portal sign-in).
From detailers entering their customers’ data (CRM imports, manual entry).
From service providers acting on our behalf (Stripe for payment status, Twilio for delivery receipts).
Automatically from your browser / device (cookies, IP, user-agent).

Purposes of processing & lawful basis (GDPR)

For each purpose we identify a lawful basis under GDPR Article 6:

Provide the service (run bookings, send reminders, process payments) — contract performance (Art. 6(1)(b)).
SMS & email transactional messaging — consent (Art. 6(1)(a)) for end customers via the booking / portal forms; contract performance for messages required to fulfill the booking.
Billing & fraud prevention — legal obligation (Art. 6(1)(c)) for tax records; legitimate interest (Art. 6(1)(f)) for fraud detection.
Analytics & product improvement — consentvia the cookie banner; we don’t analyze without opt-in.
Security & abuse detection — legitimate interest (Art. 6(1)(f)).
Legal compliance & dispute resolution — legal obligationand / or legitimate interest.

We do not use personal information for automated decisions that produce legal or similarly significant effects on individuals (GDPR Art. 22). We do not profile for advertising.

SMS messaging (text messages)

DetailingStack sends transactional SMS on behalf of detailers to their end customers. SMS is used exclusively for appointment-related communication and account access:

Appointment reminders (typically 48 hours and 2 hours before a scheduled visit).
Customer-portal sign-in links and one-time codes the customer requests.
Wait-list slot openings the customer has signed up for.
Operational status updates initiated by the detailer (e.g. "your detail is ready for pickup").

How consent is collected

Transactional messages.The detailer’s public booking page shows an SMS disclosure directly below the phone-number field: “By providing your phone number, you agree to receive transactional text messages — booking confirmation, appointment reminders, wait-list openings, and status updates — from [business] via DetailingStack at the number provided. Msg & data rates may apply. Msg frequency varies. Reply STOP to opt out, HELP for help.” The equivalent disclosure appears at portal sign-in and wait-list sign-up. These messages are tied to the specific request the customer initiated — a one-time sign-in code, booking confirmation, appointment reminder, or wait-list opening; frequency is typically 2–5 messages per appointment cycle.

Promotional / marketing messages. Recurring marketing texts (special offers, promotions, rebooking reminders) require separate, express opt-in: the booking form shows an unchecked, optional checkboxthe customer must tick. The consent language reads: “By checking this box, I agree to receive recurring promotional and marketing text messages from [business] via DetailingStack at the number I provided. Consent is not a condition of booking or any purchase. Reply STOP to opt out, HELP for help. Msg & data rates may apply. Msg frequency varies.” The checkbox is never pre-checked and is not required to book. When ticked, we record the consent timestamp, source, and the exact text shown, and retain that record as opt-in evidence.

Opt-out and help

Reply STOP to any DetailingStack SMS to opt out of further messages from that detailer. Opt-outs are honored automatically and immediately. Reply HELP for assistance, or contact the detailer who sent the message. Standard message and data rates from your mobile carrier may apply.

Mobile carriers (AT&T, T-Mobile, Verizon, etc.) are not liable for delayed or undelivered messages.

No sharing of SMS data with third parties

No mobile information, phone numbers, or SMS opt-in data will be shared with third parties or affiliates for marketing or promotional purposes. All the categories listed above exclude text-messaging originator opt-in data and consent; this information will not be shared with any third party. We share phone numbers only with Twilio (our SMS carrier) and only to deliver the messages described in this section, as required to operate the service.

Email notifications

We send transactional emails (booking confirmations, invoices, password resets, sign-in links) via Resend on the detailer’s behalf. Email recipients can unsubscribe from non-essential email at the footer link; essential transactional email (e.g. an invoice receipt) continues for as long as the customer has an active relationship with the detailer.

Cookies & tracking technologies

Strictly necessary cookies: session, CSRF, auth tokens, cookie-consent state. Always on — required to operate the app.
Analytics cookies (PostHog):page views, feature usage. Off by default; enabled only when the user picks "Accept analytics" on the banner.
Functional cookies: preferences (last-picked vehicle size, last tenant). Set only after a user-initiated action.

We do not use advertising / re-targeting cookies and we do not embed third-party pixel trackers (Meta, TikTok, etc.).

Subprocessors & categories of recipients

We use a small set of named subprocessors to operate the service:

Stripe, Inc.— payments and billing (US, EU SCCs in place).
Twilio, Inc.— SMS and voice (US).
Resend, Inc.— transactional email (US).
Cloudflare, Inc.— DNS, R2 object storage, edge cache, workers (global).
Neon, Inc.— managed Postgres (US, region-pinned).
Railway Corp / Vercel Inc.— application + edge hosting (US).
PostHog, Inc.— product analytics (US; only when opted in).
Anthropic, PBC— AI assistant features (US; only when used).

Beyond these subprocessors, recipients of personal information are limited to: (a) law enforcement when compelled by valid legal process; (b) successors in a merger, acquisition, or asset sale (subject to a binding obligation to honor this policy); and (c) the detailer who serves you, where applicable.

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act / California Privacy Rights Act, and we have not sold or shared personal information for monetary or other valuable consideration in the preceding 12 months.

International data transfers

Our subprocessors are predominantly US-based; some (Cloudflare, Stripe) operate globally. When personal information of EU / UK / Swiss residents is transferred outside their home jurisdiction, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and equivalent UK and Swiss addenda, executed with each subprocessor that requires them. Copies are available on request.

Data retention

We keep detailer account data and end-customer records for as long as the detailer has an active subscription. On cancellation the detailer has 90 days to export everything; after that we anonymize audit logs and permanently delete personally identifiable information.

Billing & tax records: 7 years (US tax retention requirement).
SMS opt-out records: retained indefinitely so we honor opt-outs across future bookings.
Security / audit logs: 180 days, then anonymized.
Analytics events: 13 months (PostHog default).
Backups: rolling 30-day retention; deletion requests propagate to backups within that window.

Your rights — California residents (CCPA / CPRA)

California residents have the right to:

Know what personal information we collect, the categories of sources, the business or commercial purpose for collecting it, the categories of third parties with whom we share it, and the specific pieces of information we hold about you.
Delete personal information we hold about you, subject to lawful exceptions (e.g. completing a transaction, security, legal compliance).
Correct inaccurate personal information.
Opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of, but you may submit a request to confirm.
Limit use of sensitive personal information to what is necessary to provide the service. We already minimize sensitive PI to account credentials (see above); no further limit is meaningful, but you may still submit a request.
Non-discrimination— we will not deny you service, charge different prices, or provide a different level of service because you exercised a privacy right.
Designate an authorized agent to make a request on your behalf.

To exercise any of these rights, email [email protected] with the subject "California Privacy Request." We will verify your identity (typically by matching email or phone against your record) and respond within 45 days, with one 45-day extension if necessary and you are notified. There is no fee for verified requests.

Your rights — EU / UK / Swiss residents (GDPR)

Access a copy of your data.
Rectify inaccurate or incomplete data.
Erase("right to be forgotten") subject to lawful exceptions.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests, and to direct-marketing processing absolutely.
Data portability— receive your data in a structured, machine-readable format.
Withdraw consent at any time where processing is based on consent (withdrawal does not affect the lawfulness of processing before the withdrawal).
Lodge a complaint with your local supervisory authority (e.g. CNIL in France, ICO in the UK, FDPIC in Switzerland).

Email [email protected] to exercise any of these rights. We respond within 30 days. We do not currently maintain an EU representative because our EU-resident user base has not crossed the threshold requiring one under Article 27(2); we will appoint one and update this page if and when we do.

Your rights — other US states

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA) have substantially similar rights to access, correct, delete, opt out of sale / targeted advertising, and (where applicable) opt out of profiling for decisions producing legal or similarly significant effects. We do not engage in targeted advertising, sales of personal information, or qualifying profiling, so opt-out is effectively pre-applied; access / correction / deletion requests work the same as above and we respond within the statutory window (typically 45 days). Affected residents may also appeal a denied request through the same email channel.

Children

DetailingStack is not intended for use by children under 16. We do not knowingly collect personal information from anyone under 16 without verifiable parental consent. If we learn we have collected information from a child without consent we will delete it promptly. California residents under 16 are not subject to opt-in sale / sharing because we do not engage in either.

Security & breach notification

We use TLS in transit and at-rest encryption for stored customer data, scoped access controls, multi-tenant isolation in the database, and security review for every infrastructure change. If we become aware of a personal-information breach that affects you, we will notify affected detailers and end customers without undue delay and in accordance with applicable law (GDPR: 72 hours to the supervisory authority where required; state breach-notification laws on their own timelines). Responsible-disclosure contact: [email protected] or /.well-known/security.txt.

Changes to this policy

We’ll update the "Last updated" date at the top of this page when we change anything material. For changes that affect SMS messaging, third-party data sharing, or the rights summarized above, we also notify active detailers by email and provide at least 30 days’ notice before the change takes effect.

Contact

Privacy questions / data-subject requests: [email protected]
Customer support: [email protected]
Security disclosures: [email protected]

We are not currently required to designate a Data Protection Officer under GDPR Article 37. We will appoint one and publish their contact details here if our processing reaches the thresholds that require one.