# Privacy policy Source: https://washbox.ae/privacy Language: en-AE Provider: WASH BOX FOR CAR WASHING - L.L.C - S.P.C · call or WhatsApp +971 58 540 1230 · care@washbox.ae · 07:00-22:00 daily Service area: Abu Dhabi, Al Reem Island, Yas Island, Saadiyat Island, United Arab Emirates. Exterior cleaning only, fully mobile. Effective 18 August 2026. What the WashBox app collects, why, who can see it, and how to get it changed or deleted. In plain terms, with no padding. ## Who we are This app and website are run by WASH BOX FOR CAR WASHING - L.L.C - S.P.C, a company licensed in Abu Dhabi, United Arab Emirates under licence CN-6695626. We are the controller of the account you create in this app. If you have any question about your data or about this policy, write to care@washbox.ae. ## A platform, not a single company WashBox is a platform used by more than one independent car-wash operator. Your account is a single login that can be connected to several operators, and it is deliberately separate from the customer record each operator keeps about your household. When you register, we look for your mobile number in the records of every operator on the platform. Each match becomes a pending link that shows you nothing until that operator's office approves it. This is on purpose: matching a phone number alone would let someone register a neighbour's number and watch their car. Once a link is active, you see that operator's record of your cars, your washes and your subscription. Each operator controls its own records. We do not merge them, and one operator cannot see another's. ## What your WashBox account holds Your account itself holds only what is needed to sign you in and greet you: your full name, your UAE mobile number, and your password. The password is stored only as a hash, so nobody at WashBox can read it. Your mobile number is the identity of the account, which is why it must be unique and, where an SMS provider is enabled, verified with a one-time code. We also keep the time you last signed in. When you sign in we store a session: a hashed copy of your refresh token, the time it expires, and the description your app or browser sends about itself. We store only the hash, so a copy of our database cannot be used to sign in as you. Your app keeps the tokens themselves in your device's secure keychain, not in ordinary storage. ## What the operator holds and shows you The rest of what you see in the app belongs to the operator serving you and is controlled by that operator. We show it to you through the app once your link is active. Your household record: the name, mobile and, if the operator has them, an alternative number and an email, along with your area, your building, your parking bay and any notes the office has written so the crew can find your car. Your cars: the number plate and its emirate, and where recorded the make, model and colour. Your washes: when each wash started and finished and how long it took, the company and the name of the person who washed the car, the area, the amount collected and whether it was cash or card, and whether the wash was covered by a subscription. Your subscription: the plan, its price, how many washes it covers, how many you have used, and when the next is due. Corrections to these records are kept in an append-only log, so that a record which can be edited is still worth something in a dispute. ## Photographs carry location and time Operators record before and after photographs of your car. Every photograph carries the GPS coordinates and the timestamp of the moment it was taken, along with how accurate the location fix was. This is the point of the photograph: it is the evidence that a wash happened, to the right car, in the right place, at the right time. In an underground car park there is often no satellite fix, so a photograph may carry no coordinates and the operator records the building instead. The photographs sit in private storage. When you open one in the app we hand your app a temporary link that stops working after five minutes. The links are never public and are never shared. ## Our lawful basis We process this data under the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Our bases are: performing the service you asked for, which is seeing the record of the washes done to your car; the legitimate interest of both you and the operator in keeping photographic evidence that a wash happened, so a dispute can be settled honestly; and your consent, which you give by creating an account and, where it is used, by verifying your number with a one-time code. You can withdraw that consent by asking us to delete your account. ## Who we share it with The only people who see your household record, your cars, your washes and your photographs are the operator serving you and its office staff, and you. Operators cannot see each other's records. We do not sell your data, and we do not share it for advertising. The app carries no advertising or analytics software: it stores only what it needs to keep you signed in and to show you your washes. We use ordinary service providers to run the system, such as hosting and storage for the photographs, and, where an operator has enabled it, an SMS provider to send the one-time code that verifies your number. They act on our instructions and for no other purpose. ## How long we keep it We keep your account for as long as it is active. If you ask us to delete it, we remove the account and its sign-in sessions. Each operator keeps its own service records, the washes and the photographs, after your account is gone. These are the operator's business records and its evidence that a wash was done, and they are not ours to erase on the operator's behalf. In the operator's own panel a photograph is hidden rather than deleted, so it can still answer a dispute. We have not set a fixed number of months for these records. An operator keeps them for as long as it needs them for its accounts and for any dispute, and you can ask the operator directly about its own retention. ## Children The service is not directed at children. An account needs a UAE mobile number and a car-wash relationship with an operator, and we do not knowingly collect data about children. If you believe a child has created an account, write to care@washbox.ae and we will remove it. ## Changes to this policy If we change this policy we will post the new version here and update the effective date at the top. If a change materially affects how we handle your data, we will make that clear rather than expecting you to spot it. ## Access, correction and deletion You can ask to see the data we hold about your account, to correct it, or to delete it. Write to care@washbox.ae from, or quoting, the mobile number on the account. For correction or deletion of what an operator holds, such as your household record or the washes on your car, we will pass your request to that operator, since those records are theirs to change. To delete your account, use the page below. It explains exactly what is removed and what an operator keeps. - [Delete your account](https://washbox.ae/delete-account)