Provider Privacy Policy

This Provider Privacy Policy ("Privacy Policy") explains how WashPot ("WashPot", "we", "our", or "us") collects, uses, stores, shares, and protects information relating to Service Providers and their Employees ("you") when using the WashPot Provider application and related services ("Service").

This Privacy Policy applies only to the Provider/Employee application. The WashPot Customer application is governed by a separate Privacy Policy.

By creating an account or using the Service, you agree to this Privacy Policy.

1. About WashPot

WashPot operates an online marketplace connecting customers with independent vehicle washing businesses.

Service Providers use the Provider application to manage their business, bookings, employees, pricing, schedules, and related operations.

Employees use the same application under accounts created for a Service Provider.

2. Information We Collect

2.1 Provider Account Information

When registering a Service Provider account, we may collect:

• Business or brand name
• Business description
• Email address
• Phone number
• Encrypted password
• Business address
• Postal/PIN code
• Geographic coordinates
• Profile image
• Business operating modes (Pickup, Doorstep, Self Drop)
• Business settings
• Opening schedules
• Booking capacity
• Holiday status

Your email address is verified using a One-Time Password (OTP).

If you choose to sign in with Google or Apple, we receive from that provider a verified sign-in token containing your email address and, for Apple, a unique Apple account identifier (or an Apple relay email address if you choose Apple's "Hide My Email" option). We do not receive your Google or Apple password.

2.2 Employee Account Information

For employee accounts we may collect:

• Employee name
• Email address
• Encrypted password
• Profile image
• Associated Service Provider
• Account status

Each employee account belongs to a single Service Provider.

If an employee leaves one provider, the employee account may be deleted. Joining another provider requires creating a new employee account.

2.3 Business Information

Providers may configure services offered, service categories, pricing, premium percentage, estimated service duration, business schedules, capacity limits, holiday settings, and pickup pricing configuration.

2.4 Bank Details

Providers provide banking information, including account holder name, account number, IFSC code, and bank name, so that WashPot can pay out provider earnings.

To enable payouts, these bank details are shared with our payout partner, RazorpayX (operated by Razorpay), which creates a payout contact and fund account for the Provider. WashPot stores the identifiers RazorpayX assigns to them, along with the verification status of the bank account. Employees cannot access provider bank details.

2.5 Earnings and Payout Information

When bookings are completed, marked as a no-show, or cancelled in circumstances where the Provider is compensated, WashPot records the Provider's earnings. We maintain the following information relating to earnings and payouts:

• Earnings per booking, including the service amount, WashPot's commission, pickup fee, and premium
• Settlement status of each earning (for example, owed, being paid, or paid)
• Payout batch identifiers, RazorpayX payout identifiers, and payout dates and times
• Payout outcomes, including failed, rejected, or reversed payouts
• Payout fees and related taxes
• Accounting (ledger) entries relating to earnings and payouts

2.6 Booking Information

When customers create bookings, providers may receive customer name, customer profile image, booking date and time, vehicle model, selected services, pickup address (where applicable), and booking status.

Customer email addresses and phone numbers are not shared with providers through the application as part of the current MVP.

2.7 Communications

WashPot may send transactional emails relating to account verification, password changes, email changes, account deletion, and security-related notifications.

If you allow notifications, WashPot collects a push notification token for your device and sends push notifications relating to bookings, such as new booking alerts and booking status updates.

WashPot does not currently send promotional emails through the Provider application.

3. Permissions

Depending on your device, the Provider application may request access to:

Camera — Used to capture a provider or employee profile image.

Photos and Media — Used to select an existing profile image.

Location — Used when configuring the business location.

Notifications — Used to send booking-related notifications.

WashPot does not continuously collect background location information.

4. How We Use Information

We use collected information to create provider accounts, authenticate users, manage employee accounts, display provider businesses, process bookings, send booking notifications, manage schedules, manage services and pricing, calculate provider earnings, verify bank accounts, process payouts, maintain accounting and tax records, verify account ownership, improve platform functionality, protect platform security, prevent fraud, and comply with legal obligations.

5. Sharing of Information

WashPot does not sell provider or employee personal information. Information may be shared only as described below.

Customers — Customers may view limited business information including business name, business description, business location, provider profile image (if displayed), services, pricing, and ratings and reviews. Provider email addresses and phone numbers are not displayed to customers in the current MVP.

Employees — Employees may access only the information required for performing their assigned responsibilities. Employees cannot access provider bank account information or payout information.

Third-Party Service Providers — WashPot uses trusted third-party services including:

• Razorpay and RazorpayX for collecting customer payments, processing refunds, and making payouts to Providers. RazorpayX receives the Provider's bank account details, account holder name, and payout amounts.
• Amazon Web Services (AWS) for secure profile image storage.
• OpenStreetMap, Nominatim, and Apple Maps for mapping, geocoding, and address search.
• Google and Apple for sign-in, if you choose to use those options.
• Expo for delivering push notifications. Expo receives your device's push token and the content of the notification.
• Email service providers for transactional emails.

Future versions of WashPot may integrate additional providers for identity verification, analytics, or other operational services.

Legal Requirements — Information may be disclosed where required to comply with applicable law, respond to lawful government requests, investigate fraud, or protect the rights or safety of WashPot, customers, providers, employees, or the public.

6. Employee Information

Employee accounts are managed by the associated Service Provider. Providers may access information relating to employees working under their business, including employee name, employee email address, employee profile image, and account status.

Providers cannot access employee passwords. WashPot does not currently maintain employee activity logs or login history.

7. Bank Information

Provider banking information is treated as confidential. Only authorized WashPot systems and personnel responsible for payment operations, and our payout partner RazorpayX, may access bank information where necessary. Employees do not have access to provider banking information.

Provider earnings are paid out automatically to the Provider's verified bank account through RazorpayX, on the schedule set out in the Provider's commercial terms. Further details are set out in the Provider Terms of Service.

8. Data Security

WashPot implements reasonable technical and organisational safeguards including password hashing, HTTPS encryption, JWT-based authentication, secure cloud storage, and access controls.

Although we strive to protect your information, no Internet-based system can guarantee absolute security.

9. Data Retention

Information is retained only as long as reasonably necessary for business, operational, legal, fraud prevention, accounting, or dispute resolution purposes.

Business records relating to completed bookings may be retained after account deletion where permitted by law.

Earnings, payout, invoice, and accounting records are retained for as long as required under applicable accounting, tax, and other laws, which may extend for several years after the transaction.

10. Provider Account Deletion

Providers may request deletion of their account. When deletion is processed:

• Login access is permanently disabled.
• Email addresses are anonymised.
• Business names are anonymised.
• Business addresses are anonymised.
• Profile images are deleted.
• Other personally identifiable information is removed or anonymised where reasonably practicable.

Historical bookings, reviews, operational records, and other non-personal information may be retained where required for legitimate business or legal purposes.

Bank details, earnings, and payout records may be retained, or deactivated rather than deleted, where necessary to settle amounts owed, resolve disputes, or comply with accounting, tax, and other legal obligations. Amounts owed to or by a Provider at the time of deletion are handled in accordance with the Provider Terms of Service and applicable law.

11. Employee Account Deletion

Employee accounts are associated with a single Service Provider. If employment ends:

• The employee account may be deleted.
• Login access is permanently disabled.
• The employee may later create a new account under another Service Provider using that provider's registration process.

12. Future Features

Future releases of WashPot may introduce additional functionality including business verification (KYC), GST information, government-issued identification verification, revenue reports, analytics dashboards, employee attendance, promotions, and subscription plans.

If these features materially change our data practices, this Privacy Policy will be updated accordingly.

13. Your Rights

Subject to applicable law, you may request to access your personal information, correct inaccurate information, update account details, change your email address, change your password, request account deletion, and contact WashPot regarding privacy concerns.

14. Children's Privacy

The Provider application is intended for business use. Users must be at least 18 years of age or otherwise legally capable of entering into binding agreements under applicable law.

15. Changes to this Privacy Policy

WashPot may update this Privacy Policy from time to time. Updated versions will be published through the application or website. Continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

16. Contact Us

For privacy-related questions or requests, please contact:

WashPot Support Email: support.washpot@gmail.com Privacy Email: support.washpot@gmail.com Website: https://washpot.app

17. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the competent courts located in Mangaluru, Karnataka, India.