Privacy Policy

Rinsox is booking and operations software for car washes, provided by Arity Craft Limited (“we”, “us”). This policy explains what personal data the platform handles, why, who can see it, how long it is kept and the rights you have. It is written for the Data Protection Act 2017 of Mauritius, where we are established.

Who is responsible for your data

Your account. Everyone with an account on Rinsox— car wash owners, their staff and customers who sign in — has account data such as an email address, display name and, if used, a Google profile. We decide how that account data is used to run the platform, so we are its controller.

Your bookings. When you book with a car wash, with or without an account, that car wash is responsible for your booking details: it decides what it needs to deliver your wash. We process those booking details on the car wash’s behalf to provide the software. For questions about a booking, contact the car wash first; you can also contact us and we will help or pass your request on.

What we collect

• Account details. Your email address, a display name if one is provided, and when your account was created. Sign-in uses a one-time code sent to your email, so there is no password to store.
• Google sign-in, if offered and you choose it. The basic profile Google shares: your name, email address, profile picture link and Google account identifier. We do not receive your Google password and do not access your Gmail, contacts or files.
• Business and staff information. A car wash’s name and web address, its branches with time zone and currency, opening hours and closures, services and prices, and its staff: their roles, branch assignments and the history of those assignments, and the email address used to add each staff member. A car wash can also publish payment instructions and a payment QR code image for its customers.
• Booking information. A booking records your vehicle registration number, your name and contact phone number, the car wash and branch, the service and vehicle category, the time, the price, tax and any deposit at the moment of booking, and the booking’s status. If you are signed in when you book, the booking is also linked to your account.
• Your private booking link. After booking you get a private link to your booking. We store only a scrambled (hashed) version of the code in it, not the link itself. It stops working a number of days after the appointment, set by the car wash, or sooner if the car wash issues you a new one.
• Payments you make to the car wash. You pay the car wash directly, using the details it shows; Rinsox does not take the payment and receives no card or bank account details. When the car wash confirms it received your payment, its staff record the amount, the method (such as bank transfer, mobile wallet or cash) and the payment reference you used, if any. A corrected payment is kept with the reason for the correction.
• Booking history. A record of what happened to a booking and who did it: for example when a payment was recorded or corrected, a held time was released or a new link was issued, and changes to a branch’s booking rules.
• Booking security log. When a booking is requested we record a hashed form of the network (IP) address the request came from, the branch and the result, to limit repeated or abusive booking requests. A hashed address can still identify a connection, so we treat it as personal data. These records are deleted once they are more than 24 hours old; the cleanup runs every hour, so they are normally kept no longer than about 25 hours.
• Technical information. Cookies that keep you signed in and remember which page to return to after signing in. Our hosting and database providers record technical request logs (such as IP address, browser type, the page requested and the time) to operate and secure the service.

You can browse a car wash’s services and prices without an account and without giving us any personal details. Technical request logs still apply to those visits. The application does not load advertising or third-party analytics scripts.

Features we are preparing

The following are planned and not yet available. We will update this policy before each one is switched on.

• Membership, loyalty and other registered features. Booking without an account is available now; these benefits will be for customers with an account.
• Booking documents and online payments. Downloadable confirmations, invoices and payment receipts, and online deposits or payments through a payment provider the car wash uses. These will store the amounts, tax and payment status needed to issue accurate documents. Card details will be handled by that payment provider, not stored by us.
• MRA e-invoicing for Mauritius car washes. An optional integration, off by default, that a Mauritius-based car wash can activate when setting up its business or later in its settings. Once active, the invoice details the law requires would be sent to the Mauritius Revenue Authority. It does not apply to car washes outside Mauritius.

Why we use it

• To provide the service you, or the car wash you book with, asked for: signing in, managing a business and its staff, and taking and running bookings. This is necessary to perform that agreement.
• To keep the platform secure and working: preventing abuse, limiting repeated sign-in attempts and booking requests, investigating problems and keeping records of who changed staff access. These are our legitimate interests in running a safe service.
• To meet legal obligations, such as tax and accounting record-keeping once documents and payments are offered, and lawful requests from authorities.

We do not sell personal data and do not use it for advertising.

Who can see it

• Within a car wash. Owners and administrators see their business’s data. Branch managers and operators see what their role and branch assignment allow. A customer’s booking details are visible to the authorised staff of the car wash booked, so they can deliver the wash. Database access rules keep each car wash’s data separate from every other car wash.
• Anyone with your private booking link can see that booking and the car wash’s payment details, so keep the link to yourself. If it was shared by mistake, ask the car wash for a new one; the old link then stops working.
• Us. Our access is limited to what is needed to operate, secure and support the service, or what the law requires.
• Our providers, each for one purpose:
  • Supabase — Database, sign-in and the emails that carry sign-in codes. The hosted database is located in the European Union (Ireland).
  • Vercel — Hosting and delivery of the application, including technical request logs.
  • Google — Only if Google sign-in is offered and you choose to use it: Google confirms your identity and shares your basic profile.
• Authorities, where the law requires it.

Where it is stored

Our database is hosted in the European Union, and our hosting provider serves the application from locations around the world, so your data is transferred outside Mauritius. We use providers that offer data protection terms and security measures for this processing.

How long we keep it

Account data is kept while the account is in use. Booking and business records are kept while the car wash uses the platform, as part of its business records. When data is no longer needed it is deleted or anonymised, except where the law requires us or the car wash to keep it longer (for example, tax and accounting records) or where it is needed to resolve a dispute. Private booking links stop working as described above. Booking security log records are deleted once more than 24 hours old, normally within about 25 hours; if our scheduled cleanup is interrupted, they are deleted when it next runs. Our providers keep technical logs for the periods set by their own policies.

Security

Data travels over encrypted connections. Requests for private data are checked in the database against the signed-in account’s role and car wash before anything is shown or changed. No system is perfectly secure; if a breach affects your personal data, we will notify the Data Protection Commissioner and you where the law requires.

Your rights

You can ask to access the personal data held about you, to correct it, to have it erased, or to object to how it is used, subject to the conditions and exceptions in the law. You can ask us to close your account; some records may be kept where the law requires it or where they form part of a car wash’s records, such as past bookings and issued invoices. We may need to confirm your identity before acting on a request. If a request concerns a car wash’s customer records, we will work with that car wash to answer it.

Write to admin@aritycraft.com to make a request. You can also complain to the Data Protection Office of Mauritius.

Children

Rinsox is not directed at children, and we do not knowingly create accounts for them.

Changes to this policy

When this policy changes we update the date at the top of this page. If a change materially affects how account holders’ data is used, we will tell them before it takes effect.

Contact

Privacy questions and requests: admin@aritycraft.com. Help using the application: support@aritycraft.com. See also our Terms of Use.