spotyshine
Privacy Policy
spotyshine helps you find car washes and mobile detailers near you and book a wash. Businesses use spotyshine Partner and the partner portal to run their bookings. This policy explains what personal information we collect, why we need it, who we share it with, how long we keep it and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).
Who is responsible for your information
The responsible party is Bluerockets (Pty) Ltd, Johannesburg, South Africa ("we", "us"). Our Information Officer handles privacy questions and requests at privacy@bluerockets.co.za.
A car wash or detailer you book with also receives the booking details it needs to do the job (see "Who we share it with"). For what it does with them afterwards, that business is responsible.
Information we collect
If you book washes (spotyshine app)
- Account details: your name and email address. If you sign in with Google we also receive your Google profile photo.
- Phone number, if you add one, so the business can reach you about a booking you made.
- Vehicles: the make, model, colour and size of the cars you save or book for. We do not ask for number plates.
- Location: your device's precise location while the app is open, to show washes near you and work out the travel fee for a mobile wash. For a mobile wash we also store the address where the wash should happen. We do not track your location in the background.
- Approximate area: if you are signed in and have allowed location, the app records the area where you last opened the map, rounded to about 1 km and updated at most once a day, so we can see where spotyshine is used and bring car washes on board where customers are. It is never your exact position or a street, it is seen only by our administrators, and it is deleted with your account.
- Bookings: the business, wash option, add-ons, time, price, notes you add, promo codes you use and the booking's status history.
- Reviews, ratings and favourite branches you choose to leave or save.
- Before and after photos of your car that the business takes as a record of the wash.
If you run a business (spotyshine Partner app and partner portal)
- Account and team details: the names and email addresses of the owner and of staff the owner invites, and their role.
- Business details: trading and legal name, company registration number, contact details, logo, branch addresses, opening hours, photos, prices and wash options.
- Tax details: the VAT number an owner enters on the Billing page, for their receipts. Only the owner and our administrators can see it. Customers pay businesses directly, so we don’t collect businesses’ bank details.
- Crew location while driving to a mobile wash: while a team member's booking is "on the way", their position is shared with that customer so they can see the crew arriving. If the team member allows it ("Keep sharing while I navigate"), this continues in the background while they use a navigation app, with a notification on their phone the whole time; it stops when the booking is no longer on the way, when they sign out, or after 3 hours. Only the latest position is kept, and it is deleted as soon as the booking is no longer on the way.
- Notes about customers that the business keeps for itself. Customers cannot see them.
From every device
- A notification token, so we can send booking notifications to your phone. It is removed when you sign out.
- Technical logs that our hosting provider keeps automatically for security and troubleshooting, such as the time of a request and the device's IP address.
- Usage statistics (Google Analytics for Firebase): which screens and pages are opened and which steps are taken, such as starting or cancelling a booking, with the device type, app version and a random installation identifier. They never include your name, email, phone number, address, location, vehicle, booking or account details, and never the advertising ID. You can switch them off: in the spotyshine app under Settings, then Emails and privacy; in the Partner app under More; in the portal under Profile.
We do not show adverts, sell personal information or use advertising trackers.
How we use it
- To show you nearby branches and prices, take bookings and pass them to the business you chose.
- To send notifications about your bookings: when a booking is accepted or changes, reminders before the wash, and a request to rate it afterwards. Businesses are told about new bookings, cancellations and jobs assigned to them.
- To send a few emails: an invitation when a business adds you to its team; a booking confirmation if our notification can't reach any of your phones; and, for business owners, a weekly earnings summary. You can switch off the confirmation and the weekly summary in the app or portal settings.
- To let businesses manage their branches, team, bookings and reports.
- To understand, in aggregate, which parts of the apps and portal are used, so we can improve them (usage statistics, which you can switch off).
- To keep the service safe, prevent abuse and fraud, and resolve disputes about a wash.
- To meet our legal obligations.
We rely on the lawful grounds POPIA allows: performing the service you asked for, your consent (for example to location and notifications, which you can withdraw in your phone's settings), our legitimate interest in running a safe and reliable service, and legal obligations. Some features need certain information; without a location you can still search by area, and without an account you can browse but not book.
Who we share it with
- The business you book with receives your name, vehicle, the booking details and, for a mobile wash, the service address. It receives your phone number only once it has accepted your booking.
- Google Analytics for Firebase receives the usage statistics described above, with Google signals, ad personalisation and the advertising ID switched off.
- Google Workspace sends our emails from bluerockets.co.za. An email is deleted from our systems once it has been sent.
- Google Firebase (Google Cloud): sign-in, database, file storage, notifications and hosting. Our database and most processing are in Google's Johannesburg region (africa-south1); a few scheduled jobs and the sign-up handler run in Google's Belgium region (europe-west1).
- Cloudflare R2 stores the before and after photos of cars, in its European Union region.
- Mapbox draws the maps and turns typed addresses into map positions. It receives the map area or address being looked up.
- Google Sign-In, if you choose to sign in with Google.
- Authorities, where the law requires it.
Where personal information is processed outside South Africa (the European Union, and Google's and Cloudflare's other facilities), it is protected by laws or binding agreements that give protection similar to POPIA, as POPIA section 72 requires.
How long we keep it
| Information | Kept for |
|---|---|
| Service address and your phone number on a booking | Deleted 24 hours after the booking is completed, declined, cancelled or expires |
| Before and after photos | Deleted 30 days after the wash is completed |
| Crew location while on the way | Deleted as soon as the booking is no longer on the way |
| Emails we send (address and message) | Deleted as soon as the email is sent, and within 3 days if it can't be |
| Usage statistics | Kept by Google Analytics for 2 months, then only in aggregate |
| Account, vehicles, favourites, approximate area | Until you delete your account |
| Booking history and reviews | Kept for the business's records and tax purposes; when you delete your account they are anonymised so they no longer identify you |
| Business and tax details | While the business uses spotyshine, then as long as tax law requires |
Your rights
Under POPIA you can ask us to tell you what personal information we hold about you and give you a copy, correct or delete it, or stop processing it, and you can object to processing based on our legitimate interests. Email privacy@bluerockets.co.za; we reply within 30 days.
You can delete your account yourself in the spotyshine app (Settings, then Delete account), or follow the steps on spotyshine.co.za/delete-account.
If you are unhappy with how we handled your information you can complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.
Keeping it safe
Information travels encrypted. Access is limited by role: a customer sees only their own bookings, a business sees only its own bookings and branches, and staff see only the branches they work at. Before and after photos of cars are reached only through links that expire; branch photos and logos are public, because businesses publish them to attract customers. Tax details are readable only by the business owner and our administrators.
Children
spotyshine is meant for adults who can book and pay for a car wash. We do not knowingly collect information from children under 18. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top and, for significant changes, tell you in the apps before the change takes effect.