Privacy Policy
This policy explains what personal information Wash Junkie holds, why we hold it, who else sees it, and what you can ask us to do about it. We have written it against what the software actually does today — not what we hope it will do later.
01 Who we are
Wash Junkie is operated by Washjunkie Limited, a company registered in Nigeria with registered office at REGISTERED OFFICE ADDRESS and company registration number RC NUMBER.
For questions about this policy, or to exercise any of the rights in section 15, contact privacy@washjunkie.com.
Because Washjunkie Limited is established outside the United Kingdom and the European Economic Area, where UK or EU data protection law applies to our processing we are required to designate a representative under Article 27 of the UK GDPR and Article 27 of the EU GDPR. ARTICLE 27 REPRESENTATIVES — appoint a UK representative and an EU representative in a member state where our users are located, then replace this note with their names, addresses and contact details
This policy covers washjunkie.com, the operator dashboard at app.washjunkie.com, and our API. It is referenced by, and forms part of, our Terms of Use.
As in the Terms, boxes headed “In plain terms” are summaries written to make this policy readable, and are not part of the agreement. The rest of this policy is.
02 Our two roles
For the people who log in to Wash Junkie, we decide what to collect — so we answer for it. For the records a laundry keeps about its own customers, the laundry decides, and we are just the software holding it.
Wash Junkie is business software sold to laundry operators. That means we sit in two different relationships with personal data at the same time, and different rules apply to each.
| Data | Our role | What that means |
|---|---|---|
| Accounts of people who sign in to Wash Junkie — owners, staff, invitees | Controller | We decide what is collected and why. This policy is our notice to you, and you exercise your rights against us. |
| Records a business keeps in its workspace about its own customers, drivers and orders | Processor | The business decides. We process on its documented instructions. Requests about that data go to the business first — see section 16. |
| The platform-wide list of phone numbers that have opted out of messages | Controller | We maintain this across all businesses on our own initiative, so that a person who opts out stays opted out everywhere. |
| Linking operator-created customer and driver records to a verified Wash Junkie account | Controller | We decide to run this matching step, across every business on the platform, so that each person has one account and a route to exercise their rights. Section 6 explains how it works. |
| Security and operational records — sessions, IP addresses, server logs | Controller | We decide to keep these to secure and run the Service. |
Where we act as processor, the business using Wash Junkie is responsible for having a lawful basis to hold the records and for giving notice to the people in them. Our Terms of Use set that obligation out.
03 What we collect
Your Wash Junkie account
- Required: email address, and a password if you sign up with one. Passwords are stored only as a one-way hash — we never hold the password itself.
- Optional, added by you: first and last name, phone number, job title, profile photo, and display preferences (theme, density, language, time zone).
- Security: whether two-factor authentication is on, and the shared secret for your authenticator app if you use one.
- Consent record: the date, time and version of the Terms and this policy you accepted when you signed up.
- Status: whether your account is active or suspended.
Automatically, when you sign in
- IP address and browser user-agent string, recorded against each sign-in session and shown back to you in your own security settings so you can spot a session you do not recognise. The IP is taken from the connection headers and is not independently verified, so treat it as an indicator rather than proof of location.
- Session timing — when a session was created, last used, when it expires, and whether it has been revoked.
- Standard web-server request logs (including IP address, time, and the URL requested), kept for security and troubleshooting.
Your business workspace
- Business name, trading identifier, logo, support email, billing email and tax identification number.
- For each outlet: address, geographic coordinates, phone number, operating hours, time zone, country, currency.
- Your catalog, pricing, roles, permissions and settings.
Records you keep about your own customers
These are entered by you or your staff, and we hold them for you:
- Customer name and phone number (both required when a record is created), plus optional email address, address and free-text preference notes.
- Orders: delivery address, free-text notes and special instructions, items, weights, prices, currency, timestamps, status history, and a per-customer lifetime order count and spend total.
- Photographs your staff upload as a garment log or dispute record, together with their dimensions, format and size.
- Records of payments you collected yourself — an amount, a free-text method, and a free-text reference.
- An activity log for each order showing which staff member did what and when, including any notes they wrote.
Records you keep about drivers
- Name, email address, phone number, vehicle model and licence plate.
- Performance figures (rating, delivery counts, on-time rate, average delivery time) and pay configuration, plus a ledger of earnings accrued per completed delivery.
Other operational records
- Which staff member started and ended each machine cycle, and when.
- One-time codes for email verification, password reset and sign-in links — stored only as a one-way hash, alongside the email address they were issued for.
- Team invitations: the email address entered by the business owner, the role offered, and an acceptance token.
- Developer API keys, stored only as a hash with a short prefix for display, and any webhook endpoints you configure.
- A platform-wide list of phone numbers that have opted out of messages.
- A short-lived internal record of recent create requests, kept for 30 days to stop a retried request creating a duplicate. Where the request created a customer or an order, that record contains a copy of the details submitted.
We do not store card numbers, bank account details or any other payment instrument — there is no payment processor connected to Wash Junkie, and payments recorded in the Service are your own record of money you collected offline.
We do not track the location of drivers or vehicles. The only coordinates we hold are the fixed addresses of outlets and wash houses that you enter yourself.
We do not use advertising trackers, session recording, or third-party marketing pixels anywhere in Wash Junkie, and we do not sell personal data or share it for cross-context behavioural advertising. The one measurement tool we do run is Google Analytics on the marketing website, configured to store nothing on your device — see Our marketing website.
04 Where it comes from
- From you, when you create an account, complete onboarding, or change your settings.
- From your device, automatically, when you sign in and use the Service.
- From a business using Wash Junkie — if you are a customer, a driver or an invited staff member, a laundry operator may have entered your details without you ever visiting Wash Junkie yourself.
05 Why we use it
| Purpose | Data used | Lawful basis (UK/EU GDPR) |
|---|---|---|
| Providing the Service to your business | Account, workspace and operational data | Performance of a contract |
| Verifying your identity, signing you in, and keeping accounts secure | Email, phone, password hash, 2FA secret, codes, IP, user-agent | Performance of a contract; legitimate interests (securing the Service) |
| Sending order updates to a business’s own customers | Customer first name, phone number, order details | On the instruction of the business, which is responsible for the basis |
| Preventing abuse, fraud and misuse | Account status, sessions, server logs | Legitimate interests |
| Support and troubleshooting | Whatever is relevant to the issue reported | Performance of a contract; legitimate interests |
| Linking existing customer and driver records to a verified account | Your verified email address, and for driver records your verified phone number, matched against existing records | Legitimate interests (giving each person a single identity and a route to exercise their rights over records held about them) |
| Honouring message opt-outs across the platform | Phone number, opt-out flag | Legal obligation; legitimate interests (respecting an objection) |
| Improving the Service | Aggregated, non-identifying usage information | Legitimate interests |
| Meeting our legal and regulatory obligations | As required | Legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object at any time under section 15.
If you are in Nigeria, the equivalent lawful bases under the Nigeria Data Protection Act 2023 apply — principally contractual necessity, legitimate interests and legal obligation.
06 How records get linked
One Wash Junkie login is one person. When you prove your email address, customer records a laundry already created about you get attached to your account — one per laundry. Driver records attach on either a proven email address or a proven phone number.
Wash Junkie uses a single identity for each person. The same account can be a business owner, a staff member at one outlet, a customer of several laundries, and a driver — all at once.
Because operators create customer and driver records about people who have never used Wash Junkie, we run an automatic matching step: when you verify your email address (or, for driver records, your email address or phone number), we attach matching records to your account — one customer record per business, and one driver record per outlet, being the earliest one we find. This happens across every business on the platform, not only the one you signed up through. Where a business holds more than one record about you, or where you already have a linked profile there, the extra records stay unattached.
We do this so you see one coherent account rather than a set of disconnected records, and so that your rights can actually be exercised over them. It means that verifying your email may reveal to you that a business you have dealt with holds a record about you. It also tells that business one thing: its record for you is marked as linked to a verified Wash Junkie account. It does not disclose your account details or your dealings with any other business, and it does not share your records between businesses — each business continues to see only its own.
We rely on our legitimate interests to do this, so you have the right to object. If you would prefer your account not to be linked in this way, or you want a record unlinked, contact privacy@washjunkie.com.
07 Staff activity records
The Service attributes actions to the staff member who performed them: who advanced an order, who recorded a payment, who wrote a note, who loaded and unloaded each machine. It can also produce per-person activity reports over a three, six or twelve-month window, showing each staff member’s name, email address and activity counts.
These records exist so a business can trace what happened to an order. The business that employs you is the controller of that data and decides how it is used — including whether it is used to evaluate performance. If you are a staff member with questions about how your employer uses it, ask them first; we will support them in answering.
08 Emails and text messages
What we send to account holders
We send account and security email only: verification codes, sign-in links, password reset links, and team invitations. We do not send marketing email, and we have no bulk or newsletter capability.
Some sign-in and reset links contain your email address encoded in the URL. Treat those links as credentials — anyone who has the link can use it until it expires.
We send one-time codes by SMS when you set up phone verification or SMS two-factor authentication, because you asked for them at that moment. These are not suppressed by an opt-out.
What businesses send to their customers
A laundry can switch on order-status text messages for its customers. When it does, we send those messages on its behalf, in its name. It is off unless the business turns it on, and the business — not Wash Junkie — is responsible for having consent to send them.
Every such message tells the recipient they can reply STOP.
Opt-outs apply across the whole platform. When a number opts out we stop sending order-status messages to it from every business on Wash Junkie, not just the one that sent the message. We keep the number on a suppression list to make sure that stays true. An opt-out cannot currently be reversed from within the product; if you want to start receiving messages again, contact privacy@washjunkie.com.
We do not keep a copy of each message we send. That means we cannot produce a message-by-message history for a given number.
10 Our marketing and help websites
This section covers washjunkie.com and the help centre at support.washjunkie.com. Neither sets a cookie or runs an advertising script. Fonts are served from our own servers rather than fetched from a font provider. You can read either site end to end without anything being stored on your device.
We do measure traffic. Both sites load Google Analytics so we can see which pages people read and where they arrive from. They share one property, so that a visit that starts in the help centre and ends on the pricing page reads as one journey rather than two strangers. It runs with analytics_storagedenied, which means it writes no cookie and nothing to your browser’s storage — the trade we made deliberately, because it is what lets us keep the promise in Cookies and local storageabove. In practice we cannot tell a returning reader from a new one, and we are fine with that. Google receives your IP address, the page you are on and your browser and device type. Advertising features and ad personalisation are switched off, so none of it is joined to Google’s advertising profile of you. The operator dashboard at app.washjunkie.com carries no analytics at all.
The contact form is the one exception. If you send us a message from washjunkie.com/contact, we receive the name, email address, optional business name and message you type, and we use them to reply to you. Nothing else on the page collects anything, and we do not need the form to show you the site.
That message is delivered to us by Mailgun, the same email provider listed in the table below, and lands in an ordinary mailbox we read. We keep it for as long as the conversation is useful and then delete it. We do not add you to a mailing list, we do not use it to build a profile, and we do not pass it to anyone else.
As with any website, our web servers record standard request logs that include IP addresses, which we use to keep the site available and secure. We also count contact-form submissions per address for a short period, so one script cannot flood the mailbox.
11 Who we share it with
We do not sell personal data and we do not share it for advertising. We share it with the service providers below, which process it only on our instructions and for the purposes shown.
| Provider | What it does | What it receives |
|---|---|---|
| Google Analytics | Traffic measurement on the marketing website only | IP address, page viewed, referrer, and browser and device type. No cookie is set and nothing identifies you across visits. |
| Mailgun | Transactional email delivery | Account holders’ and invitees’ email addresses and message contents. Never your customers’ details — we do not email them. |
| Twilio | Text messages and one-time codes | Phone numbers, and for order updates the customer’s first name, order number, business name and order status |
| Cloudinary | Image storage and delivery | Order photographs, profile photos and business logos, and the IP address of whoever views them |
| DigitalOcean | Hosting and the database | All Service data, at rest and in transit through the servers |
We will update this list before adding a new provider that processes personal data. We may also disclose information where we are legally required to, to establish or defend legal claims, or to a buyer in connection with a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.
Wash Junkie maintains a platform-administrator role held by a small number of our own staff. It grants the same access as a business owner inside every business on the platform — reading and changing orders, customers, drivers, catalog, staff and settings — as well as searching accounts by name, email or phone number and suspending an account. It exists to run and support the Service. It cannot be self-granted: it is conferred manually, server-side, on a named account. Suspensions and reinstatements are written to an audit trail; other access by platform administrators is not currently logged, and we will say so here when that changes.
12 International transfers
Wash Junkie is available worldwide and our providers operate internationally, so personal data may be transferred outside the country where you are located — including to the United States, where our email, SMS and image providers are based.
Our infrastructure is hosted with DigitalOcean in CONFIRM DATA-CENTRE REGION.
Where personal data protected by UK or EU data protection law is transferred outside those areas, we rely on the UK International Data Transfer Addendum or the European Commission’s Standard Contractual Clauses, together with the transfer terms in our providers’ data processing agreements. Where data protected by the Nigeria Data Protection Act 2023 is transferred abroad, we rely on the transfer conditions in that Act.
ACTION REQUIRED — confirm the data processing agreement and transfer mechanism is executed with each provider before publishing
You can ask us for details of the safeguards that apply at privacy@washjunkie.com.
13 How we protect it
These are the measures actually in place today:
- Passwords are stored only as a one-way Argon2 hash. We never hold or can recover your password.
- Sign-in tokens, one-time codes and API keys are stored only as cryptographic hashes, and compared in constant time.
- The token that keeps you signed in is held in an HttpOnly cookie that JavaScript cannot read, and is replaced each time it is used.
- Sign-in tokens are short-lived and every request re-checks that the session is still valid and the account is still active, so revoking a session takes effect immediately.
- Optional two-factor authentication by authenticator app or SMS.
- Changing your password signs out your other devices; resetting it signs out all of them.
- Access inside a business is controlled by a per-outlet permission model that fails closed, with the most sensitive permissions grantable only by the business owner.
- Traffic between your browser and our servers is encrypted with TLS, and only approved origins may call the API.
No system is perfectly secure. We do not claim a formal security certification, and we will not represent controls we have not implemented. If you find a vulnerability, please report it to security@washjunkie.com rather than disclosing it publicly, and we will work with you.
If a breach occurs that is likely to result in a risk to people’s rights, we will notify the relevant supervisory authority and affected individuals as the law requires, and we will tell any affected business customer without undue delay so it can meet its own obligations.
14 How long we keep it
Honestly: for most records, until you ask us to delete them. We are still building automatic retention limits, and we would rather say so than quote a schedule we do not run.
| Record | How long |
|---|---|
| Your account and workspace data | For as long as the account is open, and afterwards until you ask us to delete it |
| Customer, order and driver records inside a business workspace | For as long as the business keeps them. The business decides — we act on its instruction |
| Order photographs and other uploads | Until deleted from the workspace. Deleting the record does not always remove the stored image, so ask us if you need a photograph erased |
| Sign-in sessions, including IP address and user-agent | Retained after the session ends or is revoked. We do not yet purge them automatically — SET A RETENTION PERIOD |
| One-time codes and sign-in links | Unusable after 15 minutes (60 minutes for password resets); the hashed record is retained |
| Duplicate-request records and internal change events | Deleted automatically after 30 days |
| Message opt-outs | Kept indefinitely, so that an opt-out continues to be honoured |
| Suspension and reinstatement audit records | Kept as a permanent record of those actions |
We will keep information for longer where we need it to comply with a legal obligation, or to establish, exercise or defend a legal claim.
15 Your rights
Depending on where you are, you have some or all of the following rights over your personal data: to be told what we hold and why; to get a copy; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to receive it in a portable format; and to withdraw consent where we relied on it.
These rights come from the Nigeria Data Protection Act 2023 and, where they apply to you, the UK GDPR and the EU GDPR. Whichever applies, we will honour the rights above.
How to exercise them
Email privacy@washjunkie.com. We will acknowledge your request and respond within one month. If the request is complex we may extend that by up to two further months and will tell you why. We do not charge, unless a request is manifestly unfounded or excessive.
Wash Junkie does not yet have self-service tools for account deletion or erasure, and every such request is fulfilled manually by our team. Export is partial: from the dashboard you can download your customer list as a CSV and a PDF receipt for an individual order, but there is no one-click export of everything we hold. That is a limitation of the product today, not a reason to refuse — write to us and we will put a full copy together by hand. We are building self-service tooling and this section will change when it ships.
Some things we cannot erase on request. We keep records of message opt-outs indefinitely, because deleting them would mean sending messages to someone who asked us to stop. We also keep what we need to comply with law or defend a claim. Where we cannot fully action a request, we will tell you which part and why.
You can also manage several things yourself in the dashboard: update your profile, change your password, turn two-factor authentication on or off, review your active sessions and sign out devices, and set your notification preferences.
16 If a laundry uses Wash Junkie
If you are a customer of a laundry that uses our software, your details are in that laundry’s hands. Ask them first — but if you cannot reach them, come to us and we will help.
A business using Wash Junkie may hold a record about you containing your name, phone number, email address, delivery address, order history, notes its staff wrote, and photographs of your items. That business decides what to collect and how long to keep it. We hold the record on its behalf.
To see, correct or delete that record, contact the business directly — it is the one that can act on it. If you do not know who they are, cannot reach them, or they do not respond, write to privacy@washjunkie.com and we will pass the request on and help it along.
To stop receiving text messages, reply STOP to any message. That stops order-status messages from every business on Wash Junkie, not just the one that texted you.
17 Children
Wash Junkie is business software and is not directed at children. You must be at least 18 to hold an account. We do not knowingly collect personal data from children, and we do not ask for anyone’s date of birth or age. If you believe a child’s data has reached us through a business’s records, tell us at privacy@washjunkie.com and we will work with that business to remove it.
18 Changes to this policy
We will update this policy as Wash Junkie changes. Every version carries a version identifier and effective date, shown at the top of this page. This version is 2026-07-22.
For changes that materially affect how we use your personal data, we will give notice by email or in the Service before they take effect. We keep a record of the policy version each account holder accepted.
19 Contact and complaints
Washjunkie Limited
REGISTERED OFFICE ADDRESS
privacy@washjunkie.com
We would like the chance to put things right ourselves, so please come to us first. You also have the right to complain to a data protection authority:
- Nigeria — the Nigeria Data Protection Commission (NDPC).
- United Kingdom— the Information Commissioner’s Office (ICO).
- European Economic Area — the supervisory authority in the country where you live or work.
This policy forms part of our Terms of Use, which set out the agreement between your business and ours.
Read the Terms of Use