Privacy Policy
Version 1.0, last updated 21 September 2026
This policy explains what personal information Kara Wash collects about you, what we do with it, who else handles it, how long we keep it, and the rights you have.
The data controller is Niche Compute Ltd, a company registered in England and Wales under company number 17424414, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, trading as Kara Wash. You can reach us about anything in this policy at hello@karawash.com.
Because we are established in the United Kingdom and our customers are in Botswana, two laws apply to what we do: UK data protection law (the UK GDPR and the Data Protection Act 2018) and the Data Protection Act 2024 of Botswana. We aim to meet the higher standard of the two throughout.
1. What we collect
Account information: your first and last name, your email address, and the mobile number you give us. If you sign in with Google or with Apple, we receive your name and email address from them. If you use Sign in with Apple and choose to hide your email, we receive only Apple’s relay address.
Your vehicles: make and model, number plate, the size class you choose, and a photo of the car if you add one.
Where we wash: the addresses you save, and any gate, boom or access notes you add, and whether there are dogs at the property.
Bookings and payments: what you booked, when, for which cars, the price, whether it was paid, refunded or rescheduled, and the reference Stripe gives the payment. We do not hold your card number; Stripe does.
At the wash: the times our team arrives, starts and finishes, and photographs of your car taken before and after the wash to show its condition. The photographs are of the car and will usually show its number plate. Our team is instructed to keep people, and the inside of your home, out of them.
Rewards and gift cards: your stamp balance and history, and any gift card code you enter. If you buy a gift card at karawash.com we also hold your name and email address as the buyer, the recipient’s name, their email address if we are to email the card to them, and your message to them.
If someone has sent you a gift card: we received your name and email address, and any message, from the person who bought the card for you, not from you. We use them only to deliver the card and to support its use, and we do not market to you.
Your device: a notification token for your phone, if you turn wash reminders on, and the platform it runs on.
When you first open the app, before you have an account: which onboarding and booking steps you reach, and the frustrations you pick in the short survey. These are recorded against a random identifier generated on your device, not against your name, and are linked to your account when you sign in.
If you write to us, or send us an enquiry through this website: your message, your contact details and our correspondence with you.
2. Why we use it, and our legal basis for doing so
To provide the service you have booked: scheduling the wash, telling our team where to go and how to get in, contacting you before we arrive, and taking payment. We do this because it is necessary to perform our contract with you.
To take payment and prevent fraud: necessary to perform our contract, and in our legitimate interests in being paid and in preventing misuse of cards, gift cards and rewards.
To record that each wash was done, and the condition of your car before and after it: in our legitimate interests in dealing fairly with complaints, damage claims and card payment disputes, and where needed to establish or defend a legal claim.
To send wash reminders: a notification on the day of your wash and about an hour before we arrive. We do this on the basis of your consent, which you give by switching reminders on. You can withdraw it at any time, as easily as you gave it, by switching them off in Settings.
To deliver a gift card you have bought, to the recipient you name, on the date you choose: necessary to perform our contract with you.
To answer you when you contact us, and to handle complaints, refunds and disputes: necessary to perform our contract and in our legitimate interests in running the service properly, and in some cases necessary for us to comply with a legal obligation or to establish or defend a legal claim.
To understand where the app loses people and to improve it: in our legitimate interests in improving a product we are building. This uses the step-by-step usage records described above, and we look at them in aggregate.
To keep our accounting and tax records: necessary to comply with a legal obligation.
Giving us your name, email address and mobile number, and the details of your car and the address where we wash it, is necessary for us to enter into and perform our contract with you. If you do not provide them, we cannot take your booking. Everything else, including a photo of your car and switching on reminders, is optional.
We do not sell your personal information, and we do not share it with anyone for their own marketing. We do not make decisions about you that have legal or similarly significant effects by automated means alone. Stripe, as the independent controller of payment data, runs automated fraud checks when you pay, which can occasionally lead to a payment being declined; if that happens to you, contact us and we will look into it.
3. Marketing
We do not send marketing messages. Your mobile number is used to coordinate your wash and for nothing else.
If we ever decide to send marketing, we will ask for your consent first, every message will say who it is from and how to stop it, and you will be able to withdraw consent at any time without affecting anything else.
4. Who else handles your information
We use a small number of service providers. They act on our instructions, under contract, and may not use your information for their own purposes.
Supabase, which hosts our database, our sign-in system and the photos you upload, on servers in Ireland.
Stripe, which processes card payments. Your card details go to Stripe directly and not to us. Stripe is an independent controller of the payment data it holds and applies its own privacy terms.
Resend, which sends our emails, including the sign-in codes and gift card deliveries.
Expo, which delivers push notifications to your phone, together with Apple and Google, who operate the notification services themselves.
Cloudflare, which hosts karawash.com.
Google and Apple, if you choose to sign in with them.
Our Botswana service partner, whose team carries out the washes. Through a staff portal they see what they need in order to do the job: your name, your mobile number, the address and access notes, and the car and its plate. They also record the times of the visit and take the photographs described in section 1. They may not use any of it for anything else.
We may also share information with our professional advisers, or where we are required to by law, by a court, or by a regulator.
Each of these providers, and our service partner, is bound by contract to protect your information to at least the standard this policy describes, and to use it only to provide its service to us. Stripe acts as an independent controller of the payment data it holds and applies its own privacy terms, which give that data a comparable standard of protection.
5. Sending information outside Botswana
Providing the service means transferring your information outside Botswana. Our database and sign-in system are hosted in Ireland; some of our other providers, including Stripe, Resend, Expo and Cloudflare, may process it in the United States and elsewhere; and we are based in the United Kingdom.
Botswana has not made an adequacy decision for any of these countries. We make these transfers because they are necessary to perform our contract with you, as section 78(1)(b) of the Data Protection Act 2024 allows: without them we could not take your booking, send our team to you, or take your payment. We also protect your information by contract with each provider, which must keep it secure and use it only to provide its service to us.
Where UK data protection law requires a transfer mechanism, we use the one it provides: for the European Economic Area, the UK’s adequacy regulations; for our service partner in Botswana, which has no UK adequacy decision, the UK International Data Transfer Agreement; and for providers in the United States, the safeguards each provider offers under its own data processing terms.
You can ask us for more detail about any particular transfer at hello@karawash.com.
6. How long we keep it
We keep your account information, your cars, your addresses, your rewards and your notification tokens for as long as your account exists.
When you delete your account, in Settings under Delete account, your profile, your cars and their photos, your saved addresses and access notes, your wash rewards, your survey answers and your notification tokens are erased immediately, and your sign-in is removed. The deletion cannot be undone.
We keep the record of bookings and payments, permanently detached from you: the amount, the dates, what happened, the car’s size class and the payment reference, with your name, contact details, address, car name and number plate removed. We keep those records because we are required to keep accounting and tax records, and because we may need them to deal with a payment dispute. They can no longer be connected to you.
Visit times and photographs of your car are kept for six months after the wash, so that we can deal with a complaint, a damage claim or a card payment dispute, and are then deleted, unless a dispute or claim about that wash is still open. This applies even if you delete your account: until that period ends we may still hold a photograph of your car, which may show its number plate.
The usage records described in section 1 are detached from your account when you delete it and kept only in that anonymous form.
Gift card orders are kept while the card is unredeemed, because the card has no expiry date and must remain redeemable, and afterwards for as long as our accounting obligations require.
Stripe keeps its own payment records for as long as the law requires of it.
Correspondence with you is kept for up to two years after the matter is closed, or longer if a claim is outstanding.
7. Your rights
You can ask us to give you a copy of the personal information we hold about you, to correct it if it is wrong, to delete it, or to restrict what we do with it. For information you gave us that we process by automated means to perform our contract or with your consent, you can also ask to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time. Your right to object is explained separately in section 8.
You can do some of this yourself straight away: your name and mobile number are editable in Settings, your cars and addresses can be changed or removed there, reminders can be switched off there, and your whole account can be deleted there. karawash.com/delete-account sets out the steps.
For anything else, write to us at hello@karawash.com. We will respond within one month. If we need to confirm your identity first, we will ask promptly. We will not charge you, and we will not ask you to give a reason. If we cannot do what you ask, we will explain why, and tell you about your right to complain and to go to court.
You have the right to complain to us about how we have handled your information. We will acknowledge a complaint within 30 days and deal with it without undue delay.
You also have the right to complain to a regulator: in Botswana, the Information and Data Protection Commission; in the United Kingdom, the Information Commission, which replaces the Information Commissioner’s Office from 30 September 2026, at ico.org.uk. We would rather you came to us first, so that we can put it right.
8. Your right to object
You have the right to object at any time to our using your personal information where we rely on our legitimate interests, including for the usage records described in section 1 and for fraud prevention. If you object, we will stop unless we have compelling legitimate grounds that override your interests, or we need the information to establish or defend a legal claim.
You have an absolute right to object to our using your information for direct marketing. We do not send marketing, but if we ever do, we will stop as soon as you ask.
To object, write to us at hello@karawash.com. It costs nothing.
9. Keeping it safe
Your information is held in a database where access is restricted per account, so one customer cannot read another’s. Car photos are kept in private storage that only you and our own systems can read. Sign-in is handled by Google, Apple or a one-time code, and we never hold a password for you. Access to the staff portal is limited to named members of our team and our service partner, according to their role.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the relevant regulator within 72 hours of becoming aware of it, and we will tell you without undue delay where the law requires us to.
11. Children
The service is not for children. You must be at least 18 to hold an account, and we do not knowingly collect information about anyone under 18. If you believe a child has given us information, tell us at hello@karawash.com and we will delete it.
12. Changes to this policy
If we change this policy in a way that matters to you, we will show the change in the app before it takes effect. The current version is always available in the app in Settings, under Help and legal, and at karawash.com/privacy.
We review this policy at least once a year. It was last reviewed on 21 September 2026.