Version date: 27.10.2026
The controller responsible for data processing on this platform is:
WACRO GmbH
Zilstrasse 22
8153 Rümlang
Switzerland
Email: admin@wacro.ch
We process personal data of our users only to the extent necessary to provide a functional platform and our services. Processing generally takes place only with consent or where a legal basis permits the processing.
The applicable laws are the Swiss Data Protection Act (DSG) and - where applicable - the EU General Data Protection Regulation (GDPR).
First and last name
Email address, phone number
Postal address and location data for pickup/cleaning
Vehicle data (type, plate number, if provided)
Payment data (processed via payment providers)
Password (stored in encrypted form)
IP address, device and browser information
Access time, visited pages, referrer URL
Cookies and similar technologies (see cookie policy)
Request content, contact details
Content, timestamp and, if applicable, username of the review
We process personal data for the following purposes:
Provision and operation of the platform (Art. 6(1)(b) GDPR / Art. 31 DSG - contract performance)
Matching between customers and car wash providers (contract performance)
Payment processing (contract performance)
Communication and customer support (contract performance / legitimate interest)
Platform analysis and improvement (legitimate interest, Art. 6(1)(f) GDPR)
Marketing and newsletters (only with consent, Art. 6(1)(a) GDPR)
Compliance with legal obligations (Art. 6(1)(c) GDPR)
Your data is shared only in the following cases:
With the booked car wash provider for order fulfillment (name, address, contact details, vehicle information)
With our payment provider Stripe for payment processing and cleaner payouts
With hosting and IT service providers based on data processing agreements
With authorities where legally required
We use carefully selected service providers that process data on our behalf, under data processing agreements. This is the complete list, and what each one receives:
| Processor | Data it receives | Purpose | Legal basis | Retention | Cross-border basis |
|---|---|---|---|---|---|
| Supabase | Account and contact details, profile, addresses, vehicles, bookings, messages, ratings, complaints, cleaner application documents, device tokens, audit records | Runs the service: database, sign-in, file storage and live updates | Performance of the contract | For the life of your account, then per our deletion rules | Switzerland (Zurich) — no cross-border transfer |
| Vercel | IP address and request metadata; anything you submit passes through in transit | Hosts and serves the application | Legitimate interest in a secure, working service | Short-lived request logs | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Stripe | Name, email, card details entered directly with Stripe, cleaner payout details, transaction amounts | Takes payment, pays cleaners, prevents fraud | Contract, and legal accounting obligations | Transaction records 10 years (CO Art. 958f) | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Google Maps Platform | The address you type, coordinates of the service location, IP address | Address autocomplete, map display, distance and arrival time | Performance of the contract | Per the provider's own retention period | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Google (Sign in with Google) | Your email address, name and Google account identifier | Signing in, only if you choose Google | Your consent (withdrawable at any time) | For the life of your account, then per our deletion rules | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Resend | Your email address, name, and the content of the message | Sends booking and account emails | Performance of the contract | Per the provider's own retention period | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Firebase Cloud Messaging (Google) | Device token and notification content | Delivers push notifications on Android and the web | Your consent (withdrawable at any time) | Until you turn push off or sign out | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Apple Push Notification service | Device token and notification content | Delivers push notifications on iOS | Your consent (withdrawable at any time) | Until you turn push off or sign out | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
| Sentry (error monitoring) | Technical error reports and an approximate location (country and city, looked up from the IP address, which is not stored). Names, email addresses, postal addresses, coordinates and payment identifiers are removed before sending | Diagnoses faults so they can be fixed | Legitimate interest in a secure, working service | Per the provider's own retention period | Stored in the EU (Frankfurt, Germany). The provider may access it from the USA under its data processing agreement and EU standard contractual clauses |
| hCaptcha (bot protection) | IP address, browser and device information, and how the page is used during the check | Tells people from bots on sign-up, sign-in and password reset | Legitimate interest in protecting accounts from automated attacks | Per the provider's own retention period | May be processed abroad under the provider's data processing agreement and EU standard contractual clauses |
Primary application data is stored in Switzerland. Where a provider may process data outside Switzerland or the EEA, we rely on EU standard contractual clauses or an adequacy decision. We use no analytics, advertising or SMS providers.
We store personal data only as long as necessary for the stated purposes or as required by statutory retention obligations (e.g., 10 years for invoice data under Swiss CO Art. 958f).
After the purpose no longer applies and retention periods expire, data is deleted or anonymized.
As a data subject, you have the following rights:
Right of access to processed data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restriction of processing
Right to data portability
Right to object to certain processing activities
Withdrawal of granted consent with effect for the future
Right to lodge a complaint with the competent supervisory authority
Competent supervisory authorities:
Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch
EU: relevant national data protection authority of your country of residence
To exercise your rights, contact: admin@wacro.ch
Details on the storage we use, key by key, are in our cookie and storage policy.
CookiesWe implement appropriate technical and organizational measures (TOM) to protect your data against unauthorized access, loss, or misuse. These include, among others, SSL/TLS encryption, access controls, regular backups, and security checks.
We may update this privacy policy when necessary. The latest version is available on our platform. In case of material changes, we will actively inform you.
If you have questions about data protection, you can reach us at:
admin@wacro.ch
For job matching we use only the cleaner's DECLARED location (home base) and their work radius — never a live GPS position.
A cleaner's live location is captured only during an accepted job (en route until done) so the customer can track arrival, and is deleted afterwards. There is no background or continuous tracking.
After 11 months of inactivity we send a reminder, and after 12 months a final notice. With no response, the account is then deactivated and anonymised.
Logging in, or confirming the link in the email, resets the inactivity timer. Invoice data is retained for 10 years per Art. 958f of the Swiss Code of Obligations.
