Data Processing Addendum
This addendum applies to the personal data of homeowners that a business (the "Owner") collects through InstantWashQuote. The Owner is the controller ("business"); InstantWashQuote is the processor ("service provider").
1. Subject matter and duration
We process homeowner data to run the Owner's quote widget and hosted page, deliver requests and send the emails the Owner triggers. Processing lasts while the Owner's account exists, plus up to 30 days after deletion.
2. Data and people
- People: homeowners who send the Owner a quote request.
- Data: name, phone, email, address, drawn area and chosen map position, preferred date, note, photos, consent time, and a salted daily hash of the IP address.
3. Our commitments
- We process only on the Owner's instructions, which are the Owner's use of the service and these terms.
- We do not sell or share the data, use it for our own marketing, or combine it with data from other sources.
- People who handle the data for us are bound to confidentiality.
- Precise location (the drawn area and map position) is used only to serve the Owner and is never sold or shared.
- We help the Owner answer requests from homeowners to access or delete their data within 10 days, and the Owner can delete any request at once.
- We delete homeowner contact data 12 months after each request, and everything within 30 days after the Owner deletes the account, unless law requires otherwise. The Owner can export all data as JSON first.
4. Security measures
- HTTPS everywhere; per-Owner access to requests; sign-in by emailed single-use link.
- Spam check, per-visitor rate limits, sandboxed embeds limited to the Owner's listed websites.
- No raw IP addresses or emails in rate-limit records; photo location data removed on upload.
- Encrypted database backups kept for up to 14 days.
5. Sub-processors
The Owner agrees to the sub-processors below. We tell Owners by email before adding or replacing one, and an Owner who objects can delete the account.
| Sub-processor | Purpose | Data |
|---|---|---|
| Resend | Sends our emails (sign-in links, request notices, customer emails on the owner's behalf) | Recipient email, message content |
| Polar | Bills the owner's subscription (merchant of record) | Owner email, business name, subscription status. Never homeowner data |
| Cloudflare Turnstile | Spam check on the request form | A challenge token and the visitor's IP address, checked once |
| Contabo (VPS) | Hosts the servers and database | Everything we store, encrypted in transit |
| Browser push services (Google FCM, Apple, Mozilla) | Deliver phone alerts to an owner who turned them on | An encrypted alert and a device address the owner's browser created |
6. Incidents
We tell the Owner without undue delay and within 72 hours of confirming a breach that affects the Owner's data, with what we know and what we are doing.
7. Audits
On reasonable written request we give the Owner the information needed to check that we follow this addendum.
Questions? Email hello@instantwashquote.com.