Data Privacy

This page explains how Nautilus, Inc. (“Nautilus,” “we,” or “us”) handles the data that car wash businesses (“customers”) put into the Nautilus platform (the “Services”), including personal information about their own customers (“customer data”). These commitments apply to all customer data we process. Each customer’s signed agreement with us also governs customer data, and that agreement controls if anything here differs.

“Applicable Privacy Laws” means the U.S. federal and state privacy laws that apply to customer data, including the California Consumer Privacy Act (“CCPA”) and other state consumer privacy laws, such as those of Virginia, Colorado, Connecticut, and New Jersey.

1. Roles and Responsibilities

Each customer is the business, or controller, for its customer data. It decides what to collect and how to use it, and it is responsible for giving its own customers any notices the law requires, obtaining any required consents, and having a lawful basis for its use of the data. Nautilus is the customer’s service provider, or processor. We process customer data on the customer’s behalf, following the customer’s instructions as reflected in its agreement and in how it uses and configures the Services.

2. What Customer Data Includes

Depending on the features a customer uses, customer data can include:

• contact details, such as names, phone numbers, and email addresses;
• vehicle information, such as license plate numbers;
• membership, purchase, and visit history;
• messages, emails, and calls sent or received through the Services, with their delivery and engagement data; and
• information synced from the customer’s point-of-sale and other connected systems.

It comes from the customer, from the customer’s own customers through the portals, forms, checkout pages, and messages the customer uses, and from the systems the customer connects.

3. How We Use Customer Data

We use customer data only to provide, maintain, support, and secure the Services for the customer it belongs to, and as that customer directs. We do not:

• sell or share customer data, as those terms are defined in the CCPA, or use it for targeted advertising;
• retain, use, or disclose customer data for any other purpose, or outside our direct business relationship with the customer, except as this page describes or Applicable Privacy Laws permit; or
• combine customer data with personal information we receive from other sources, except as Applicable Privacy Laws permit, such as to secure the Services, prevent fraud, or honor opt-out requests.

We may create aggregated, de-identified data that cannot reasonably be linked to any customer or individual, and use it for any lawful business purpose, such as benchmarking, analytics, industry reporting, marketing, and improving our products, including AI features. We will not attempt to re-identify it.

4. Text Message Opt-Outs

When someone replies STOP to a text sent through the Services, we record the opt-out and stop further marketing and notification texts sent through Nautilus to that number, other than messages the person asks for, such as login codes. An opt-out recorded through the Services is honored across the Services, not only by the customer whose message received the reply. Customers remain responsible for honoring opt-outs they receive in other ways.

5. AI Features

Some features, such as the Compass assistant and the Davey voice agent, use artificial intelligence. Customers choose which AI features to use. When a customer uses one, the relevant customer data is processed by our AI service providers to produce the feature’s output, such as an answer, a draft message, or a reply on a call.

6. Service Providers

We use service providers to help us run the Services, in these categories: cloud hosting and databases, messaging and email delivery, payment processing, AI services, and customer support tools. Each is bound by written terms that require it to protect customer data and to use it only to provide its services to us, and we remain responsible for how they handle customer data. We share customer data only with these providers, with the systems a customer connects or directs us to share it with (such as its point-of-sale), or when the law requires it.

7. Payment Information

Card payments are processed by third-party payment processors, such as Stripe, which is certified to PCI DSS Level 1. Card details entered online go into secure payment fields provided either by Stripe, which sends them directly to Stripe, or by our encryption partner, which encrypts the card number and security code on the customer’s device before they are submitted. Nautilus does not store card numbers or security codes entered online in readable form.

8. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect customer data, appropriate to its nature, including:

• encryption of customer data in transit, and at rest in our primary database;
• access controls that limit customer data to personnel who need it to provide and support the Services, all of whom are bound by confidentiality obligations;
• hosting with major cloud providers that maintain independent security certifications, such as SOC 2; and
• regular backups of our primary database.

No system is perfectly secure, and we review our safeguards as the Services change.

9. Where Data Is Stored

The Services are hosted in the United States, and customer data is stored and processed primarily in the United States.

10. Security Incidents

If we confirm unauthorized access to, or acquisition, disclosure, or loss of, customer data in our control or our service providers’ control, we will notify the affected customer without undue delay, share the information reasonably available to us, take reasonable steps to contain and remediate the incident, and cooperate with the customer’s response. Unless the law requires otherwise, the customer decides whether and how to notify affected individuals and regulators.

11. Requests from Individuals

If someone contacts us about customer data, we refer them to the car wash that holds it. We provide reasonable assistance, including through features of the Services, to help customers respond to requests to access, correct, delete, or opt out of the use of personal information.

12. Retention, Return, and Deletion

We keep customer data while a customer uses the Services. If a customer asks within 30 days after its agreement ends, we will provide its customer data in a commonly used electronic format. On a customer’s written request, we will delete its customer data within a reasonable time, except information the law requires us to keep and copies in backups, which remain protected until they are overwritten in the normal course.

13. Children

The Services are designed for businesses and are not directed to children under 13.

14. Changes

We may update this page. If we make a material change, we will update the effective date above and notify customers by email or in the Services.

15. Contact

Questions about data privacy? Email support@nautilus.co or write to Nautilus, Inc., 525 Brannan St, STE 410, San Francisco, CA 94107.