PRIVACY POLICY

Crystal Clean Car Wash (“we,” “us,” or “our”), located in Lancaster, Pennsylvania, is committed to protecting the privacy and personal information of our customers, members, and website visitors. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the choices you have regarding your information. By using our services, visiting our location, accessing our website, or enrolling in a membership plan, you agree to the practices described in this Policy.

Please read this Policy carefully. If you have any questions or concerns, you may contact us at any time using the information provided in Section 12 of this document.

1. Information We Collect

We collect several categories of information in the course of operating our business and providing car wash services. The types of information we collect include:

1.1 Personal Information

When you create an account, enroll in a membership, or interact with our staff, we may collect the following personal information:

• Full name
• Email address
• Phone number
• Vehicle license plate number
• Vehicle make and model

1.2 Payment Information

When you purchase services or a membership plan, payment transactions are processed through secure, third-party payment processors (see Section 3). We do not store your full credit or debit card number, CVV, or banking details on our systems. Payment processors may retain this data in accordance with their own privacy policies and applicable Payment Card Industry Data Security Standards (PCI DSS).

1.3 Website and App Usage Data

If you visit our website or use a related digital application, we may automatically collect certain technical information, including:

• IP address and general geographic location
• Browser type and version
• Pages visited, time spent on pages, and navigation paths
• Device type and operating system
• Referring website URLs

1.4 Membership and Service Data

For customers enrolled in a membership or recurring subscription plan, we collect and maintain records including:

• Membership plan type and tier
• Wash history and transaction records
• Visit frequency and usage patterns
• Plan enrollment and renewal dates

1.5 On-Premises Surveillance (CCTV)

For the safety and security of our customers, employees, and property, Crystal Clean Car Wash operates closed-circuit television (CCTV) cameras at our Lancaster, PA facility. By entering our premises, you acknowledge that video footage may be recorded. This footage is used solely for security and safety purposes and is subject to the retention schedule described in Section 4.

2. How We Use Your Information

We use the information we collect for legitimate business purposes, including:

• Service Delivery: To process payments, operate car wash equipment, and provide the services you have requested or purchased.
• Membership Management: To administer, renew, suspend, or cancel membership and subscription plans, and to track your service usage and benefits.
• Communications: To send you transaction receipts, service updates, promotional offers, and loyalty program information. You may opt out of marketing communications at any time (see Section 5).
• Service Improvement: To analyze usage trends, identify operational improvements, and enhance the overall customer experience at our facility and through our digital channels.
• Legal Compliance: To meet our obligations under applicable federal, Pennsylvania state, and local laws, including tax reporting, accounting, and regulatory requirements.
• Security Monitoring: To review on-premises CCTV footage as necessary to investigate security incidents, property damage, theft, or safety concerns.
• Customer Support: To respond to inquiries, complaints, or requests submitted by customers.

3. How We Share Your Information

Crystal Clean Car Wash does not sell your personal information to third parties. We may share information with the following categories of recipients only as described below:

✓ We do NOT sell your personal information to any third party.

3.1 Payment Processors

We use third-party payment processing services (such as Stripe, Square, or similar PCI-compliant providers) to handle financial transactions. These processors receive the payment information necessary to complete your transaction and are bound by their own privacy policies and security standards. We do not control or direct how they use information shared in the course of payment processing.

3.2 Marketing and Communications Platforms

With your consent, we may share your email address or phone number with third-party marketing or communications platforms for the purpose of sending promotional emails, SMS messages, or loyalty program updates. You may withdraw this consent at any time (see Section 5).

3.3 Legal Authorities

We may disclose your personal information to law enforcement agencies, courts, regulatory authorities, or other government entities if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, the safety of any person, or to investigate fraud or a security incident.

3.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or transfer of business operations, your personal information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

4. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law. The following table summarizes our standard retention periods:

When personal information is no longer required under our retention schedule, we securely delete or anonymize it in accordance with industry best practices.

5. Your Rights & Choices

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

• Right to Access: You may request a copy of the personal information we hold about you.
• Right to Correct: You may request that we correct any inaccurate or incomplete personal information in our records.
• Right to Delete: You may request that we delete your personal information, subject to our legal retention obligations (for example, transaction records retained under tax law may not be immediately deleted).
• Right to Opt Out of Marketing: You may opt out of receiving promotional emails or SMS messages at any time by clicking the “unsubscribe” link in any marketing email, replying “STOP” to any marketing text message, or contacting us directly at the address below.
• Right to Data Portability: Where technically feasible and required by law, you may request your personal data in a portable, machine-readable format.
• Right to Restrict Processing: In certain circumstances, you may request that we limit the way we use your personal information.

How to Exercise Your Rights

To submit a privacy request or exercise any of the rights described above, please contact us by email at robh@crystalcleancar.com. We will respond to verified requests within a reasonable timeframe, and no later than as required under applicable law. We may need to verify your identity before processing your request.

6. Data Security

Crystal Clean Car Wash takes the security of your personal information seriously. We implement industry-standard administrative, technical, and physical safeguards designed to protect your data from unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• Encryption of data transmitted via our website using Secure Sockets Layer (SSL/TLS) technology
• Use of PCI DSS-compliant third-party payment processors for all financial transactions
• Restricted access to personal information on a need-to-know basis among authorized personnel
• Regular review of our data collection, storage, and processing practices

However, no method of transmission over the internet or electronic storage system is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you become aware of or suspect a security issue related to your information or our systems, please notify us promptly at robh@crystalcleancar.com.

7. Cookies & Website Tracking

Our website may use cookies and similar tracking technologies to enhance functionality, analyze site traffic, and support marketing efforts. The types of cookies we may use include:

7.1 Essential Cookies

Necessary for the website to function correctly. These cannot be disabled without affecting core site functionality.

7.2 Analytics Cookies

We may use services such as Google Analytics to collect aggregated, anonymized data about how visitors use our website. This helps us understand traffic patterns, popular pages, and areas for improvement. Google Analytics may set cookies on your device; you can opt out via the Google Analytics Opt-out Browser Add-on.

7.3 Marketing and Targeting Cookies

We may use cookies to deliver advertisements or promotions relevant to your interests, based on your browsing behavior. These are only used with your consent where required by applicable law.

7.4 Managing Cookie Preferences

You can manage or disable cookies at any time through your web browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information about managing cookies, refer to your browser’s help documentation.

8. Children’s Privacy

Crystal Clean Car Wash’s services are not directed to children under the age of 13, and we do not knowingly collect personal information from minors under 13 years of age. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at robh@crystalcleancar.com and we will take prompt steps to delete such information from our records.

Persons between the ages of 13 and 18 should use our services only with the involvement and consent of a parent or legal guardian.

9. State Privacy Rights

Depending on the state in which you reside, you may have additional privacy rights under applicable state law. The following is a non-exhaustive summary of rights that may apply as of the effective date of this Policy:

9.1 Pennsylvania Residents

Pennsylvania residents are protected under applicable Pennsylvania state law regarding the privacy and security of personal information. Crystal Clean Car Wash is committed to complying with its obligations under Pennsylvania law, including maintaining reasonable security measures and providing timely notification in the event of a qualifying data breach affecting Pennsylvania residents.

9.2 California Residents (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• Right to Know: The right to know what personal information we collect, use, disclose, and sell about you.
• Right to Delete: The right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: The right to correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: The right to opt out of the sale or sharing of your personal information. As stated in Section 3, Crystal Clean Car Wash does not sell personal information.
• Right to Non-Discrimination: The right not to be discriminated against for exercising your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at robh@crystalcleancar.com.

9.3 Other U.S. State Privacy Laws

As of 2026, numerous U.S. states have enacted comprehensive consumer privacy legislation, including (but not limited to) Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and others. Crystal Clean Car Wash is committed to respecting the applicable privacy rights of residents of all U.S. states to the extent required by law. If you believe you have privacy rights under your state’s law, please contact us and we will make reasonable efforts to honor your request.

10. Third-Party Links

Our website may contain links to third-party websites, social media platforms, or partner services that are not operated or controlled by Crystal Clean Car Wash. This Privacy Policy applies only to our own services and properties. We are not responsible for the privacy practices, security measures, or content of any third-party websites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, or applicable regulations. When we make material changes, we will post the revised Policy on our website and update the “Effective Date” at the top of the document. We encourage you to review this Policy periodically to stay informed about how we protect your information.

Your continued use of our services after the posting of an updated Privacy Policy constitutes your acknowledgment of, and agreement to, the revised terms, to the extent permitted by applicable law.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us:

Business Name: Crystal Clean Car Wash
Location: Lancaster, Pennsylvania, United States
Privacy Contact Email: robh@crystalcleancar.com
Purpose: Privacy requests, data access or deletion inquiries, opt-out requests, general privacy questions

We are committed to addressing your concerns promptly and in accordance with our obligations under applicable law. For verified privacy requests, please include your name, contact information, and a description of your request so we may respond effectively.

Crystal Clean Car Wash — Lancaster, PA  |   Privacy Policy  |  Effective August 27, 2026