Privacy Policy

1. Scope and who we are

This Policy applies to information handled by August Quillen, doing business as Wishy-Washy Window Cleaning ("Wishy-Washy," "we," "us," or "our"), in connection with this website, the customer portal, quote and appointment workflows, e-gift certificates, service visits, hiring inquiries, customer communications, and our technician, sales-representative, and administrative tools.

It does not govern a third party's independent website, application, or service, even when we link to it. Those parties provide their own notices. This Policy also does not replace a signed service agreement; that agreement may contain additional information about job documentation and photographs.

2. Information we collect

The information we collect depends on how you interact with us. It may include the following categories.

Contact and account information

• Name, email address, telephone number, and communication preferences.
• Customer, technician, sales-representative, or administrator account identifiers, role, account status, and sign-in activity.
• Email-verification status and, if you use Google sign-in, your Google-provided name and email address.
• Authentication and recovery information handled through Amazon Cognito. We do not store plaintext passwords.

Property, quote, and service information

• Service address, unit or address details, city, postal code, county, Google place identifier, and coordinates associated with the entered property.
• Property type, residential or business status, additional buildings, access details, whether someone expects to be home, exterior-window range, and notes you provide.
• Quote requests, appointment preferences, scheduled times, reschedule reasons, cancellations, recurring-service cadence, price, service scope, job status, completion summary, and service history.
• Technician notes, job events, and photographs of windows, exterior property conditions, access or safety issues, existing damage, and completed work.

Contracts, transactions, and gift certificates

• Service agreements and uploaded contract files, agreement version, typed signature name, signature method, acceptance record, and timestamps.
• Invoice number, description, amount, due date, payment status, payment source, Stripe transaction or checkout identifiers, refunds, disputes, and related accounting records.
• Gift-certificate amount, purchaser and recipient names and email addresses, personal message, delivery status, private access token, certificate code, balance, and redemption history.
• Stripe collects payment-card, billing, device, and fraud-prevention information on its hosted pages. We receive transaction status and related records, not full card numbers or security codes.

Communications and preferences

• Contact-form messages, emails, telephone communications, support requests, billing questions, and other correspondence.
• Appointment-related SMS choice, mobile number, the language shown when consent was requested, consent and preference timestamps, and opt-out activity.
• Hiring-interest information you choose to send by email, including your name, email address, area of interest, and note.

Canvassing and field-operation information

• Addresses visited by authorized sales representatives, associated map coordinates, visit date, outcome, follow-up date, and notes.
• Contact information voluntarily provided during a field interaction and do-not-contact status.
• Staff assignments, profile details, last-seen time, work activity, job counts, and operational audit records.

Device, usage, and security information

• IP address, browser and device type, operating system, language, approximate location, referring page, pages viewed, interactions, and timestamps.
• Cookie and advertising identifiers, Google Analytics and Google Ads events, and an internal quote identifier reported with a successful quote conversion.
• Request identifiers, authentication events, network and application logs, fraud or abuse signals, and diagnostic information.
• Browser storage used for session management, optional persistent sign-in, pending quote claims, private gift-certificate viewing, and service-status handling.

3. Where information comes from

• From you: when you submit a form, create an account, sign an agreement, buy or redeem a gift certificate, select communications, pay, or contact us.
• From other people: for example, a gift-certificate purchaser may provide a recipient's name and email address, or a property representative may provide service details.
• From our personnel: when an authorized administrator, technician, or sales representative documents a quote, visit, service, payment, or customer request.
• Automatically: from browsers, devices, cookies, logs, security systems, and analytics or advertising technologies when the site is used.
• From providers: including Google for sign-in and address information, Stripe for payment status, and communications providers for delivery or opt-out information.

If you give us information about another person, please provide it only when you are authorized to do so and direct that person to this Policy. Gift recipients should understand that the purchaser controls the name, email address, and personal message supplied at checkout.

4. How we use information

We use information as reasonably necessary to:

• provide free estimates, reserve quote visits, prepare quotes, schedule and perform services, and manage recurring-service reminders;
• create and secure accounts, authenticate users, provide role-appropriate access, recover accounts, and support optional multifactor authentication;
• prepare, deliver, retain, and verify service agreements and electronic signatures;
• create invoices, process payments and gift certificates, record redemptions, handle refunds or disputes, and maintain tax and accounting records;
• send confirmations, reminders, technician-status notices, completion updates, invoices, receipts, security messages, and responses to requests;
• route and document field work, address safety or access issues, support quality control, resolve warranty or insurance matters, and investigate disputes;
• operate canvassing workflows, honor do-not-contact requests, manage follow-ups, assign personnel, and measure internal performance;
• understand website use, attribute advertising conversions, evaluate promotions, improve our site and services, and troubleshoot errors;
• detect, investigate, and prevent fraud, abuse, unauthorized access, security incidents, and violations of our terms;
• comply with law, enforce agreements, establish or defend legal claims, and protect people, property, and our business; and
• carry out another purpose disclosed when information is collected, with consent when required.

We may combine information from these sources and create aggregated or de-identified statistics. We do not attempt to reidentify information we maintain as de-identified except to test whether de-identification works.

5. Cookies, browser storage, analytics, and advertising

Necessary browser storage

The portal uses session storage and, when "Keep me signed in" is selected, local storage to maintain authentication. Browser storage also protects short-lived quote-claim and private gift-certificate links. The private token in a gift-certificate URL fragment is moved into session storage and removed from the visible URL before analytics initializes. Blocking this storage may prevent sign-in or other requested features.

Google Analytics and Google Ads

On the deployed site, Google Analytics and Google Ads tags load automatically unless blocked by your browser, extension, network, or device settings. Google may receive the page URL, IP address, device and browser information, referrer, cookie or advertising identifiers, and interaction data. We use this information to measure traffic, understand site performance, attribute advertising, and count quote leads.

Our tag configuration sends the page origin and path without the query string or URL fragment. When a public quote request succeeds, we report a lead and advertising-conversion event with the internal quote ID as a transaction identifier. We do not intentionally send names, email addresses, telephone numbers, service addresses, form contents, payment information, or gift-certificate access tokens to Google Analytics or Google Ads. Google may use information under its own policies, including for measurement, security, and advertising depending on your settings. Learn more about how Google uses information from sites that use its services.

Google Maps and Places

Address fields use Google Places to standardize and validate Whatcom County addresses. Authorized sales tools also use Google Maps and geocoding. When these features load, the browser connects to Google and may share IP address, device information, search text, and map or place interactions. We store the selected standardized address, place ID, and, for field operations, coordinates associated with that property. We do not ask Google Maps for continuous background location or device GPS.

Your controls

• Use browser controls to block or delete cookies and site storage. Some portal functions may stop working.
• Install the Google Analytics opt-out browser add-on.
• Review your Google My Ad Center settings to control ad personalization.
• Use a browser or network content blocker before visiting if you do not want Google tags to load.

Some privacy laws use terms such as "sale," "sharing," or "targeted advertising" for certain advertising disclosures even when no money is exchanged. We do not sell personal information for money. Our disclosure of online identifiers, website activity, and conversion information to Google for advertising measurement may be considered sharing or targeted advertising under some state laws. Contact us with the subject "Privacy Opt Out" to make a request concerning information we control.

The site does not currently respond to the older browser "Do Not Track" signal, which is not interpreted consistently across browsers. Where an applicable law requires us to honor a legally recognized browser-based opt-out signal, we will treat it as required by that law.

6. When we disclose information

We do not disclose personal information merely because it may be useful to someone else. We may disclose it to the following categories of recipients for the purposes described in this Policy:

• Cloud and security providers: Amazon Web Services hosts the site, APIs, database, private files, authentication, logs, email delivery, SMS delivery, monitoring, and security controls.
• Payment providers: Stripe, payment networks, financial institutions, and fraud-prevention partners process checkouts, invoices, payments, refunds, and disputes.
• Google services: Google receives information for Analytics, Ads, Maps, Places, and optional Google sign-in as described above.
• Communications providers: email, mobile carriers, and messaging vendors transmit requested service, account, and appointment communications.
• Personnel and contractors: authorized administrators, technicians, sales representatives, accountants, insurers, professional advisers, and support providers receive information appropriate to their work.
• People you direct us to contact: including gift-certificate recipients, property representatives, and other recipients you designate.
• Government, legal, and safety recipients: when we reasonably believe disclosure is required by law, legal process, insurance obligations, or protection of rights, safety, and property.
• Business transaction recipients: if the business or its assets are reorganized, financed, sold, or transferred, subject to appropriate confidentiality and any notices required by law.

Providers may process information under their own terms and privacy notices. See the current AWS Privacy Notice, Google Privacy Policy, and Stripe Privacy Policy.

7. Retention and security

How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose collected, including providing service, maintaining an account, honoring a gift certificate, keeping tax and business records, resolving disputes, enforcing agreements, and meeting legal obligations. The period varies by record:

• public quote-claim tokens generally expire after seven days, payment-attempt records generally expire after about one day, and certain anti-duplicate quote records expire after about 30 days;
• application, API, and access logs are generally scheduled for deletion after approximately 30 to 90 days, although security or legal investigations may require longer retention;
• account and service records remain while an account or customer relationship is active and afterward as reasonably needed for service history, claims, and legal compliance;
• contracts, signatures, invoices, payment records, and gift-certificate records may be kept for the applicable limitation, accounting, tax, unclaimed-property, and consumer-protection periods; and
• job photographs and notes remain with the service record until no longer reasonably needed for quality, warranty, insurance, safety, or dispute purposes.

Backup copies, versioned private files, and records subject to a legal hold may remain for a limited period after deletion from active systems. We may retain aggregated or de-identified information that no longer reasonably identifies an individual.

How we protect information

We use safeguards designed for the nature of the information involved, including HTTPS, role-based access, managed authentication, encryption at rest for customer data and private job media, restricted private storage, short-lived signed file links, multifactor-authentication support, request validation, rate limiting, monitoring, backups, and logging designed to omit request bodies, addresses, contact details, credentials, and tokens. Technician photo capture is re-encoded to remove embedded image metadata before upload. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

If you believe your account, private link, gift-certificate code, or information has been compromised, contact us promptly. Do not email us a password, full card number, access token, or other secret.

8. Your choices and privacy rights

Account and communications choices

• Account: contact us to correct profile information or request account closure. Signing out and clearing browser storage removes local session information but does not delete business records.
• SMS: appointment texts are optional. Reply STOP to opt out or contact us. Reply HELP for assistance. Email service updates may continue.
• Email: you may ask us to stop optional hiring or marketing updates. We may continue transactional, security, billing, or legal messages connected with an active request or relationship.
• Recurring service: pause or cancel future recurring reminders in the portal. This does not cancel an already booked appointment.
• Analytics and advertising: use the controls in Section 5 or contact us with a privacy request.

Requests concerning your information

Depending on where you live and whether a particular privacy law applies, you may have the right to request confirmation of processing, access, correction, deletion, portability, or a list of certain recipients; to opt out of sale, sharing, targeted advertising, or certain profiling; to limit particular uses of sensitive information; to withdraw consent; or to appeal a denied request. We do not use personal information to make decisions that produce legal or similarly significant effects through automated profiling.

Email wishywashywindowcleaning2@gmail.com with the subject "Privacy Request" or call 360-592-3837. Tell us the right you want to exercise and the email address associated with your interaction. We will verify the request in a way proportionate to its sensitivity. We may ask for additional information and may deny or limit a request when we cannot verify it or when an exception applies. An authorized agent may submit a request where allowed by law, but we may require proof of authority and direct verification with you.

We will respond within the time required by applicable law. If we deny an appealable request, our response will explain how to appeal. We will not unlawfully discriminate against you for exercising a privacy right. We may retain information needed to complete a transaction, honor a gift certificate, provide requested service, detect security incidents, comply with law, or establish and defend legal claims.

U.S. state privacy disclosure

In the preceding 12 months, we may have collected and disclosed for the business purposes described above: identifiers and contact information; customer-record and commercial information; payment and transaction records; internet or other electronic activity; approximate location and property-address coordinates; audio, electronic, visual, or similar information such as job photographs and communications; professional or employment-related information; and inferences such as service interest or likely follow-up need. Account credentials and exact property coordinates may be treated as sensitive information in some jurisdictions. We use them only for authentication, security, address validation, routing, and service delivery, not to infer sensitive characteristics.

We disclose these categories to the recipient categories in Section 6 as reasonably necessary for our business purposes. We do not knowingly sell or share the personal information of people under 16. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

9. Other privacy information

Children

The site and services are intended for adults arranging property services and are not directed to children under 13. We do not knowingly collect personal information online from a child under 13. A parent or guardian who believes a child submitted information should contact us so we can review and delete it as appropriate.

Consumer health information

Wishy-Washy does not offer health services and does not intend to collect consumer health data. Please do not include health information in open-text fields. If you voluntarily provide limited information to explain a service or accessibility request, we will use it only to address that request, protect safety, and meet legal obligations, and will not sell it.

United States processing

Wishy-Washy operates in Washington and its core cloud infrastructure is configured in the United States. Providers may process information in other locations under their own terms. If you access the site from outside the United States, you understand that information may be transferred to and processed in the United States, where privacy laws may differ.

Changes to this Policy

We may update this Policy as our services, providers, or legal obligations change. We will post the revised Policy here and update the effective date. If a change is material, we will provide additional notice when reasonably appropriate, such as a website or portal notice or an email to account holders. A new use of information will not apply retroactively where notice or consent is required by law.

10. Contact us

Questions, requests, complaints, and appeals about this Policy or our privacy practices may be directed to: