Membership Review
Draft, for lawyer review. This text has not been reviewed by a lawyer yet and may change.

Terms of service

Draft prepared 2026-10-17. Not yet reviewed by a lawyer.

This agreement is between [Entity name pending] ("we", "us" or "Provider") and the car wash business that subscribes to Membership Review ("you" or "Customer"). Section 7.1 sets out how your data is owned and used.

Data ownership and use

1. Your data is yours. "Customer Data" means everything your cameras, your staff and your EverWash account put into the Service and everything the Service derives from it: images, plate reads, vehicle descriptions, member records, visit history, AI outputs, verdicts, standing, notes, logs about your members, and any statistics or models built from them. You own Customer Data. We claim no rights in it beyond the limited permission in section 2.

2. We use it only to serve you. We will process Customer Data only (a) to provide, secure, support and bill the Service to you, (b) as you instruct in writing (including through the Service's settings), and (c) as the law requires, in which case we tell you first unless the law forbids it. Nothing else.

3. What we will never do with Customer Data. We will not: sell it; rent it; share it with any other customer; combine or pool it with any other customer's data; use it to build or maintain any list, score or database that is used for anyone but you (including any shared "banned" or "watch" list); use it to train, fine-tune, evaluate or benchmark any machine-learning or AI model that serves anyone but you; use it for our marketing, sales, product analytics or research; or create biometric identifiers or templates (face, voice, gait or similar) from it. This applies equally to aggregated, anonymised, pseudonymised or de-identified data derived from Customer Data. Unlike many providers, we do not reserve any right to use de-identified data.

3a. Learning that serves only you. The Service does learn from your own data to serve you better: it builds profiles of your members' vehicles from their confirmed visits, keeps reference photos, learns how reliable each of your cameras is in each lighting condition, and may build an index or model from your data alone. Everything it learns this way is Customer Data: it is used only in your account, never for any other customer or for us, is included in your export, and is deleted with the rest of your data.

4. Isolation. Customer Data is stored and processed in a logically separate tenant with its own encryption keys. No employee, contractor or system can query across tenants. We test this and will show you the test results on request.

5. Support access. Our staff access your tenant only when you ask for help or approve a specific access in writing (a ticket or in-app approval counts), only for that purpose, only for the time needed, and every access is logged with who, when and what. You can see the log at any time.

6. Your members' data and EverWash. You confirm you have the right under your EverWash agreement to use EverWash dashboard data with the Service, that you have given your members the notices the law and your agreements require, and that you decide every warning, cancellation or other action. The Service helps you review evidence; it does not make decisions about your members.

7. Export. You can export all Customer Data at any time, in open formats (CSV/JSON for records, original JPEG/PNG for images, with a manifest), from the Service or on request within [10] business days. We never charge for export.

8. Deletion. You can delete any member, image or case at any time. When your subscription ends, we keep your data in read-only mode for [30] days so you can export it, then delete it from live systems. Backups are rotated so that deleted data is gone from all backups within a further [35] days. Within [10] business days after that, we send you a signed deletion certificate. If a law requires us to keep something longer, we tell you what and why.

9. Retention you control. You set retention periods for each data type within the ranges the Service offers. Defaults are listed in the Data Handling Standard. If a state law where you operate requires a shorter period (for example 60 days for plate data in Arkansas), you must set it, and the Service will enforce it.

10. Who we share with. We use the subprocessors listed at /subprocessors. Each is bound in writing to terms at least as protective as these. We give you [30] days' notice before adding or changing one; you may object, and if we cannot resolve your objection you may terminate and we refund prepaid fees for the unused period.

11. Security incidents. If we learn that Customer Data was accessed, disclosed, lost or altered without authorisation, we notify you within [72 hours] of confirming it, with what we know, what we are doing, and what we suggest you do, and we keep you updated. We help you meet your own legal notice duties (for example Texas's 60-day individual and 30-day attorney-general deadlines) at no charge.

12. If someone demands your data. If a court, agency or anyone else demands Customer Data from us, we tell you promptly (unless legally forbidden), give you the chance to object, and disclose only what we are legally compelled to.

13. Survival. Sections 1-3, 8, 11 and 12 survive termination.

Other terms

The full agreement will also cover the following topics. A lawyer must draft each one before the first paying customer.

  • Scope of service: what Membership Review provides and what it does not.
  • Customer responsibilities: lawful camera placement, required signage and member notices, EverWash authorisation, accurate instructions, and human review before any action is taken.
  • Decision-support disclaimer: Membership Review helps review evidence. It does not make final decisions about members, and its verdicts can be wrong.
  • Acceptable use: no face recognition requests, no use for immigration, repossession or stalking, and no sharing of outputs beyond membership administration.
  • Fees: monthly or per-member pricing, as set out in the order form.
  • Term and termination: the initial term, renewal, and termination for convenience or for breach.
  • Data return: export and deletion of Customer Data as described in sections 7 and 8.
  • Limitation of liability: a cap at 12 months' fees, mutual exclusion of consequential damages, and higher caps for confidentiality and data breach.
  • Indemnities: you indemnify us for unlawful camera use, missing signage, and wrong verdicts you act on; we indemnify you for intellectual property infringement and for breaches we cause.
  • Governing law: Texas.

Questions about these terms: hello@washattest.com.