Last updated: 6 October 2026
This policy explains how WashMás, the technology platform for self-service laundromats and hotels offered at washmas.app and in the WashMás app (iOS, Android and web), handles personal data. It applies to visitors of this website, people who request a demo or our guide, laundromat staff who use the app, and customers who create an account in the app.
Who handles your data?
WashMás is the trade name of Francisco Javier González Martín, tax ID (NIF) 78854910P, registered at Calle San Isidro San Matías 18, 3º, 38108 La Laguna, Santa Cruz de Tenerife, Spain. You can reach us at hello@washmas.app or +34 624 448 296. More details in the legal notice.
WashMás acts in two different roles:
- Controller of the data from this website (visitors and people who request a demo or the guide) and of app user accounts: the data you sign up with, log in with and use to set up the app.
- Processor of the data generated at each laundromat or hotel: machine usage, payments and sales, and what the store records about its customers. The owner of each store is the controller of that data, as they provide the laundry service to you. WashMás processes it on the owner's behalf and following their instructions, under Article 28 GDPR.
Each store owner's details appear on the QR page of their machines. To exercise your rights over a store's data, you can contact its owner or us, and we will pass your request on.
WashMás may use anonymised or aggregated data that can no longer identify anyone, for example the total number of washes on the platform.
What data do we handle?
If you visit the website or ask us for information:
- "Request a demo" form: name, email, phone (optional) and number of machines.
- "Download the guide" form: name, email and phone.
- With each form: your language, the page you came from and the campaign parameters in the address (UTM), if any.
- Booking a call (optional): after sending the demo form you can book a call on Cal.com, which receives your name, email and the date and time you choose.
- Anti-spam check (Cloudflare Turnstile): technical browser signals and your IP address, to check you are not a bot. It does not use advertising cookies.
- Website analytics (PostHog), only if you accept cookies: pages viewed, clicks, device and browser. It does not include your name or what you type in forms.
- Approximate region: from the network information Cloudflare gives us, we know whether you are visiting from the Canary Islands to adapt a line of text. It is not stored.
- WhatsApp: if you message us on WhatsApp, we receive your number, profile name and messages.
If you have a customer account in the app (street laundromats only; hotel guests pay by QR without creating an account):
- Sign-up: first name, last name, email and password. The password is stored with irreversible encryption and no one at WashMás can see it. Your email is confirmed with a code. To create the account you must declare, with a checkbox, that you are 18 or over; we do not ask for your date of birth.
- Sign-up or sign-in with Google or Apple (mobile app only): if you sign up or sign in with Google or Apple, we don't create or see any password: they send us an identifier of your account, your email (with Apple it may be a private relay address if you choose to hide your email) and your name if you share it. Google also tells us the email is verified and may send your profile photo URL, which we don't use. We still store when you accepted this policy and your statement that you are over 18.
- Acceptance of this policy and the terms: the checkbox is required and we store the date you accept.
- Linked stores: the laundromats you join by scanning a machine's QR code.
- History: the washes and dries you pay for while logged in: machine, date, time, amount, payment method and payment reference. These records are also part of the store's data, and the store is their controller.
- Payments: cards and Bizum are processed by Redsys on behalf of the store. WashMás never sees or stores your card number.
- Notifications (optional): if you turn them on, we store your phone's notification identifier, its platform (iOS or Android), your language and the machines you ask us to watch. You can turn them off in your app account or in your phone settings. When you turn them off or log out, we delete that phone's identifier.
- "Diviértete" game plays (optional): if you play the app's mini-games while logged in, for each play we store the game, the laundromat if any, the date and time, the score and the duration, linked to your account. They are used to show your playing streak and for each laundromat's "Top 10", which only shows which games are played most, with no one's names or scores.
- No location: the app does not ask for or use your location.
- App errors: if the app crashes, a technical error report is sent (device, system, app version and what failed), without your name or email.
If you work at a laundromat that uses WashMás (owners, managers, technicians and cash collectors): first name, last name and email; any optional profile details you choose to add, such as date of birth, address or photo; and your role in each store. The activity you record at a store, such as cash collections or machine activations, is part of that store's data. Each cash collection records the name of the person who made it, and it is kept with the store's data even if their account is deleted.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling your demo request, sending you the guide and managing any call you book | Your consent, when you submit the form |
| Website analytics | Your consent, in the cookie notice |
| Protecting forms from bots and abuse | Our legitimate interest |
| Creating and running your account, letting you pay and showing your history | Performance of the app terms of use you accept when signing up |
| Signing in with Google or Apple | Performance of the terms of use, because you choose that method to create and use your account |
| Storing your "Diviértete" game plays, your streak and each laundromat's "Top 10" | Performance of the app terms of use, because you choose to play with your account |
| Phone notifications | Your consent, when you turn notifications on |
| Detecting and fixing errors and keeping the service secure | Our legitimate interest |
| Recording each store's usage and sales | Decided by the store owner as controller; WashMás processes it on their behalf |
We do not sell your data or use it for advertising.
Which providers handle the data?
To provide the service we work with these providers, who process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Platform database, user accounts, website forms and server functions | Data stored in Ireland (EU). US company; its server functions may run outside the EU |
| Cloudflare | Hosting of this website, the web version of the app and the QR pages; anti-spam check; cookieless visit statistics for the web version of the app; forwarding of domain email | Global network. US company |
| Sentry | App error logging, without your name or email | Data in the EU (Germany). US company |
| Resend | Sending emails: sign-up code, password reset, form notifications and guide delivery | Sends from Amazon Web Services servers in Ireland. US company |
| Expo, Apple and Google | Delivering phone notifications (phone identifier and language) | United States |
| Redsys | Card and Bizum payments, on behalf of the store | Spain |
| Particle | Connectivity for the machine boards. Machine data only, no personal data | United States |
| Cal.com | Booking the demo call, if you choose to | United States |
| PostHog | Analytics for this website, only if you accept cookies | EU |
When any of these providers processes data outside the European Economic Area, the transfer relies on the mechanisms provided for in the GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for participating companies, or the European Commission's standard contractual clauses, in line with each provider's data processing terms.
Google and Apple (Google Ireland Ltd. / Google LLC and Apple Distribution International Ltd. / Apple Inc.), only if you choose to sign in with them: they verify your identity and send us the data above, as controllers of their own sign-in service under their own policies. They may process data in the US under the EU-US Data Privacy Framework.
How long do we keep data?
- Demo and guide requests: as long as needed to handle your request and keep in commercial contact, and until you ask us to delete them.
- App account: while it exists, until you delete it in the app or ask us to erase it. If you sign up and do not confirm your email, the sign-up is deleted automatically after 30 days.
- Google or Apple link: lasts as long as your account; when you delete it we also revoke WashMás's access in your Apple account. Google or Apple sign-ups that never accept this policy are deleted after 30 days.
- Phone notification identifier: until you log out on that phone, turn notifications off or delete your account.
- Game plays: until you delete your account, which deletes them.
- Each store's usage and sales: for as long as the store owner decides, as controller, under their commercial and tax obligations. If you delete your account, those records remain with the store but are no longer linked to your account.
- Error reports: for a limited period, according to the error logging service's settings.
- Backups: deleted data may remain for up to 8 days in the daily database backups, which are deleted automatically. If a backup were ever restored, the deletions would be applied again.
- Website analytics: the PostHog cookie lasts 365 days. Details in the cookie policy.
What are your rights?
You can request access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw your consent at any time.
- In the app, on your profile: "Download my data" creates a file with your account data, your washes and payments, and your linked sign-in methods (email, Google or Apple) with their dates, and your "Diviértete" game plays; and "Delete my account" removes your account, your profile, your phones' notification identifiers and your links to stores. Your washes and payments are anonymised: they are kept for the store without being linked to you.
- By email, at hello@washmas.app, for any right.
- To delete your account, with or without the app, follow the steps at washmas.app/en/delete-account, which also explains what is deleted and what is kept.
You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD).
Security
Data is encrypted in transit and at rest. Database access is restricted by permissions based on each user's role, so each person only sees what concerns them.
Cookies and local storage
This website only uses analytics cookies (PostHog) if you accept them in the notice shown on your first visit. If you decline, no analytics script loads. Cloudflare's visit statistics for the web version of the app do not use cookies. In the web version of the app, your session is kept in the browser's local storage so you stay logged in. You can see the details and change your choice in the cookie policy.
Minors
This website is aimed at professionals who run laundromats or hotels. You must be 18 or over to create a customer account in the app. Paying by QR without an account has no age requirement.
Changes to this policy
If the way we handle your data changes, we will update this page and its last-updated date.
Contact
For any question about this policy or your data, write to us at hello@washmas.app or call +34 624 448 296.