Privacy Policy

1. INTRODUCTION

This Privacy Policy describes how Tsunami Express Intermediate Holdco (“Tsunami Express,”“we,”“us,” or “our”) collects, uses, discloses, and protects personal information when you:

• Visit our website at https://www.tsunamiexpress.com
• Use our car wash services at any Tsunami Express location
• Purchase a membership or use our payment kiosks
• Interact with us through sales, marketing, events, or customer service

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Services.

Data obtained through the short code program will not be shared with any third parties for their marketing reasons/purposes.

For questions about this Privacy Policy, contact us at [email protected].

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

When you interact with our Services, you may provide:

Account and Membership Information:

• Name, email address, phone number, mailing address
• Account credentials (username and password)
• Vehicle information (make, model, year, color, license plate number)
• Membership plan details and wash preferences

Payment Information:

• Credit/debit card information (stored securely by our payment processors)
• Billing address and transaction history

Communications:

• Correspondence with customer service
• Feedback, surveys, and reviews
• Marketing preferences

2.2 Information Collected Automatically

Video Surveillance and License Plate Recognition:

We operate video surveillance cameras and Automatic License Plate Recognition (ALPR) systems at our car wash locations for membership validation, security, and operational purposes. This includes:

• License plate images and data captured when vehicles enter our property and approach wash tunnels
• Video footage of vehicles and individuals on our premises
• Timestamps and location data associated with each visit
• Vehicle characteristics (e.g., make, model, color) as captured by cameras

License Plate Data Practices:

• Purpose: ALPR data is used primarily to validate active memberships and facilitate automatic entry for members. It may also be used for security, loss prevention, and resolving customer service issues.
• Retention: License plate data and associated video footage are retained and may be deleted based on our internal procedures, except when needed for ongoing investigations, legal proceedings, or as required by law.
• Cameras Facing Public Roads: Some cameras may incidentally capture license plates of vehicles passing by on public roads. Such data is not actively monitored or used for any purpose other than facility security and is subject to the same retention policies.
• Sharing: License plate data may be shared with law enforcement in response to valid legal requests, subpoenas, or court orders, or to protect our rights and property.

Important Notice: By entering our premises, you consent to being recorded by our video surveillance systems and to the capture of your vehicle’s license plate information as described above.

Website and Mobile App Usage Data:

• IP address, browser type, device information, operating system
• Pages visited, time spent, clickstream data
• Referring website or search engine
• Cookies and similar tracking technologies (see Section 6)

Location Data:

• Geolocation data (if you enable location services)
• Location of car wash visits based on facility you visit

Service Usage Information:

• Wash history, including dates, times, locations, and services selected
• Membership usage patterns and frequency of visits

2.3 Information from Third Parties

We may receive information from:

• Payment processors (to complete transactions)
• Marketing platforms (Google, Meta/Facebook, etc., when you interact with our ads)
• Data analytics providers (for aggregated, anonymized insights)
• Publicly available sources (if you interact with us on social media)

We do not purchase lists of consumer data for unsolicited marketing purposes.

2.4 SMS/Text Message Data

If you opt into receiving text messages from us through our short code program:

Data obtained through the short code program will not be shared with any third parties for their marketing reasons/purposes.

• We collect your mobile phone number and message preferences
• Standard messaging rates may apply
• You may opt out at any time by replying “STOP” or “UNSUBSCRIBE”
• Message frequency varies based on your preferences and our promotions
• We may send account notifications via text message even if you opt out of promotional messages

3. HOW WE USE YOUR INFORMATION

We process your personal information for the following purposes:

3.1 To Provide and Improve Our Services

• Facilitate account creation and authentication and manage user accounts
• Process membership registrations and account management
• Deliver and facilitate delivery of services to you
• Facilitate car wash services and transactions
• Identify vehicles through ALPR for membership validation, use-monitoring, or promotional offerings
• Customize wash preferences and settings
• Process payments and manage billing (fulfill and manage your orders, payments, returns, and exchanges)
• Provide customer support and respond to inquiries
• Troubleshoot technical issues and improve service quality

3.2 For Marketing and Communications

• Send promotional emails, text messages, and marketing materials about offers, discounts, and new services (you may opt out at any time)
• Deliver targeted advertising based on your location, preferences, and wash history
• Conduct customer surveys and request feedback
• Notify you of program updates, service changes, or new locations

3.3 For Safety, Security, and Legal Compliance

• Monitor our facilities through video surveillance for safety and loss prevention
• Investigate and prevent fraud, misuse, or security incidents
• Enforce our Terms and Conditions
• Comply with legal obligations, court orders, and law enforcement requests
• Protect our rights, property, and the safety of our customers and employees

3.4 For Analytics and Business Operations

• Analyze usage trends and customer behavior to improve Services
• Identify usage trends to better understand how Services are being used
• Evaluate the effectiveness of marketing campaigns
• Generate aggregated, anonymized reports for business planning
• Conduct internal research for service development

We process your information only when we have a valid legal basis, including: Your consent, Performance of our contract with you, Compliance with legal obligations, and Our legitimate business interests (balanced against your rights).

4. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We may share your information in the following limited circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who perform services on our behalf, including:

• Payment processors and financial institutions
• Cloud hosting and data storage providers
• Email and SMS marketing platforms
• Customer relationship management (CRM) systems
• Analytics and advertising partners
• IT support and security service providers

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.2 Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your information may be transferred as part of that transaction. You will be notified of any such change.

4.3 Legal Requirements and Protection

We may disclose your information if required to do so by law or in response to:

• Subpoenas, court orders, or legal processes
• Law enforcement requests or government investigations
• Requests to protect the rights, property, or safety of Tsunami Express, our customers, or others
• Situations involving potential fraud, security threats, or illegal activity

4.4 Aggregate or De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, marketing, analytics, or other business purposes.

5. DATA SECURITY

We implement reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of sensitive data in transit and at rest
• Secure servers and firewalls
• Regular security assessments and updates
• Access controls limiting who can view or use your information
• Employee training on data protection and privacy

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, pixel tags, and similar tracking technologies to collect information about your interactions with our website and Services.

6.1 Types of Cookies We Use

• Essential Cookies: Required for basic website functionality (e.g., login, shopping cart)
• Performance Cookies: Collect information about how you use our website to improve performance
• Functional Cookies: Remember your preferences and settings
• Advertising Cookies: Deliver targeted ads based on your interests

6.2 Your Cookie Choices

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our website. Most browsers allow you to:

• View and delete cookies
• Block third-party cookies
• Block all cookies (not recommended)
• Clear cookies when you close your browser

6.3 Third-Party Analytics and Advertising

We use third-party analytics services such as Google Analytics to understand website usage. These services may use cookies and similar technologies. For more information:

• Google Analytics: https://policies.google.com/privacy
• Opt-out of Google Analytics: https://tools.google.com/dlpage/gaoptout

We also use advertising platforms such as Google Ads and Meta (Facebook) Ads. You can opt out of interest-based advertising through the Digital Advertising Alliance (http://optout.aboutads.info) or the Network Advertising Initiative (http://optout.networkadvertising.org).

7. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, or for a longer retention period if required or permitted by law. Retention periods vary based on:

• The nature of the information (e.g., account data vs. transaction history)
• Our legal and regulatory obligations
• Whether you have an active account or membership
• Our business needs (e.g., providing services, preventing fraud)
• As required by applicable tax laws

When we no longer need your information, we securely delete or anonymize it in accordance with our internalpractices.

8. YOUR PRIVACY RIGHTS AND CHOICES

Depending on your location, you may have the following rights regarding your personal information:

8.1 Access and Portability

You have the right to:

• Request confirmation of whether we process your personal information
• Access the personal information we hold about you
• Receive a copy of your information in a structured, commonly used format (data portability)

8.2 Correction and Deletion

You have the right to:

• Request correction of inaccurate or incomplete personal information
• Request deletion of your personal information, subject to legal exceptions (e.g., we may need to retain certain information for legal compliance)

8.3 Opt-Out of Marketing

You can opt out of receiving promotional communications at any time by:

• Clicking the “unsubscribe” link in emails
• Replying “STOP” to text messages
• Adjusting your communication preferences in your account settings
• Contacting us at [email protected]

Please note that even if you opt out of marketing communications, we may still send you transactional or service-related messages (e.g., account notifications, billing information).

8.4 Do Not Track

Some browsers have “Do Not Track” features that signal your preference not to be tracked online. Currently, there is no industry standard for how to respond to these signals. We do not currently respond to Do Not Track signals.

8.5 How to Exercise Your Rights

To exercise any of the rights described above, please:

• Email: [email protected]
• Mail: Tsunami Express Intermediate Holdco, Attn: Privacy

4800 Meadows Rd, Suite 200

Lake Oswego, OR 97034

We will respond to your request within the timeframe required by applicable law (typically 30-45 days). We may need to verify your identity before processing your request. You will not be discriminated against for exercising your privacy rights.

9. CHILDREN’S PRIVACY

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected], and we will take steps to delete such information.

10. INTERNATIONAL USERS AND GEOGRAPHIC SCOPE

Our Services are intended for residents of the United States only. We do not knowingly collect information from residents of the European Economic Area, United Kingdom, or Switzerland. If you are located outside the United States, please do not use our Services.

11. STATE-SPECIFIC PRIVACY RIGHTS

11.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties with whom we share information
• Right to Delete: Request deletion of your personal information, subject to legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. However, some of our data practices may be considered “sharing” for cross-context behavioral advertising purposes. You have the right to opt out.
• Right to Limit Use of Sensitive Personal Information: Request that we limit the use of your sensitive personal information (e.g., precise geolocation, financial account information)
• Right to Non-Discrimination: You will not be discriminated against for exercising your CCPA/CPRA rights

California Shine the Light Law: California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

To exercise your CCPA/CPRA rights, contact us at:

• Email: [email protected]
• Phone: (219) 213-6865

You may designate an authorized agent to make requests on your behalf. We will require verification of your identity and the agent’s authority.

11.2 Colorado, Connecticut, Virginia, and Utah Residents

If you reside in Colorado, Connecticut, Virginia, or Utah, you have similar rights under your state’s privacy laws, including:

• Right to confirm whether we process your personal information and access that information
• Right to correct inaccuracies in your personal information
• Right to delete your personal information
• Right to obtain a copy of your personal information in a portable format
• Right to opt out of the processing of personal information for targeted advertising, sale, or profiling

We do not sell personal information or engage in profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise your rights, contact us using the information in Section 8.5.

If we decline to act on your request, you may appeal the decision by contacting us at [email protected] and specifying that you wish to appeal. We will respond to your appeal within the timeframe required by applicable state law.

12. THIRD-PARTY LINKS AND SERVICES

Our website and Services may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to those third-party sites. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Privacy Policy on our website with a revised “Last Updated” date
• Notify you via email or through our Services if the changes are significant

Your continued use of our Services after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.

14. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Tsunami Express Intermediate Holdco

Attn: Privacy

4800 Meadows Rd, Suite 200

Lake Oswego, OR 97034

Email: [email protected]