This Privacy Policy explains how Kwashly collects, uses, shares and protects personal data when you use kwashly.com, create an account, install the Kwashly browser extension, or book a wash with a partner laundry. It also explains your rights under the EU General Data Protection Regulation (GDPR). Our Extension Privacy disclosure covers the browser extension in more detail.
1. Who we are
The controller of your personal data is Kwashly Labs, Lda. (“Kwashly”, “we”, “us”), Rua da Prata 12, 2.º andar, 1100-052 Lisbon, Portugal. Company registration (NIPC) 517 482 903; VAT PT517482903. Founded in 2024, our team of 14 works from Lisbon, Bangkok and Mexico City.
Our Data Protection Officer is Marta Vieira: [email protected]. For any privacy request, [email protected] is the fastest route; see also our contact page.
2. What this policy covers
This policy covers the Kwashly website and web app, the browser extension for Chrome, Edge, Firefox and Safari, and the marketplace that connects you to our 2,340 vetted partner laundries in 38 cities across 11 countries. A partner laundry that receives your order also processes part of your data as an independent controller in order to perform the service; our Partner Terms require every partner to meet GDPR standards.
3. What we collect
3.1 Account and profile data
Your email address, password hash, display name, home country, preferred language and currency, notification settings, and — if you subscribe — your plan (Free, Kwashly Plus or Kwashly Teams) and billing status. Plan details and prices are listed on our pricing page.
3.2 Trip and itinerary data
Saved destinations, trip names, arrival and departure dates, the number of travelers, packing preferences (for example “carry-on only”), and any notes you add to a trip.
3.3 Data read from supported booking pages
When the extension is active on a supported booking or airline page, it reads the destination city, the property or airport locality, the check-in and check-out dates, and the baggage add-on price if the page shows one. Only those values reach our API, and only to price laundry options for the trip. The rest of the page — your name, payment details, booking reference and everything else — is never read and never transmitted.
3.4 Laundry bookings and payment metadata
Pickup and delivery addresses or hotel details, chosen time slots, service type (wash and fold, express, dry clean), weight in kilograms, order status, partner messages, ratings you leave, and the payment metadata Stripe returns to us: card brand, last four digits, country, an authorization identifier and the amount. We never see or store your full card number or CVC.
3.5 Loyalty wallet
Your wallet balance, credit grants and expiries, and the bookings each credit was applied to, so the wallet works across cities.
3.6 Device, log and analytics data
IP address (truncated for analytics), browser and operating system version, extension version, referrer, pages viewed and error diagnostics. Analytics cookies are set only with your consent; see our Cookie Policy.
4. Why we use your data, and our legal bases
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and secure your account | Account and profile data, log data | Contract (6(1)(b)) |
| Plan a trip, price laundry options and show the partner map | Trip data, booking-page data, location of the destination | Contract (6(1)(b)) |
| Take a laundry booking and pass it to the partner | Booking, contact and address data | Contract (6(1)(b)) |
| Take payment and prevent payment fraud | Payment metadata, device and log data | Contract (6(1)(b)); legitimate interests (6(1)(f)) for fraud prevention |
| Send booking confirmations, pickup reminders and service SMS | Email, phone number, booking data | Contract (6(1)(b)) |
| Operate the loyalty wallet and the Plus Turnaround Guarantee | Wallet balance, booking timestamps | Contract (6(1)(b)) |
| Keep the service secure, debug faults, prevent abuse | Log and diagnostic data | Legitimate interests (6(1)(f)) |
| Product and marketing analytics | Usage events, truncated IP, consent state | Consent (6(1)(a)) |
| Marketing email and price alerts | Email, trip data, saved destinations | Consent (6(1)(a)), withdrawable at any time |
| Accounting, tax and responding to lawful requests | Invoices, transaction records | Legal obligation (6(1)(c)) |
5. How long we keep your data
| Record | Retention period |
|---|---|
| Account and profile | Life of the account, then 30 days before deletion |
| Saved trips and destinations | 24 months after the trip end date, or until you delete the trip |
| Data read from booking pages | Attached to the trip it created; discarded within 24 hours if no trip is saved |
| Laundry orders and partner messages | 24 months after completion (dispute window and quality review) |
| Invoices and payment metadata | 10 years (Portuguese accounting and tax law) |
| Loyalty wallet ledger | 5 years after the last movement |
| Security and access logs | 12 months |
| Analytics events | 14 months |
| Consent records | 5 years, as evidence of consent |
| Support email | 36 months |
6. Who receives your data
| Recipient | Role | Location of processing |
|---|---|---|
| Amazon Web Services | Hosting and database storage | EU (Frankfurt) |
| Stripe | Payments, subscriptions, fraud checks | EU and US (SCCs) |
| Google Analytics 4 | Website analytics, with Consent Mode v2 and IP truncation | EU and US (SCCs) |
| PostHog EU | Product analytics and session counts | EU (Frankfurt) |
| Brevo | Transactional and consented marketing email | EU |
| Twilio | Booking and pickup SMS | EU and US (SCCs) |
| Partner laundries | Order fulfillment: name, contact, pickup details, service and weight | The city of your trip |
| Professional advisers, auditors, authorities | Legal and accounting obligations | EU, case by case |
We do not sell personal data, and we never share it with data brokers or advertising networks for their own purposes.
7. International transfers
Your data is hosted in the European Union (Frankfurt). Where a processor is based in the United States, the transfer relies on the European Commission’s Standard Contractual Clauses, supported by encryption in transit and at rest, access controls and a transfer impact assessment. When you book a wash outside the EU — in Bangkok or Mexico City, for example — the minimum data needed to perform the service is sent to that partner under Article 49(1)(b) GDPR, because the transfer is necessary to perform the contract you asked us to arrange.
8. Your rights
- Access — a copy of the personal data we hold about you.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — deletion, where we have no overriding legal reason to keep the record.
- Restriction — pause processing while a dispute is resolved.
- Portability — your trips, orders and wallet ledger in a machine-readable JSON or CSV export.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — for analytics, price alerts and marketing, without affecting the service you have already received.
You can export or delete your account yourself from Settings → Privacy, or email [email protected]. We answer within 30 days and will say if we need the extension allowed by Article 12(3). We may ask you to confirm your identity first, and we charge no fee unless a request is manifestly excessive.
9. Complaints
If you are unhappy with how we handled your data, contact our DPO first so we can fix it. You also have the right to complain to the Portuguese supervisory authority, CNPD (Comissão Nacional de Proteção de Dados), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal, or to the authority of the country where you live or work.
10. Children
Kwashly is intended for travelers aged 16 and over. We do not knowingly collect data from anyone under 16; if you believe a child has created an account, write to [email protected] and we will delete it.
11. Automated decision-making
We do not make decisions about you solely by automated means with legal or similarly significant effects, and we do not profile you for such decisions. Laundry prices, turnaround estimates and pack-lighter suggestions are calculated from partner rates, trip length and distance; a person at Kwashly or at the partner laundry confirms every order.
12. How we protect your data
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to production systems requires single sign-on with hardware-backed two-factor authentication and is limited to staff who need it. We log administrative access, review permissions quarterly, keep no real customer data in development environments, scan dependencies continuously and commission an external penetration test every year. Card data is handled entirely by Stripe, a PCI DSS Level 1 provider. If a breach is likely to create a risk to your rights, we notify the CNPD within 72 hours and affected users without undue delay.
13. Changes to this policy
If we change how we use personal data, we update this page, raise the version number and change the date above. For material changes we email account holders at least 14 days in advance, and where a change requires consent we ask for it again. Previous versions are available on request.
14. How to contact us
Privacy questions and rights requests: [email protected]. Data Protection Officer: [email protected] (Marta Vieira). Support: [email protected] or +351 210 995 340. Post: Kwashly Labs, Lda., Rua da Prata 12, 2.º andar, 1100-052 Lisbon, Portugal. See also our Cookie Policy, Terms of Service and Accessibility statement.