Privacy notice.

Who we are and what this covers

Tiger Xpress Car Wash operates at 701 Beatty Dr., Mount Holly, NC 28120. In this notice, “we,” “us” and “our” refer to the business operating Tiger Xpress Car Wash at this location.

This notice describes information we collect or handle through tigerxpresscarwash.com, our Contact, Community and Careers forms, the staff systems supporting those forms, and direct customer emails and telephone inquiries. It also covers applications submitted through our earlier Google Form.

It covers our handling of Text Club information through OptSpot and membership or gift card information we receive or access through NXT. Using a provider does not remove our responsibility for how we use information in our customer programs.

Providers may also process information for their own purposes under their own notices, as explained below. This notice does not describe on-site surveillance or every pay-station data practice, or separate employee records after hiring. Contact us with questions about information collected at the wash. Unrelated websites have their own privacy notices.

What we collect

What you give us

You choose what to send. Questions marked as optional can be left blank.

Contact form (on our Visit page): your first and last name, email address, phone number (optional), what your message is about (you pick from a list) and your message.

Community form (fundraiser requests): your first and last name, email address, phone number, your school or organization, and what you tell us about your fundraiser.

Careers application:

• your full legal name, email address and phone number;
• your age range, "18 or older" or "16 or 17" (we don't ask for your date of birth);
• the position you want, and the job opening if you picked one;
• for Wash Technician, whether you are in school (optional);
• the hourly pay you would like;
• how you will get to work, with a few words of your own if you choose "Other";
• whether you have car wash experience and, if you do, any past jobs or experience you choose to tell us about;
• your yes or no answer to "Have you been convicted of a felony in the last 7 years? (Do not include expunged records.)", and a short explanation if you choose to add one. A conviction does not automatically rule you out: we consider what the offense was, how long ago it happened, and whether it relates to the job;
• the days and hours you can work each week;
• a résumé, if you choose to attach one (PDF, DOC or DOCX, up to 5 MB), and its file name. A résumé can hold more than we ask for, such as a home address, so include only what you're comfortable sharing.

On every form we also record when you sent it and which version of this notice was shown with the form. On the Community and Careers forms you check a box to confirm you have read this notice, and we record that too. You get a six-digit reference number: keep it if you want to ask us about your form later.

Our Contact, Community and Careers forms do not ask for payment card numbers, bank details or Social Security numbers. Please do not include these, identification documents or unrelated sensitive information in messages or résumés.

Direct communications and records we create

When you email or call us, we receive the contact information you provide and the information you share about your request. We may keep correspondence, service notes and follow-up records. Staff may also add notes when reviewing a form submission or application. Please share only information relevant to your request.

What is collected automatically

• Website and hosting records. Vercel hosts our website and admin system. Requests can include your IP address, requested page or file, time, browser and device information. Technical logs support delivery, troubleshooting and security; they are not used by us for behavioral advertising.
• Form security. We use Cloudflare Turnstile to help distinguish people from bots. Cloudflare receives technical signals such as your IP address, browser information and connection characteristics. Cloudflare processes signals on our behalf to protect the website and also for its own purpose of improving bot detection. See Cloudflare’s Turnstile Privacy Addendum.
• Abuse prevention. Our form system uses identifiers derived from IP addresses to limit repeated requests. These identifiers are not a guarantee of anonymity. Hosting and security providers may separately process the underlying IP address.
• Map content. When the map on our Visit page loads, your browser requests map images from OpenStreetMap, which receives technical details including your IP address and browser information. See the OpenStreetMap Foundation privacy policy.
• Error reports. If one of our website’s own scripts fails in your browser, your browser sends a short error report to Sentry, which we use to find and fix problems with our website. A report contains the error and where in our code it happened, the page address without anything after a "?" or "#", your browser’s user-agent (its name and version, and device details such as the operating system) and the version of our website. It does not include what you type into our forms, cookies or the other pages you visited. Because your browser connects to Sentry to send the report, Sentry receives your IP address; we instruct Sentry not to store it with the report. A page sends no report unless something goes wrong, and at most five.

Cookies and browser storage

Our public website does not use advertising cookies, advertising pixels or visitor analytics tools. It uses session storage to remember whether you have seen the home-page introduction or a promotion pop-up. Those preferences are stored in your browser for the browsing session; browser settings and session restoration can affect how long they remain.

Security and sign-in services are separate from advertising tracking. Cloudflare’s security checks can use cookies or similar technologies depending on the configuration. Private staff sign-in may also use necessary authentication storage. You can manage cookies and site storage through your browser; blocking necessary storage may affect functionality.

OptSpot sign-up pages, the NXT portal and other linked sites can use their own cookies and measurement technologies. The statements above about our public website do not describe those separate sites or Text Club reporting.

How we use it

• Customer service: respond to messages, calls and requests, and maintain the records needed to follow up.
• Community programs: assess fundraiser requests and work with participating schools or organizations.
• Hiring: review applications and contact applicants. Age-range information helps us follow rules for workers under 18.
• Memberships and gift cards: assist with purchases, account questions, membership changes, cancellations and related transaction issues using information available through NXT.
• Text Club: administer sign-ups and preferences, send the messages you subscribed to, respond to replies and assess campaign results available through OptSpot.
• Form confirmations: send you a receipt and send an alert to the staff responsible for your submission.
• Website reliability: find and fix errors in our website’s code.
• Security and legal obligations: prevent abuse and fraud, handle disputes and privacy requests, preserve required records, and protect our customers, staff and business.

Text Club and OptSpot

OptSpot provides the technology for Tiger Xpress Car Wash’s Text Club. You can sign up by texting TIGER to 56506 or using our Get a free wash sign-up page, hosted by OptSpot. These are Tiger Xpress messages delivered through a service provider.

Information used for the program. This includes your mobile number, information you enter at sign-up, your subscription and opt-out status, and records of your consent and messages. Tiger Xpress uses the program information and reports made available to us to administer the Text Club and respond to you.

Campaign activity. Depending on the features enabled for our program, OptSpot’s reporting may include message delivery, replies, link clicks and offer redemptions, with related times or identifiers. Where available to us, we use these records to understand and improve our offers. OptSpot’s hosted pages may also collect browser and usage information under its privacy policy.

Your choice. Text Club enrollment is separate from submitting a Contact, Community or Careers form. Marketing consent is not required to purchase goods or services. A form acknowledgment confirms that you have read this notice; it does not sign you up for marketing texts.

Stop or get help. Reply STOP to a Text Club message to unsubscribe, or HELP for assistance. You can also contact Tiger Xpress using the details below. Recurring message frequency varies, and message and data rates may apply. Opting out of marketing texts does not cancel your Wash Club membership.

Sharing. We do not sell mobile numbers or SMS consent records, or share them with third parties or affiliates for their own marketing. OptSpot and the providers and carriers involved in delivering the program process the information needed to provide it. Necessary legal disclosures are described below.

Read OptSpot’s Privacy Policy and the Mobile Terms of Service in OptSpot’s terms, together with the disclosures shown when you sign up. This notice describes Tiger Xpress’s use of Text Club information; it does not replace those program terms.

Memberships and gift cards through NXT

The NXT customer portal handles online Wash Club enrollment, member accounts and gift cards. Information entered there is collected through that portal rather than our three website forms.

Tiger Xpress uses the account and transaction information made available to us through NXT to administer your membership or gift card and help with service requests. Depending on your transaction and the account features you use, this can include contact details, account identifiers, membership status and purchase or payment-status records. Information you provide directly to us about an account is also covered here.

Payment information entered in the portal is handled through NXT and its payment arrangements. Please review the privacy and payment disclosures presented there. Do not send full card numbers or other financial credentials through our website forms or ordinary email. Contact Tiger Xpress for help with your membership or with a privacy request involving records we handle through NXT.

Who sees it, and who we share it with

Authorized staff and support. Access is limited according to work responsibilities. Hiring staff review applications and résumés; authorized administrators and service providers may also need access to maintain systems, investigate problems or meet legal obligations. Staff may create internal notes. We do not publish private form submissions or application materials.

Email notifications. Contact and Community alerts include your contact information and submission details. Careers alerts include your name, email address, phone number and the position or opening, but not your résumé or other application answers. Alerts go to staff mailboxes, outside the form database. Your confirmation is sent to the email address you provided with your reference number.

Providers supporting our services:

• Vercel: website and admin hosting, file storage and backups.
• Neon: database hosting for submissions, staff notes and system email records.
• Resend: delivery of form alerts and confirmation emails.
• Cloudflare: Turnstile form security.
• Sentry: error reports from our website.
• Our email provider: staff correspondence and incoming alerts.
• Google: applications received through our former Google Form and associated files.
• OptSpot and message-delivery providers: Text Club administration and delivery.
• NXT and payment providers: membership, gift card and related transaction services.

Providers process information on our behalf to support these functions. Some also process technical or service information for purposes described in their own notices. For example, Cloudflare separately uses Turnstile signals to improve bot detection. Their independent processing is subject to their applicable privacy notices and law; our use of information remains subject to this notice.

Legal disclosures. We may disclose information to comply with law or valid legal process, obtain professional advice, investigate fraud or abuse, or protect rights, property and safety. Such disclosures are limited to what is appropriate for the purpose.

Business transfers. Relevant records may be disclosed or transferred in connection with a merger, acquisition, reorganization, asset sale or bankruptcy, subject to applicable law and appropriate confidentiality protections. A transfer does not by itself authorize materially different uses of previously collected information.

What we don't do

• We do not sell personal information or share it for cross-context behavioral advertising.
• We do not use Contact, Community or Careers submissions to enroll you in marketing lists. Text Club marketing requires a separate sign-up.
• We do not use advertising pixels or visitor analytics tools on our public website. Provider-hosted pages and Text Club reports are described separately above.
• We do not request Social Security numbers, bank details or payment card numbers in our three website forms.
• We do not include résumés or detailed application answers in automated Careers email alerts.

How long we keep it

Retention depends on the record and why we need it. The normal periods below are subject to a specific legal requirement or a hold to preserve relevant records for a claim, investigation or dispute. When that need ends, the records return to the applicable deletion process.

• Website forms and résumés: normally 2 years from receipt. Our scheduled deletion process covers Contact messages, Community requests and applications, their résumés and staff notes, and related email copies held in the admin system. Required preservation can extend this period. Copies outside that system need separate handling.
• Earlier Google Form applications: the same normal 2-year period. These are deleted separately from the form, linked spreadsheet and associated application files, subject to preservation requirements.
• Staff email alerts: normally within 30 days of receipt. Our staff deletion policy applies separately to these mailbox copies. Relevant records may be retained when needed for an active matter or legal preservation. Mailbox trash, recovery and backup settings can delay final removal.
• Customer correspondence and account records. Direct emails, inquiry notes, membership and gift card records are kept as needed to handle the relationship or request, resolve transaction issues, and meet applicable recordkeeping requirements. Their retention is not automatically the same as website form retention.
• Text Club records. We retain program information as needed to operate your subscription and address related requests. After an opt-out, limited consent, opt-out and suppression records may remain to document your choice, prevent unwanted messages and meet legal requirements. Unsubscribing does not automatically delete every program record.
• Email delivery records. The latest bounce, spam-complaint or provider-suppression record that blocks an address and the related email suppression entry are normally kept for 2 years after the latest report. Other delivery reports are normally kept for 90 days. Marketing SMS opt-outs are handled separately.
• Unsubmitted résumés. Uploaded files not attached to a completed application are scheduled for automatic cleanup, normally within a day.
• Abuse-prevention records. Form rate-limit identifiers expire after 15 minutes; résumé-upload identifiers are removed by the daily cleanup. Separate provider logs follow their applicable retention arrangements.
• Website error reports. Sentry deletes them automatically, normally within 90 days.
• Backups and recovery copies. Admin backups normally rotate out after about five weeks. Database and other providers may maintain separate recovery copies. Deleted records can remain in restricted backups until those copies expire. If records are restored, applicable deletion requests and retention rules must be reapplied.
• Employee records. If you are hired, necessary application information becomes part of a separate employee file subject to employment recordkeeping requirements.

Our retention rules also apply to copies we create outside the main system, including authorized downloads and exports. Deletion requires coordinating those copies and relevant provider-held records; deleting a database entry alone does not necessarily remove every copy. You can ask us to delete information sooner using the contact details below.

How we protect it

We use safeguards appropriate to the information and systems involved, including encrypted website connections, staff authentication, access restrictions, protected résumé storage, backups and measures to limit automated abuse.

Application access is restricted according to staff responsibilities. Files are intended for authorized access rather than public browsing. Authorized support personnel and providers may need access as described above. We limit the application information included in automated email alerts.

No website, email service or storage system is completely secure. If a security incident requires notice to you or a regulator, we will provide that notice as required by applicable law.

Your choices and requests

Choose what you provide. Optional form fields and résumés can be left out. We may need certain information to respond to a request, process an application or provide a service.

Access, correction and deletion. You can ask about personal information we hold about you, request a copy, ask us to correct inaccuracies, or request deletion. This can include information you submitted, related staff notes and correspondence, and records we handle through OptSpot or NXT, subject to applicable legal limits, others’ privacy and protected information.

Email info@tigerxpresscarwash.com, call 704-612-WASH (9274), or write to Tiger Xpress Car Wash, Attention: Privacy Requests, 701 Beatty Dr., Mount Holly, NC 28120. Describe the request and the form, account or program involved. Include your six-digit form reference number if available; it helps us find a record but is not proof of identity.

Verification. We take reasonable steps to verify identity and authority before disclosing, changing or deleting records. Depending on the request, we may use the email address or mobile number associated with the record and other appropriate checks. Please do not send identification documents or financial credentials unless we explain why they are necessary and provide an appropriate method.

Timing and limits. We aim to respond within 30 calendar days and will meet any applicable legal deadline. If more time or information is needed, we will explain the next steps and any extension allowed by law. If we cannot fulfill all or part of a request, we will explain the reason where permitted, including any information we must retain. We will coordinate with providers for records they handle on our behalf and direct you to them when a request concerns their independent processing.

Parents, guardians and representatives. A parent, guardian or authorized representative may contact us for someone else, including an applicant aged 16 or 17. We verify identity and legal authority before acting; a claimed relationship alone does not authorize disclosure.

Text preferences. Reply STOP to a Text Club message to unsubscribe or HELP for assistance. Contact us if you need help or want to request deletion. A deletion request and an SMS opt-out are different actions; limited opt-out records may need to remain.

Browser privacy signals. We do not sell personal information or share it for cross-context behavioral advertising under this notice, so there is no such activity for Global Privacy Control to turn off. Our public site does not perform cross-site behavioral tracking and does not change its behavior in response to Do Not Track. These statements do not describe independent linked websites.

Applicable privacy rights depend on the law and circumstances. The request process above is available regardless of whether a particular state privacy law applies. We will not penalize you for exercising rights protected by applicable law.

Children

Our website is not aimed at children under 13, and we don't knowingly collect their information. If you think a child under 13 has sent us information through our website, contact us and we will delete it.

You must be at least 16 to apply for a job. The application offers only the age ranges "18 or older" and "16 or 17".

Links to other sites

Links can take you to the NXT portal, OptSpot’s sign-up page, Google Maps or reviews, Facebook, YouTube and other services. When you open a linked site, it receives your IP address and browser information and may receive referral information depending on browser and website settings. Review that service’s privacy notice and controls.

Our website links to the NXT customer portal and OptSpot Text Club sign-up page. Those providers’ notices describe their own processing. Tiger Xpress’s handling of program information remains covered by the membership and Text Club sections of this notice.

The embedded OpenStreetMap map makes a third-party connection when it loads, as explained under What is collected automatically.

Changes to this notice

We update this notice when our practices change and identify revisions using the date and version above. For material changes, we will provide additional notice and obtain consent where required by law. Posting an updated notice does not by itself authorize a new use that requires your consent.

Our forms record the notice version presented with a submission. Acknowledging the notice is separate from any marketing consent. Contact us if you need an earlier version.

Contact us

Questions about this notice, or about your information:

• Tiger Xpress Car Wash, 701 Beatty Dr., Mount Holly, NC 28120
• 704-612-WASH (9274)
• info@tigerxpresscarwash.com