Mobile App Privacy Policy

This policy explains how Nautilus handles personal information in the Nautilus Crew mobile app, including the Compass assistant inside it (together, the “app”). It covers car wash employees who sign in with a phone number (“crew”) and managers who sign in with a Nautilus account. Our main privacy policy covers our website and SMS programs.

1. Who we are

The app is provided by Nautilus, Inc., a Delaware corporation (“Nautilus,” “we,” or “us”). Car wash businesses (“employers”) pay for Nautilus and use the app to run their teams.

For crew information, we act as a service provider to your employer. Your employer decides who is on its team, what checklists, schedules, and updates you see, and how long records are kept. We process that information on your employer’s behalf and under our agreement with them. Your employer’s own privacy notices also apply to how it uses information about you.

2. Information we collect

Information your employer gives us

Your name, the phone number your manager has on file, and your email address if your manager adds one.
Your roles, home site, and the sites you work at.
Your published shifts, open shifts, and time-off policies.
Checklists, tasks, standard operating procedure (SOP) documents, and updates your managers post.

Information you give us in the app

Phone number. When you sign in, we use your phone number to find your team and text you a one-time code.
Nautilus account email. Managers can add a Nautilus account with an email address, and a password or emailed code. Nautilus accounts are created on the web, not in the app.
Checklist answers and photos. Yes/No answers, numbers, choices, notes, and photos you take to show a checklist step or task is done. When your employer allows it, you can also choose a photo from your library. A library photo may carry details your phone saved with it, such as when and where it was taken. We do not use location details.
Schedule and time-off requests. Shift swap offers, open-shift claims, time-off requests, and any note you add for your manager.
Chat messages and comments. Messages you send in team chats, comments and thumbs-up reactions on updates, and read receipts showing which updates and messages you have seen.
Voice messages. When you record a voice message in a chat, we receive the recording, its length, and a loudness outline used to draw it. We send the recording to a speech-to-text provider and save the written transcript with the message. People in the chat can play the recording and read the transcript.
Compass requests. Questions you type or dictate to Compass, and photos or files you attach. See section 4.

Information collected automatically

Account and session identifiers. Your employee ID, your sign-in session, and, for Nautilus accounts, your user ID. The app sends one of these with each request.
Push token and device model. If you allow notifications, the app registers a push token so we can send you notifications about your schedule, time-off requests, chats, and updates. We save it with your sign-in session, along with your device model name (for example, “iPhone 16”).
Request logs. Our servers record technical details of each request, such as IP address, time, and any error. We use them to keep the service running and secure.
Crash, error, and performance reports. The app records crashes, errors, and how long it takes to open and load, along with when it happened, your device model, operating system and language, app version, battery, memory, and network state, and a random ID for this installation of the app. It sends these reports to our app-monitoring provider, which also receives your IP address and uses it to show an approximate country. We do not add your name or phone number to them. We use them to find and fix problems.
Usage analytics and session recordings. The app records which screens you open and when you open and close the app, along with your device model, operating system and language, app version, and a random ID for this installation of the app. It also records some sessions as screen recordings, with all text, text fields, and images covered so their content is not captured. These are linked to your account ID and your organization’s ID, not your name or phone number, and are sent to our product analytics provider, which also receives your IP address. We use them to understand how the app is used and to improve it.

What stays on your phone

Voice dictation. When you dictate a Compass question, speech recognition runs on your device. We do not receive your audio. Only the text you send reaches us. Voice messages you record in chats are sent to us; see Voice messages above.
Widget data and settings. The Home Screen KPI widget, your appearance setting, and your Compass privacy choice are stored on your phone.

What we do not collect

The app does not ask for your location and does not track where you are. It does not track clock-in or clock-out time. It does not include advertising code.

When you open an SOP document, the app loads it from our file storage. We do not record which documents you open.

3. How we use information

We use the information above to:

Sign you in and keep your account secure.
Show you your shifts, checklists, tasks, documents, updates, and chats for your team.
Save your checklist answers and photos, and send your requests to your managers for review.
Send you push notifications about your schedule, time-off requests, chats, and updates.
Answer Compass requests.
Fix problems, prevent abuse, and keep the service running.
Meet legal obligations.

Your managers and teammates see information your employer’s setup shares with them. For example, managers see your checklist answers and photos, time-off requests, and swap requests, and people in a chat see your messages there.

4. Compass and AI processing

Compass is an AI assistant for managers with a Nautilus account. Before you use it, the app asks you to allow AI sharing on that device.

When you use Compass, we send your messages, attached photos and files, relevant conversation history, and the business data your request needs to third-party AI service providers. That business data can include customer information from the systems your employer connects to Nautilus. These providers process requests for us to write answers, analyze data, and create or edit images.

Compass can also search the web and read web pages to answer a request. When it does, we send the search terms and page addresses Compass writes from your request to a third-party web search provider.

We save Compass conversations to your Nautilus account so you can come back to them. You can turn Compass off in the app. Turning it off stops new Compass requests from that device. It does not recall data already sent or delete saved conversations.

AI answers can be wrong. Check important information before you act on it, and only share information you are allowed to use for these purposes.

We share personal information only as follows:

With your employer. Your managers and the people your employer adds to chats see what the app shows them, as described in section 3.
With service providers. They process information for us under contract, only to provide their service to us. We use these categories of providers:
- Hosting and database providers
- Sign-in and account authentication providers
- SMS delivery providers, to text you sign-in codes
- File storage providers, for checklist photos and documents, and chat photos and voice messages
- Speech-to-text providers, to transcribe voice messages you send in chats
- Push notification services, to deliver notifications to your phone
- Real-time messaging providers, to deliver chat messages as they are sent
- Analytics, feature-management, and monitoring providers that our servers use. They receive account and organization identifiers and technical request data. For Compass, this can include the content of requests and answers, which we use to find errors and improve Compass.
- App-monitoring providers, for the app’s crash, error, and performance reports
- Product analytics providers, for the app’s usage analytics and session recordings
- Third-party AI service providers that process Compass requests
- Web search providers, when Compass searches the web or reads a web page for your request
For legal reasons. When the law requires it, or to protect the rights, safety, or property of our users, employers, Nautilus, or others.
In a business transfer. If Nautilus is involved in a merger, acquisition, or sale of assets, subject to this policy.

6. No selling, tracking, or ads

We do not sell your personal information or share it for cross-context behavioral advertising. The app does not show ads. It does not track you across other companies’ apps or websites, and it does not use your device’s advertising identifier. Your phone number is not used for marketing messages through the app.

7. How long we keep information

We keep crew information for as long as your employer uses Nautilus, or until your employer deletes it or asks us to. Your employer sets how long it keeps records such as checklist results, schedules, and chats.

We delete a sign-in code request, which includes your phone number and IP address, when you use the code.
When you sign out, we delete that device’s sign-in session on our servers, including the push token and device model saved with it. When your employer deactivates you on its team roster, we delete all of your sign-in sessions.
When an employer stops using Nautilus, we delete or return its data under our agreement with that employer.

We may keep some information longer when the law requires it, to resolve disputes, or to enforce our agreements. Backups, logs, and crash reports are deleted on their normal schedule.

8. Security

We protect information with encryption in transit, access controls, and one-time sign-in codes. The app stores your sign-in session in your phone’s secure storage. No system is perfectly secure, so we cannot guarantee that information will never be accessed without permission. If you think your account has been used by someone else, sign out and contact your manager or us.

9. Your choices and rights

Permissions. You can turn camera, photo library, microphone, speech recognition, and notification access on or off in your phone’s Settings. Some features stop working without them. For example, a checklist photo step needs the camera, and a voice message needs the microphone.
Compass. You can turn Compass on or off under Compass privacy in the app.
Access, correction, and deletion. Depending on where you live, you may have the right to ask for a copy of your personal information, or ask us to correct or delete it. We will not treat you differently for asking.

To make a request, email support@nautilus.co. We will confirm who you are before we act. We hold crew information for your employer, so we may send your request to your employer or act on its instructions. You can also ask your employer directly.

10. Deleting your account and data

You cannot create an account in the app. Your employer adds crew to its team, and Nautilus accounts are created on the web. Anyone who uses the app, whether or not they are on a crew roster, can ask us to delete their account and data by email. To delete your account and the data tied to it:

If you’re on a crew roster, you can ask your manager to deactivate you. This ends your crew access right away and deletes your sign-in sessions. If you sign in with a Nautilus account and are not on a roster, skip this step.
Email support@nautilus.co from the phone number or email address on your account, or include it in your message. You can email us directly; you don’t need to ask your manager first. We will confirm the request with your employer and tell you when it is done, or tell you what we must keep and why.

You can also remove some data yourself in the app:

Delete a chat message you sent.
Cancel a time-off request that is still pending.
Delete a saved Compass conversation from the Compass chat list.
Sign out to delete that device’s session and push token.

11. Children

The app is a workplace tool for car wash employees. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy. When we do, we will change the effective date above. If we make significant changes, we will post a notice on our site or in the app before they take effect.

13. Contact us

If you have questions about this policy or your information, contact us at support@nautilus.co, or write to Nautilus, Inc., 525 Brannan St, STE 410, San Francisco, CA 94107.