Serving Bahrain — mobile car wash at your locationinfo@mistriconnect.com
Book Now

Privacy Policy

Last updated: October 2026

1. Who we are

MistriConnect operates an e-commerce retail platform for on-demand car care in Bahrain: customers browse service packages and add-ons, book and schedule a wash or detailing appointment online (one-time or on a recurring subscription), pay online, and are matched with an independent, licensed service Partner who fulfils the order. This policy explains how we collect, use, share, and protect personal data across that booking-and-scheduling flow, in line with Bahrain's Personal Data Protection Law (Legislative Decree No. 30 of 2018, "PDPL"), enforced by the Personal Data Protection Authority (PDPA). It applies to customers, service Partners, and their staff.

2. Data we collect

  • Account data: name, phone number, email address, and password (stored as a salted hash — we cannot see your actual password). If you choose Sign in with Google, Google shares your name and email address with us to create or link your account; we never receive your Google password.
  • Security settings: whether you have turned on Two-Factor Authentication, and the one-time codes we send (by email or SMS) for sign-in, phone verification, and password reset. These codes expire quickly and are used only to verify you.
  • Booking and scheduling data: the service package and any add-ons selected, vehicle information (make, model, plate), service address and parking/access details, chosen date and time slot, and — for recurring plans — the subscription frequency (e.g. weekly/bi-weekly), selected days, and the series of upcoming and past appointments it generates. Rescheduling or cancelling a booking is also recorded.
  • Order and transaction data: your order/booking history and status, itemised pricing (package price, add-ons, any vehicle-size surcharge), promo codes applied and the discount given, wallet balance and how it was earned or redeemed (for example, referral credits), and payment/refund status for each order.
  • Payment data: processed by our licensed payment gateway partner; we never see or store your full card number or CVV. If you choose to save a card, the card is tokenized and held by our payment partner, and we store only the token reference, card brand, last four digits, and expiry month/year so you can recognise and reuse it. The card brand and last four digits are also recorded on the booking or plan you paid for, so they can appear on your invoice. Fils-level rounding adjustments to your wallet (see our Terms) are recorded in your transaction history.
  • Communications data: in-app chat messages and photos you exchange with a Partner or with support about a booking, and support tickets you open.
  • Photos: a profile photo or vehicle photos you choose to upload, and before/after photos of your vehicle that the assigned Partner may take as a record of the completed service (these may show the number plate and surroundings). The app accesses your camera or photo library only when you choose to add a photo.
  • Service progress records: the time a job was started and completed, checklist items ticked by the Partner, the staff member assigned, reminder and notification history, and whether a wash was marked as missed (no-show) together with any reschedule or refund request you make.
  • Company (fleet) plan data: if you are a Driver, the details your Corporate Client gives us (your name, mobile number, employee or driver reference, vehicle plate and model), your seat and Voucher status, your company-covered plans and washes, and any payments your Corporate Client records as received from you. If you use the company portal for a Corporate Client, your name, work email, and portal activity.
  • Partner data: company details, commercial registration and trade licence, staff identification, vehicle registration, insurance certificates, and bank details for payouts.
  • Device and technical data: IP address, device/browser type, app version, crash and performance data, and a device push-notification token (used to deliver booking and scheduling updates). For each signed-in session we record a device description (for example "Safari on iPhone"), when it was created and last active, so you can review and sign out sessions under Security.
  • Activity and error log: the actions you take on the website and apps (for example signing in, booking, paying, cancelling or updating your profile), whether each one worked, and any error message shown to you, with the time, app type and version, and IP address. We use it to help you when something goes wrong and to keep accounts secure; it never includes your password, codes or card details, and it is kept for 180 days.
  • Device security signals: the mobile app checks whether it is running on a rooted/jailbroken device, an emulator, or a device in developer mode. If so, that fact (not the contents of your device) is recorded in our security log to help prevent fraud and account abuse.
  • Notification preferences: which channels (push, email, SMS) you have turned on or off.
  • Usage analytics: pages viewed, features used, and app events, collected via Firebase Analytics, to understand how the Platform is used and to fix problems.
  • Location: the service address you enter or save, and — where you place it — a map pin (latitude/longitude) marking the exact parking spot. If you tap "use my current location", the app or browser asks for permission and reads your device's location once, only at that moment, to place the pin. We do not track your device's location in the background or continuously. Address searches and pin placement use Google Maps services (see Section 6).
  • Biometrics: if you turn on Biometric Login in the mobile app, Face ID / fingerprint checks are performed entirely by your device's operating system. MistriConnect never receives or stores your biometric data.

3. Legal basis for processing

We process personal data on one or more of these bases under the PDPL: performance of a contract (to create your account and fulfil a booking), your consent (for example, marketing messages, which you can withdraw at any time), our legitimate interests (fraud prevention, service improvement, platform security), and compliance with a legal obligation (for example, retaining financial records for tax purposes).

4. How we use your data

  • To operate the online booking and scheduling flow: processing your order (package, add-ons, and any promo code), assigning a time slot, matching it with an available Partner, and generating and managing future appointments for recurring/subscription plans.
  • To share only what is necessary with the assigned Partner to complete your booking: a shortened form of your name (for example "M•••n A."), a masked phone number, the service address and map pin, vehicle details, and any booking notes. Partners never see your full name, full phone number, email address, or payment information, and contact you through in-app chat.
  • To run company (fleet) plans: verifying Voucher activation with a one-time code, applying the Corporate Client's cover and limits, keeping washes at approved company locations, and giving the Corporate Client reports on its Drivers' Fleet Plan activity.
  • To send booking reminders (by email and push notification) and to detect and handle missed washes, including notifying you, the Partner, and our team.
  • To process online payments and refunds for your order, apply wallet credit or promo discounts, and maintain your order/transaction history and receipts.
  • To send service and scheduling notifications (order confirmations, upcoming-appointment reminders, status updates, payout notices) and, only with your consent, marketing messages, which you can opt out of at any time from account settings or via the unsubscribe link.
  • To keep your account secure — verifying sign-ins (including Two-Factor codes), signing out inactive sessions, letting you review and sign out devices, and signing out other devices when your password changes — and to detect and prevent fraud, abuse, and security incidents, and to enforce our Terms.
  • To improve the Platform through aggregated, de-identified analytics — for example, understanding which service areas need more Partner coverage or which time slots are in highest demand.

5. Automated matching

When you place a booking, our dispatch system automatically suggests nearby, available Partners based on your service area and Partner availability, to reduce wait time. This assists booking allocation; it does not make legal or similarly significant decisions about you, and a human (our operations team) can review or override dispatch outcomes on request.

6. Sharing and disclosure

We do not sell your personal data. We share data only where necessary, with:

  • The Partner assigned to your booking (that Partner's managers and the staff member assigned to the job — other staff don't see it), limited to what they need to perform the service: a shortened form of your name, a masked phone number, service address and map pin, vehicle details, and booking notes. Partners are contractually required to use this data only to perform your booking, not to contact you for unrelated purposes without consent, and not to retain or reuse it once the booking is complete except for warranty/re-wash follow-up or as required by law.
  • Our licensed payment gateway partner (AFS), to process card payments, refunds, and saved-card tokens securely.
  • Service providers acting on our instructions, only for the purposes we specify: Amazon Web Services (hosting, database, and storage of uploaded photos and documents); Google (Firebase push notifications and analytics, Google Maps address search and map display, and Sign in with Google if you use it); SendGrid (transactional email); and our SMS gateway provider (one-time codes and text notifications).
  • Google Maps, when you tap a service address in the mobile app to open it — the address or map pin is then sent to Google Maps (or your browser) outside the MistriConnect app and handled under Google's privacy policy.
  • Bahrain authorities or regulators, where required by law, court order, or to protect the rights, property, or safety of MistriConnect, our users, or the public.
  • A successor entity in the event of a merger, acquisition, or sale of assets, subject to the same privacy commitments described here.

6A. Company (fleet) plans

If you take part in a Corporate Client's Fleet Plan, MistriConnect and the Corporate Client each process your data for their own purposes. We receive your details from the Corporate Client to set up your seat, and we share with that Corporate Client's authorised portal users your name, registered mobile number, driver reference, vehicle plate and model, and your Fleet Plan activity (wash dates and times, status, location, usage against company limits, plan and renewal status, and payments it has recorded). We do not share your card details, Wallet balance, or Bookings you make outside the Fleet Plan. The Corporate Client is responsible for its own use of the data it receives, including any downloads or exports, under its own privacy notice. If your seat is revoked or reassigned, we stop sharing new activity with that Corporate Client, but records already shared or needed for billing and audit are kept as described in Section 8.

7. International data transfers

Some of the providers we use (for example, cloud hosting, push-notification, maps, email, and analytics services) may process data on servers located outside Bahrain. Where this happens, we require providers to apply security and contractual safeguards consistent with the PDPL's requirements for cross-border transfers.

8. Retention

We retain personal data only as long as needed for the purposes described above, or as required by Bahrain law — for example, financial and transaction records are generally retained for the period required by Bahrain's tax and commercial regulations. When data is no longer needed, we delete it or render it anonymous. Signed-in sessions expire automatically (website sessions after a period of inactivity; all sessions after a maximum period, currently 30 days) and expired sessions are removed. When you delete your account in the app or on the website, it is closed immediately and all of its sessions are signed out; records we must keep by law (for example, invoices and payment records) are retained for the required period, and you can contact us to confirm what has been retained or erased.

Job records (status times, checklist ticks and before/after photos) and missed-wash records are kept for as long as needed to handle complaints, damage claims and disputes, and in line with our financial record-keeping. Company (fleet) plan records, including activity reports and payments recorded by a Corporate Client, are kept for the duration of the Corporate Client's agreement and for as long afterwards as needed for billing, audit and legal claims.

9. Security

We apply industry-standard security measures including encryption in transit (HTTPS), salted password hashing, optional Two-Factor Authentication, automatic sign-out of inactive website sessions, session-token expiry, signing out other devices when a password is changed or reset, rate limiting on sign-in and one-time-code endpoints, card tokenization by our payment partner, role-based access controls for our staff, Partner access limited to their own assigned jobs, short-lived signed links for private documents, and, in the Android app, blocking screenshots and screen recording on card and password screens. No system is completely secure; if we become aware of a data breach likely to affect your rights, we will notify affected users and the PDPA as required by Bahrain law.

10. Your rights

Under the PDPL you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data, subject to our legal retention obligations; object to or restrict certain processing; withdraw consent to marketing at any time; and request a copy of your data in a portable format. You can update your profile, addresses, vehicles, saved cards, notification preferences, and security settings yourself in the app or on the website, and delete your account from Settings. To exercise any other right, contact support@mistriconnect.com — we verify your identity and respond within 30 days. You may also lodge a complaint with Bahrain's Personal Data Protection Authority (PDPA).

11. Children's privacy

The Platform is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Cookies and similar technologies

We use essential cookies for login sessions and security, and analytics cookies/SDKs (including Firebase Analytics) to understand site and app usage. You can disable non-essential cookies in your browser without affecting core booking functionality.

13. Changes to this policy

We will post any changes on this page and, for material changes, notify you through the Platform before they take effect.

14. Contact

Questions or requests about your personal data: support@mistriconnect.com