Privacy Policy
Last updated 9 November 2026
Glossily is software for car detailing businesses: detailing, ceramic coating, paint protection film and tint. It gives a detailer one place to handle enquiries from Facebook Messenger, Instagram, SMS, email and their website, and to send quotes, take bookings and deposits, store job photos and ask for reviews.
This policy explains what personal information Glossily handles, why, who we share it with, and how you can see, fix or delete it.
Who we are
Glossily is run by Autoclean Limited (NZBN 9429051708825), 208b Valley Road, Mount Maunganui 3116, New Zealand. In this policy "Glossily", "we" and "us" mean Autoclean Limited.
Our privacy officer is Aaron Wilton-Jones. Questions or requests about privacy: [email protected].
Two kinds of people, two roles
Detailers and their staff sign up for Glossily and use it to run their business. For their account details, we decide how the information is used.
A detailer's customers (people who message, call, email or book with a detailing business) never sign up or log in to Glossily. They only see the business's own name and receive links from that business. The detailing business decides what it collects about its customers and why. Glossily stores and processes that information on the business's behalf, following its instructions.
If you are a customer of a detailing business, that business is your first contact for questions about your information. You can also contact us directly and we will help (see Data Deletion).
What we collect
From detailers and their staff
- Name, email, phone number, and a password (stored only as a secure hash).
- Business details: business name, address, service area, services and prices, opening hours, logo and branding.
- Settings and connections you choose, such as a connected Facebook Page, Instagram account, phone number, email address or Stripe account.
- Records of what happens in your account, such as sign-ins and changes, kept in an audit log for security.
- Subscription and billing details. Card payments are handled by Stripe; we never see or store full card numbers.
About a detailer's customers (on the business's behalf)
- Contact details: name, phone number, email address, and suburb or address where the job is done.
- Messages sent to and from the business by Messenger, Instagram, SMS, email or the business's website form, including attachments.
- Vehicle details, quotes, bookings, job notes and job photos.
- Payment records, such as deposits and balances paid (amount, date, status). Card details stay with Stripe.
- Review requests and any reviews or feedback they give.
Information from Meta (Facebook and Instagram)
When a detailer connects their Facebook Page or Instagram professional account to Glossily, we receive and store:
- A Page access token, which lets Glossily read and reply to that Page's or account's messages. It is encrypted before it is stored.
- The Facebook Page's ID and name, and the linked Instagram account's ID and username.
- Messages people send to that Page or account, delivered to us by Meta webhooks: the message text, details about any attachments (such as type and link), and the sender's name and Meta-scoped ID (an ID Meta gives that person for this app only).
- The replies the business sends through Glossily.
That is everything we store from Meta. We do not store the connecting person's Facebook profile, profile photos, Page posts, comments, insights or follower information.
We use this Meta data only to run that business's inbox: showing the conversation to the business, helping them reply, and linking the conversation to a quote or booking. We do not sell it, use it for advertising, use it to build profiles of people, or share it with any other business. Meta data from one business is never visible to another business.
When a business disconnects its Page or account, we delete the access token and unsubscribe the Page from our app, so no new messages reach Glossily. To have past messages deleted, see Data Deletion.
From using the website and app
We use cookies only to keep you signed in and secure. We do not use analytics tools, advertising pixels, advertising cookies or third-party trackers on Glossily or on the links a business sends its customers.
How we use it
- To provide Glossily: show enquiries, send replies, quotes, booking confirmations, reminders, payment links and review requests that the business asks us to send.
- To draft replies with AI. The business sees the draft and can edit it. A business can also choose to let some drafts send automatically, and remains responsible for them.
- To take payments for the business through its own Stripe account.
- To keep the service secure, prevent misuse and fix problems.
- To bill detailers for their subscription and contact them about their account.
- To meet legal obligations.
We do not sell personal information. We do not share it for advertising. We do not use a detailer's customer data for our own marketing.
AI
Glossily uses Anthropic's AI models (through its API) to draft replies and to help businesses set up their account. To do this, the relevant conversation and business details are sent to Anthropic for processing. Anthropic acts as our service provider and, under its API terms, does not use this data to train its models.
Who we share it with
We use trusted service providers to run Glossily. They process data only to provide their service to us.
| Provider | What for |
|---|---|
| Stripe | Subscription billing, and customer deposits and balances paid into each detailer's own Stripe account (Stripe Connect) |
| Square | Customer deposits and balances paid into the detailer's own Square account, for businesses that use Square instead of Stripe |
| Twilio | Sending and receiving SMS |
| Postmark | Sending and receiving email |
| Cloudflare (R2) | Storing job photos and files |
| Railway | Hosting the app and its database |
| Anthropic | AI drafting of replies and setup help |
| Meta | Receiving and sending Messenger and Instagram messages for a connected business |
We may also share information if the law requires it, to protect people's safety, or as part of a sale or restructure of our business (in which case this policy would continue to apply).
Where it is stored
The providers above may store and process information outside your country. When we send information overseas we take reasonable steps so it is protected in a way comparable to New Zealand and Australian privacy law, including choosing providers with strong security and contractual privacy commitments.
How we protect it
- Each business's data is kept separate from every other business's data in our database.
- Access tokens and other secrets are encrypted at rest (AES-256-GCM).
- All connections use HTTPS.
- Passwords are stored only as secure hashes.
- Account activity is recorded in an audit log.
- We keep personal information out of our system logs.
No system is perfectly secure. If a privacy breach is likely to cause serious harm, we will tell the affected businesses and people, and the regulator, as the law requires.
How long we keep it
We keep information while the business's account is active. When a business closes its account or asks us to delete its data, we delete it within 30 days, except where we must keep some records by law (for example billing records for tax). Backups are overwritten on a rolling basis after that.
Your rights
You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live (for example New Zealand, Australia, or a US state such as California), you may have further rights, such as to know what we collect and to not be treated differently for using your rights. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of.
To make a request, email [email protected]. If you are a customer of a detailing business, we may pass your request to that business or work with them to complete it. We will reply within 30 days. We may need to confirm who you are first.
Detailers can ask us to export or delete their business's data at any time. See Data Deletion.
Complaints
If you are unhappy with how we handled your information, please tell us first and we will try to fix it. You can also complain to the regulator:
- New Zealand: Office of the Privacy Commissioner, privacy.org.nz
- Australia: Office of the Australian Information Commissioner, oaic.gov.au
- United States: your state Attorney General or consumer protection agency
Children
Glossily is a business tool and is not meant for children. Detailer accounts are for people aged 18 or over.
Changes to this policy
We may update this policy. We will change the date at the top, and for important changes we will tell detailers by email or in the app before they take effect.
Contact
Autoclean Limited (Glossily)
208b Valley Road, Mount Maunganui 3116, New Zealand
[email protected]