Privacy

TunnelRunner is operations software for car washes, provided by Berwick Labs, LLC. This policy explains what the service holds, who it belongs to, and what we do with it.

Two kinds of people use TunnelRunner, and the difference matters throughout this policy. An operator is the business that subscribes — the company that runs the wash. Its team are the owners, managers and attendants that operator adds to the account.

Whose data this is

The operator decides who is on their team, which sites those people can reach, and what their checklists record. We hold that information on the operator's behalf and act on their instructions.

In data-protection terms the operator is the controller and Berwick Labs, LLC is the processor. If you are an attendant or a manager and you want to know what is held about you, or want it corrected, ask your employer first — they control the account. We will help them answer you.

What the service holds

Account information, entered by the operator or by you when you sign in:

• Your name and initials, and the email address you sign in with
• Your role — attendant, manager or owner — and which sites you have been given access to
• The identifier your sign-in provider gives us, so we can recognise you next time

What the service records as you work

TunnelRunner exists to keep a record of a wash's daily running, so this is the substance of it:

• Which checklists were run, when, and by whom
• Which items were completed, which were skipped, and the reason given for a skip
• Photos, where a checklist item asks for one
• Faults raised, their notes and comments, and who closed them
• Downtime recorded against a site, and the figures derived from it

This is a record of people's work

We want to be direct about this rather than leave it between the lines. A completed checklist names the person who completed it and the time they did it. Over a week it shows who opened late, who skipped what, and why. That is the point of the product — it is what makes a wash auditable — but it is also employee monitoring, and it should not be a surprise to the person being monitored.

If you are an operator, tell your team that checklist completion is recorded against their name before you put them on the floor with it. Some states and some employment agreements require that you do. We are not in a position to do it for you.

Card details

We never see them. Subscription payments run through Stripe, on Stripe's own pages, and card numbers do not reach our servers at any point. What we hold is Stripe's identifier for the customer, the state of the subscription, and how many sites it covers.

Who else processes it

TunnelRunner runs on five services, each of which necessarily handles some of the above. We do not sell data to anyone, and none of these are advertising companies:

• Convex — the database and backend the service runs on
• Clerk — sign-in and identity
• Stripe — subscription payments
• Resend — the invitation and digest emails the service sends
• Vercel — hosting for the application itself

The website

This policy also covers tunnelrunner.com, the public website, which is separate from the application. The website uses Google Tag Manager to load analytics, so we can see how people find it and which pages they read. Google is an advertising company, which is why it is named here separately rather than folded into the list above.

It only runs if you accept it. Until you do, no analytics or advertising cookies are set, and you can change your answer at any time from the Cookies link in the footer. Nothing from an operator's account — no checklists, runs, faults or photos — is sent to Google. The application itself does not carry these tags.

One operator cannot see another

Every operator's data is separated from every other operator's, and that separation is enforced on the server for each request rather than by what the screen happens to show. A person signed in to one operator cannot read another's sites, team, checklists or records.

How long it is kept

Operational records are kept, deliberately. A car wash may need to show what was checked on a given morning long after the fact, so completing a run does not begin a countdown to its deletion.

Closing a site does not delete anything. The site stops appearing to attendants and stops producing checklists, and everything recorded against it stays readable.

An operator can close their account entirely, which removes their sites and the operator record. Where work has already been recorded against a site, the service refuses that deletion rather than destroying the record silently — if you need it gone, write to us and we will deal with it deliberately.

Security

Traffic is encrypted in transit. Sign-in is handled by Clerk rather than by us holding passwords. Every request that reads or writes anything resolves who is asking and what they are allowed to reach, on the server.

No service is perfectly secure and we are not going to claim otherwise. If you believe an account has been compromised, tell us straight away.

Children

TunnelRunner is for people at work. It is not intended for anyone under 16, and an operator should not add one to their team.

Changes

If this policy changes in a way that affects what we do with your information, we will say so in the application rather than quietly updating the date at the top.

Getting in touch

Write to ryan@tunnelrunner.com. If you are on an operator's team, your employer controls the account and is the faster route for most questions — but you are welcome to contact us directly.