Privacy here is not a marketing preference. It is part of the structure of this House.

We collect information because there are things you request we do, things we need to know in order to do them, and occasionally things the law requires us to keep.

We do not collect your information in order to turn you into a product.

Your information is not for sale.

We do not sell, rent, trade, license, exchange, or otherwise monetize personal information you give us.

We do not give it to another company so that company can advertise to you, build a profile about you, enrich its own datasets, or use your information for its own commercial purposes.

We do not treat the personal information entrusted to us as a saleable business asset.

That means we do not consider our mailing lists, form submissions, client records, correspondence, or other personally identifiable information to be inventory that may simply be transferred to a buyer because ownership of a business changes.

If that policy ever changes, affected people will be told before their information is placed under the new policy and will be given a reasonable opportunity to have their personal information deleted instead.

We do not sell, rent, trade, monetize, contribute as an asset, or disclose your personal information for another party’s independent use. Service providers may process information only where necessary to perform services for the House.

Some companies help us keep the House running.

Absolute privacy does not mean pretending the internet has no infrastructure.

We use service providers to perform specific functions for us. Depending on how you interact with the House, those providers may include website hosting, forms, communications, scheduling, payment processing, banking, invoicing, document storage, or similar infrastructure.

Cookies and analytics.
This website uses necessary cookies required for basic site operation. With your permission, it may also use limited analytics cookies to understand visits, traffic sources and page use.

Non-essential cookies are restricted unless you choose to accept them. You may accept, decline or manage those preferences through the cookie controls provided on the site.

Squarespace may process certain technical and usage information as the website host and analytics provider.

Contact and correspondence.
Messages sent through our contact forms may be delivered to and processed through Proton Mail. Proton Mail acts as part of the communications infrastructure used to receive and manage correspondence with the House.

Payments.
Where we offer payment through Square, payment information is submitted to and processed by Square rather than being stored by The Wash House as ordinary website-form data. Square’s own privacy and security terms govern its processing of that information.

Those providers may necessarily process information in order to perform the service we asked them to perform.

That is different from giving your information away.

We expect service providers handling personal information for us to use it only for the purpose of providing their service, subject to their contractual, privacy, and security obligations.

We collect what the interaction requires.

Information you provide may include things such as:

• your name

• email address

• telephone number

• mailing or business address

• organization or household information

• information submitted through questionnaires or forms

• correspondence with the House

• documents or files you intentionally provide

• transaction and payment-related information

• other information necessary for a particular Wash, inquiry, qualification process, or service

Different pathways inside The Wash House require different information from the guests who enter them. We do not need every piece of information from every person.

Where information is particularly sensitive, we may deliberately collect it through a more protected channel rather than through ordinary website forms.

Sensitive information receives stronger treatment.

For forms that warrant increased protection, The Wash House uses Zoho Forms privacy and security controls according to the sensitivity and purpose of the information being collected.

Zoho Forms allows individual fields to be marked as Personal or Encrypted. Personal fields receive additional handling warnings when their information is used in exports, notifications, integrations, or similar actions. Encrypted fields receive an additional layer of protection while stored; Zoho uses AES-256 application-level encryption at rest for this data. 

For forms involving electronic protected health information where HIPAA applies, Zoho provides a separate HIPAA configuration. HIPAA protections must first be activated for the organization and then enabled for the individual form. Fields containing ePHI can then be specifically identified and are encrypted by default, with additional restrictions on access, export, and transmission. Where required, use of Zoho for HIPAA-covered information also requires the appropriate Business Associate Agreement. Zoho provides tools intended to support HIPAA-compliant use; simply using Zoho Forms does not by itself make a form HIPAA compliant. 

For highly sensitive information where HIPAA is not the applicable framework, Zoho also provides full-form encryption. In that mode, the form’s records, reports, approvals, and tasks are protected behind a separate access code, and some export, notification, and sharing functions are restricted. Zoho does not permit full-form encryption and HIPAA mode to be configured on the same form. 

Access is limited by purpose.

Information entrusted to the House should be available only to the people who reasonably need it to perform the work connected to it.

Access is not permission to browse.

As the House grows, permissions, accounts, systems, and procedures may change, but the principle does not: access follows function.

We keep information only while there is a reason to keep it.

We may retain information while it is needed to:

• respond to an inquiry

• maintain an active relationship

• complete work you requested

• maintain necessary operational or financial records

• resolve disputes or questions

• protect the House and its guests

• comply with legal, tax, accounting, regulatory, or recordkeeping requirements

When information no longer has a legitimate reason to remain, it may be deleted or anonymized.

Some records cannot be deleted immediately simply because they are requested—for example, information we are legally required to preserve or information necessary to document a completed financial transaction.

You may ask what we have or ask us to delete it.

You may contact us to ask about personal information you have directly provided to the House, request a correction, or request deletion.

Where applicable law gives you additional rights, those rights remain yours.

We may need to verify that a request actually came from you before providing, changing, or deleting personal information.

Some information may have to be retained where the law requires it or where another legitimate legal obligation prevents immediate deletion.

Florida law, where applicable, requires covered controllers to give consumers a reasonably accessible privacy notice identifying categories of data processed, why it is processed, applicable sharing, and methods for exercising statutory privacy rights. 

Security is a practice, not a promise of impossibility.

We use administrative, technical, and organizational measures intended to protect information from unauthorized access, disclosure, alteration, loss, or misuse.

No website, network, device, transmission method, or storage system can truthfully promise absolute security.

So we will not make that promise.

What we can promise is that privacy and security are design requirements here, not afterthoughts.

If something materially changes, we will tell you.

If we materially change how personal information is used, disclosed, sold, transferred, or treated, we will update this page.

If a future change would conflict with our present commitment not to sell or commercially transfer information entrusted to us, we will not impose that new rule on information already collected without notice.

Affected people will be informed directly and given an opportunity to request deletion before their information becomes subject to the materially different practice, except where retention is legally required.

Questions, corrections, and deletion requests.

Privacy questions and data requests: house+privacy@thewashhouse.club

Security concerns and incident reports: house+security@thewashhouse.club

Last Updated: September 13, 2026