Privacy Policy

1. Who we are and what this Policy covers

Xpress Oil & Lube Center is a locally owned oil change and vehicle maintenance company in Northern Nevada, in business since 1983, with four walk-in service centers: 6100 Mae Anne Ave, Reno, NV 89523, (775) 787-1000; 4993 Longley Ln, Reno, NV 89502, (775) 828-6996; 1861 E College Pkwy, Carson City, NV 89706, (775) 883-5823; and 1293 US Hwy 395 N, Gardnerville, NV 89410, (775) 301-5912. Our mailing address for this Policy is 4993 Longley Ln, Reno, NV 89502.

This Policy covers the Site, the email club and service reminder emails, the My Garage account area (including garage.xpressoilandlube.com), the coupons offered on the Site, the Rev chat assistant and the emails the Site sends. It also describes what happens with the information you give us when you call or visit a service center, where the Site is involved. It does not cover other companies' websites or apps, even ones we link to, such as Google Maps, Google reviews or Facebook.

The Site is built, hosted and operated for us by YelloPost (yellopost.com), a marketing agency in Reno, Nevada. YelloPost acts on our instructions and as a processor of the information described below. Where this Policy says "we" collect or keep information, YelloPost may be doing that work for us on servers it manages.

If you have a question about this Policy, section 24 explains how to reach us.

2. The short version

The details follow, but here is the summary:

• We collect what you type into our forms, what you choose to store in the email club and My Garage, basic technical data such as your IP address and browser, and analytics about how the Site is used.
• We use it to answer your requests, send the service reminders and offers you signed up for, run the coupons, keep your garage up to date and improve the Site.
• We do not sell personal information, and we do not share it with other companies for their own marketing.
• The people and services that see it are our staff, YelloPost (the website operator), the email services that deliver our mail, Cloudflare (security and the bot check), Google (analytics and tag management, which you can turn off) and the public vehicle database we use to decode VINs.
• Email club and garage data is kept while you are active and for three years after your last activity, then purged. You can delete it sooner yourself.
• Every marketing email has a one-click unsubscribe, and the preferences page lets you choose what you receive, change your vehicles and service center, or delete your garage.
• You can ask for a copy of what we hold about you, ask us to correct it or ask us to delete it.
• The Site is not for children under 13 and we do not knowingly collect information from them.
• Rev, the chat assistant, is automated. Do not share sensitive information in the chat.

3. Information you give us through forms

The Site has a contact form, a fleet inquiry form on the fleet page, the email club sign-up, the My Garage sign-in, and a small "before you go" call-back panel that can appear on desktop computers when your pointer leaves the page. Each one asks only for what that request needs: usually your name, a phone number or email address, the service center you prefer, something about your vehicle and your message. The call-back panel asks for a name and phone number so a service center can call you.

When you send a form, the Site emails your submission to the service center and, in some cases, to YelloPost so the request is not missed. The email includes what you typed plus the page you sent it from, the date and time, your IP address and your browser type. The service center keeps that email as a business record so it can answer you and, if you become a customer, keep track of what was discussed.

If you send us a message by regular email or call a service center, we keep what you tell us in the same way. We may write down your name, number, vehicle and the reason for the call so the right person can follow up.

Please do not put sensitive information in a form, in the chat or in an email: no payment card numbers, Social Security numbers, driver's license numbers, health information or passwords. We will never ask for a card number through the Site.

4. The email club

The email club at /join/ (also offered in the footer and on the coupons page) sends service reminders and offers by email. It is double opt-in: after you sign up we send a confirmation email, and you are not a member until you click the link in it. If you never click, we send one reminder and then delete the unconfirmed sign-up within 14 days.

When you join we store:

• Your email address, first name and ZIP code.
• The service center you prefer.
• Each vehicle you add: year, make and model, an approximate mileage range, and optionally the month your Nevada registration renews, so we can remind you before your smog check is due.
• Your phone number, only if you choose to give it, and a separate record of whether you checked the box that allows text messages.
• A consent record: the date and time you joined, the wording you agreed to, the IP address and browser (user agent) you joined from, and which form you used. We keep this so we can show that you asked for the emails.
• What we send you and whether it was delivered, opened or clicked, which coupons we issued to you, and which were redeemed and where.

The text message box is separate from joining the club and is unchecked by default. Joining the club never signs you up for texts. We do not send marketing text messages today. If you check the box, we store that consent so that if we ever start a text program we can include you, and only you, and you could stop the texts at any time by replying STOP or through the preferences page.

You can leave the club with one click from the link in any club email, or from your preferences page. Unsubscribing takes effect immediately. We add your address to a do-not-send list so that we do not email you again by mistake, and that list is checked before every send.

Bounces and spam complaints reported by your email provider also go on the do-not-send list, so that we stop mailing an address that does not want our email or cannot receive it.

5. My Garage

My Garage is an optional account area where you can see your vehicles, your last recorded service and mileage, what is due next, your member coupons, your preferred service center and your preferences. It has no password. To sign in you enter your email address and we send you a link that works once and expires quickly. Clicking it starts a session in that browser that lasts up to 30 days, stored in a secure, HTTP-only cookie. You can sign out of every session from the garage page.

When you ask for a sign-in link, we record the request, the time, your IP address and your browser, and we limit how many links one address or one connection can request, to protect your account from abuse. We store sign-in links only as a one-way hash, so the link itself is not kept in a readable form.

Your garage holds what you put in it and what the club already stores: the vehicles you add, including the VIN or plate if you choose to enter them, services you tell us you had and when, mileage, and your reminder settings per vehicle. If you enter a VIN, the Site sends it to the NHTSA vehicle database (vpic.nhtsa.dot.gov), a public service of the United States Department of Transportation, to fill in the year, make and model. We send only the VIN.

Service history in your garage can come from three places, and each entry is labeled: what you reported yourself, a coupon redemption recorded by a service center, and service center records that a service center matched to your email address or vehicle. Service center records show the date, the service center, the services performed and the mileage. They never show what any business pays us for advertising or anything about our costs.

You can edit or remove any vehicle, turn reminders off per vehicle, change your preferred service center, and delete the whole garage with the "Delete my garage" button on the preferences page. Deleting removes your customer record, vehicles, visits and coupon issues, and adds your email address to the do-not-send list so we do not email you again.

6. Coupons

The coupons page lets you save a coupon to show at the service center. Saved coupon codes are kept in your own browser's local storage (a key named xp_wallet) and are not sent to us until a service center redeems one. Clearing your browser's storage clears your saved coupons. Member coupons from the email club carry a unique code tied to your account, and when a service center redeems one we record the date, the service center and the code so that each coupon is used once. A service center may also record the ticket total of the visit alongside the redemption as part of its own sales records.

The terms of each coupon are printed on its face. Our Terms of Use explain how coupons work.

7. Information collected automatically

Like most websites, the Site's servers keep logs of each request: the page asked for, the date and time, your IP address, your browser and device type, the page that referred you and the response sent. We use logs to keep the Site running, to find and fix errors and to detect abuse. YelloPost keeps these logs on the servers it manages for a limited time and does not use them to identify you except when investigating a security problem or a request from you.

The Site is delivered through Cloudflare, which sits between your browser and our servers to speed up the Site and block attacks. Cloudflare sees your IP address and the pages you request, and may set its own cookies for security. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

The Site remembers a few things in your browser so it works the way you left it. The location picker stores the service center you chose (xp_shop) so that every page shows that service center's phone, hours and directions. Your privacy choice (xp_cc) is stored so that we do not ask again. The accessibility tools store the settings you choose. The coupon wallet is described in section 6. Short-lived items that last only for the visit record that a form was sent, that the call-back panel already appeared, the results of the What's Due tool and the chat lead you may have left, so that we do not show you the same thing twice. None of these is sent to us; they stay in your browser and you can clear them at any time through your browser's settings.

If you sign in to My Garage, a session cookie keeps you signed in, as described in section 5.

Google Analytics, if you allow it, sets its own cookies, described in section 8.

8. Analytics, Google Tag Manager and your privacy choices

We use Google Analytics 4, loaded through Google Tag Manager, to understand how many people visit, which pages they read, which service center they pick and whether they click to call, send a form, save a coupon or join the club. We may also use Google Ads conversion measurement so that we know which of our ads brought people who contacted us. These tools collect your IP address, a random identifier stored in a cookie, pages viewed, approximate location derived from your IP address, and the events described above. We do not send them your name, email address, phone number or anything you type into a form.

The Site uses an opt-out model. The Google tags do not load during the first paint of a page. They load after your first interaction or shortly after the page finishes loading, unless you have chosen "Essential only." A privacy choices card appears on your first visit. Choose "Essential only" and the Google tags stay off; your choice is remembered in your browser and the page reloads without them. You can change your mind at any time with the "Privacy choices" link in the footer.

You can also block Google Analytics in every website you visit with Google's browser add-on at tools.google.com/dlpage/gaoptout, or by using your browser's tracking protection. How Google uses data from sites that use its services is described at policies.google.com/technologies/partner-sites.

We do not use analytics data to build profiles of individual visitors, and we do not combine it with your email club or garage record.

The Site does not respond to "Do Not Track" browser signals, because there is no agreed standard for them, but the "Essential only" choice above does the same job on this Site. Where your browser sends a Global Privacy Control signal, we treat it as a request not to sell or share your information, which we do not do in any case.

The map on the home page loads map tiles from a map tile provider, and the map on each service center page is embedded from Google Maps. Those providers receive your IP address when the map loads. The addresses of our service centers are printed as text on every location page, so you do not need the map to find us.

Links to Google Maps, Google reviews and Facebook take you to those companies' sites, which have their own privacy policies.

9. Rev, our chat assistant

Rev is an automated chat assistant built for us by YelloPost AI. It answers common questions about our services, hours, service centers and smog checks, and it can take your name and phone number so a service center can call you back. Rev is software, not a person, and its answers can be wrong or out of date. For anything about your own vehicle, call the service center or drive in; the technician's inspection is what counts.

What you type in the chat is sent to the service that generates Rev's replies. When you leave the page, a transcript of the conversation may be emailed to the service center and to YelloPost so that a person can follow up on what you asked, fix wrong answers and improve the assistant. If you leave your name and number in the chat, that is treated as a form submission under section 3.

Do not share sensitive information in the chat: no card numbers, government ID numbers, health details or passwords. The chat window is also kept in your browser for the length of your visit so that you can see earlier messages. Closing the browser tab clears it.

Rev may be unavailable at times, and we may change or remove it. The Site, the forms and the phones work without it.

10. Bot checks, spam and duplicate protection

Our forms are protected by Cloudflare Turnstile, an invisible bot check that usually confirms you are a person without asking you to do anything. Turnstile runs in your browser and sends Cloudflare technical signals about the browser and the visit; it does not read what you type. If it ever asks you to complete a step, that step is Cloudflare's. If a form will not send, call any service center and we will take the request by phone.

Forms also include a hidden field that bots fill in and people do not, and the servers limit how many submissions one connection can make in an hour. A duplicate-lead guard holds a form that is identical to one sent moments before, so a double click does not create two requests. These checks use your IP address and the content of the submission and nothing else.

Every message that comes through the Site is reviewed before it is treated as a customer request. Messages that are sales pitches to us rather than requests from customers are set aside and are not answered.

We never ask you to prove you are human by giving us personal information, and we do not use these checks for any purpose other than keeping spam and abuse out.

11. Telephone calls

When you call a service center, our phone system and provider record the number you called from, the number you called, the date and the length of the call, as any phone system does. If a call is recorded for quality or training, you will hear a notice at the start; you can tell us you do not want to be recorded and we will take your call without recording or take your number and call you back.

Some of the phone numbers shown on the Site may be tracking numbers that forward to the service center, so that we can tell which page or ad led to the call. The call goes to the same people at the same service center; only the routing is different.

If you leave a voicemail, it is kept until the service center has answered it and for a short time afterward.

We do not use phone numbers collected through the Site for marketing calls, and we do not send marketing texts (see section 4).

12. How we use personal information

We use the information described above to:

• Answer your requests, call you back and get you to the right service center.
• Send the service reminders and offers you asked for in the email club, timed to your vehicle's mileage, your last visit and your registration month.
• Run My Garage: keep your vehicles and service history, show what is due and sign you in.
• Issue, track and honor coupons, one per code.
• Send transactional email: confirmation links, sign-in links, welcome coupons and replies to your requests.
• Keep the Site working, secure and fast, and find and fix errors.
• Understand how the Site is used, in aggregate, so we can improve it.
• Meet our legal obligations, keep business records and resolve disputes.

We do not use your information to make automated decisions that have a legal or similarly significant effect on you. Reminder emails are triggered by the dates and mileage in your garage, and you control them.

13. Who sees your information

We share personal information only as described here. We never sell it, rent it or give it to other companies for their own marketing.

The companies that help us run the Site and our communications, each limited to the job it does for us:

• YelloPost (yellopost.com), Reno, Nevada: builds, hosts and operates the Site, the email club, the reminder system and My Garage, receives copies of form submissions and chat transcripts so that requests are not missed, and reviews them on our behalf. YelloPost keeps the data on servers it manages and may use its own hosting providers for that.
• Zoho Mail and the email delivery services YelloPost uses to send our mail: they carry the confirmation, sign-in, reminder and offer emails and report back whether each one was delivered, bounced, opened or clicked.
• Cloudflare: delivers the Site, blocks attacks and runs the Turnstile bot check.
• Google: Google Analytics 4 and Google Tag Manager, subject to your privacy choice, and Google Maps on the service center pages. Google Ads conversion measurement may also apply.
• NHTSA vPIC: the United States government vehicle database that decodes VINs you enter in My Garage.
• The service center you visit and its point-of-sale system, when a service center records a coupon redemption or matches its service records to your garage.
• Any professional advisers, such as accountants or attorneys, when they need the information to advise us.

We may also disclose information when the law requires it, in response to a subpoena, court order or lawful request from a public authority, to protect our rights, property or safety or those of our customers or others, or to investigate fraud or abuse of the Site.

If the company is sold, merges with another business or transfers a service center to a new owner, customer records may be transferred as part of that transaction. The new owner would have to honor this Policy for information collected under it, or tell you otherwise and give you a choice.

Within the company, your information is seen only by the people who need it to help you: the staff at the service centers and the owner.

We do not share your information with data brokers, and we do not take part in advertising networks that build profiles of you across websites.

YelloPost may use information about the Site in aggregate, without identifying anyone, to report to us on how the Site performs.

14. No sale of personal information

We do not sell covered information as that term is defined in NRS 603A.330, and we have no plans to. Nevada law still gives you the right to send us a verified request directing us not to sell your covered information. You can send that request to the contact in section 24 and we will confirm it within 60 days, as the law provides.

Analytics and conversion measurement described in section 8 are not a sale: no money changes hands, and the data is used to measure our own website and advertising. You can turn those tags off with the "Essential only" choice.

15. Emails the Site sends

The Site sends two kinds of email. Transactional emails are the ones you cause: the club confirmation link, the My Garage sign-in link, your welcome coupon, replies to a form and the confirmation that a request was received. Marketing emails are the service reminders, offers and seasonal notes you asked for when you joined the club. We never mix an offer into a transactional email, and we never send marketing email to an address that has not confirmed.

Every marketing email identifies us as the sender, says plainly what it is, carries our postal address (4993 Longley Ln, Reno, NV 89502), includes a visible unsubscribe link and the one-click unsubscribe headers that mail apps use, and is sent from an address at xpressoilandlube.com with the authentication records (SPF, DKIM and DMARC) that keep our mail from being faked. This is what the CAN-SPAM Act and the major mailbox providers require, and it is how we work in any case.

An unsubscribe request takes effect immediately, not within the ten business days the law allows. If you unsubscribe from everything, you may still receive transactional emails that you trigger yourself, such as a sign-in link you request.

The preferences page linked from every club email lets you keep reminders but stop offers, pick which vehicle gets reminders, change your service center, or delete your garage, without leaving the club entirely.

16. How long we keep personal information

We keep personal information only as long as we need it for the purposes above, then delete it or make it anonymous. In particular:

• Email club and My Garage records: for as long as you are a member or have a garage, and for three years after your last activity (a confirmed email, a click, a sign-in, a visit or a coupon redemption). After three years with no activity the record is purged: customer, vehicles, visits and coupon issues.
• Unconfirmed sign-ups: deleted 14 days after sign-up if you never confirm.
• The do-not-send list: your email address alone, with the reason and date, is kept indefinitely so that we never email an address that asked us to stop. If you later join again and confirm, the new consent replaces it.
• Form submissions and chat transcripts: the service center keeps the email it received as a business record for as long as it keeps other customer correspondence. YelloPost keeps its copy for a limited time to support us and then deletes it.
• Server logs: for a limited time set by YelloPost for security and troubleshooting, typically no more than a few months.
• Google Analytics data: for the retention period set in our analytics account, after which Google deletes the user-level data. Aggregate reports may be kept longer because they identify no one.

If you ask us to delete your information, we remove it from the systems we control and ask our service providers to do the same, except for records we must keep by law, records of your request itself, and the do-not-send entry that keeps us from emailing you again.

17. How we protect personal information

No website or email is perfectly secure, and we cannot promise that, but we use reasonable measures that fit a small company and the kind of information we hold:

• The Site and My Garage are served only over HTTPS, and the forms post only over HTTPS.
• My Garage has no password to steal. Sign-in links work once and expire quickly, are stored only as a one-way hash, and sessions use secure, HTTP-only cookies that you can revoke.
• Customer data lives on a server separate from the public website, so a change to the website never touches your record.
• Access to the customer database is limited to the people at YelloPost who run it for us, and to the service centers through tools that show only what a service center needs.
• Email sending uses authenticated accounts; no mail password is stored in the website's code.
• Nightly encrypted backups of the customer database, kept for a limited time, so that a failure does not lose your garage.
• Rate limits, the Turnstile bot check and the duplicate-lead guard on every form and on the sign-in link request.

If we learn of a breach of security that affects your unencrypted personal information, we will notify you as Nevada law (NRS 603A.220) requires, in the most expedient time possible and without unreasonable delay.

Please protect your own email account. Anyone who can read your email can request a sign-in link for your garage. If you think someone else has used your garage, sign out of all sessions from the garage page and tell us.

18. Your choices and rights

You are in control of what we hold and what we send. Whatever state you live in, you can:

• Unsubscribe from marketing email with one click from any club email. It takes effect immediately.
• Use the preferences page linked from any club email to choose reminders, offers or seasonal notes, pick which vehicles get reminders, change your preferred service center or update your details.
• Delete your garage and your club record yourself with "Delete my garage" on the preferences page.
• Ask us for a copy of the personal information we hold about you. We will send it to the email address on the record, in a readable form, within 45 days.
• Ask us to correct something we have wrong, or to delete your information. We will do so unless we have to keep it by law, and we will tell you if that is the case.
• Turn off Google Analytics and Tag Manager for this Site with "Essential only" in the privacy choices card, reachable from the footer at any time.
• Clear the service center choice, saved coupons, accessibility settings and other items the Site keeps in your browser through your browser's settings.

To make a request, email us or write to us at the address in section 24, or call any service center. Tell us the email address on your record and what you would like. Because My Garage has no password, we verify requests by sending a message to the email address on the record and acting on it only when you reply or click, so that no one else can get your information by asking for it. We do not charge for requests and we do not treat you differently for making one.

If you believe we have not handled a request properly, you can contact the Nevada Attorney General's Bureau of Consumer Protection at ag.nv.gov.

19. Nevada online privacy notice (NRS 603A.300 to 603A.360)

Nevada requires operators of websites that collect covered information from Nevada residents to post a notice. For that purpose:

• The categories of covered information we collect are described in sections 3 to 11: name, postal ZIP code, email address, telephone number, vehicle details, and identifiers such as your IP address and cookies that let us contact you or recognize your browser.
• The categories of third parties with whom we may share covered information are listed in section 13.
• You can review and request changes to your covered information through the preferences page, My Garage, or a request to the contact in section 24.
• We will notify you of material changes to this notice as described in section 23.
• Google, through Google Analytics, may collect covered information about your online activities on this Site over time, if you allow the tags to load. We do not permit any third party to collect information about your activities across different websites for its own purposes.
• We do not sell covered information. Section 14 explains how to send a verified request anyway.
• The effective date of this notice is October 15, 2026.

20. Visitors from other states and countries

Our service centers serve Northern Nevada and the Site is meant for people who can drive to one of them. If you visit from another state whose law gives you additional rights, such as California, Colorado or Virginia, we will honor the rights in section 18 for you in the same way. The Site is not directed at people outside the United States, and we do not intend to collect information from them. If you use the Site from outside the United States, you understand that your information is processed in the United States.

21. Children

The Site is for adults who own or drive a vehicle. We do not knowingly collect personal information from children under 13, and no part of the Site is directed at them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

The email club and My Garage are for people 18 and older, because they involve a vehicle registration and a consent record. If you are under 18, please have a parent or guardian handle them.

22. Links, reviews and social media

The Site links to Google Maps, to each service center's Google listing where you can read and write reviews, and to our Facebook page. Those sites are run by Google and Meta under their own privacy policies and terms. Anything you post there, including a review, is public and controlled by that platform, not by us. The reviews we quote on the Site are already public on Google and are shown with the reviewer's first name and last initial as given there.

When we reply to a review, we reply on the platform, in public, and we do not add anything about your vehicle or visit that you did not already share.

23. Changes to this Policy

We may update this Policy when the Site, the law or our practices change. The effective date at the top always shows the current version. For a material change that affects email club members or garage owners, we will email the address on your record before the change takes effect. Continuing to use the Site after a change means you accept the updated Policy; if you do not, stop using the Site and, if you like, delete your garage.

24. Contact

Questions, requests about your information or concerns about this Policy can go to any of the following:

• Email: ian@xpressoilandlube.com (please put "Privacy" in the subject).
• Mail: Xpress Oil & Lube Center, Attn: Privacy, 4993 Longley Ln, Reno, NV 89502.
• Reno Northwest, 6100 Mae Anne Ave, Reno, NV 89523: (775) 787-1000.
• Reno South, 4993 Longley Ln, Reno, NV 89502: (775) 828-6996.
• Carson City, 1861 E College Pkwy, Carson City, NV 89706: (775) 883-5823.
• Gardnerville, 1293 US Hwy 395 N, Gardnerville, NV 89410: (775) 301-5912.