Legal

Privacy Policy

Effective November 8, 2026

Dryline VMS is vending management software for operators. This policy explains what we collect when you use the Dryline VMS web app, the Dryline VMS mobile app, and this website, and what we do with it.

Cactus Wash Systems LLC ("Dryline VMS", "we", "us") provides Dryline VMS: the web application at app.drylinevms.com and your organization's own Dryline VMS address, the Dryline VMS mobile app for iOS and Android, Rain Pay card acceptance on vending machines, and this website. This policy covers all of them. It is written for the people who use Dryline VMS at work: vending operators and the staff they add to their organization.

1. Who this policy is about

  • Operators and staff. Dryline VMS accounts are created by an organization's administrator, not by self-service sign-up. Your organization decides who has an account and what they can do.
  • Vending customers. People who buy from a machine running Rain Pay pay the card processor directly. We receive transaction records (amount, time, machine, masked card details, and authorization results), never full card numbers. We do not know who the buyer is.
  • Website visitors. People who read this site or request a demo.

2. Information we collect

Provided by your organization or by you

  • Account information: your name, work email address, role, and the organization you belong to. Passwords are stored as salted hashes; we never see or store the password itself.
  • Machine and sales data you enter: machines, locations, products, prices, planograms (slot layouts), restock and inventory counts, and notes. This is your organization's business data.
  • Product photos: pictures you choose to take or pick from your photo library to illustrate a product. The app only accesses the camera or photo library when you start that action, and only the images you choose.
  • Barcode scans: product codes you scan with the camera or a connected Socket Mobile scanner. A code is used to find the product in your catalog and, when it is not there, may be sent to a third-party product-data service to suggest a name and image. Scans are not linked to any consumer.
  • Demo and contact requests: name, email, phone, company, role, and message, plus the answers you give about your operation (such as machine count, current payment setup, and timeline) when you use a form on this website, and how you heard about us if you choose to say. We keep them in our customer relationship management (CRM) system, HubSpot, along with how you found us: the page you landed on and any campaign or ad tags in the link you followed.

Collected automatically

  • Transaction records from machines running Rain Pay, as described above, so your reports and reconciliation can match sales to slots.
  • Device and diagnostics data: app version, operating system, device model, an app-generated device identifier, IP address, and crash or performance reports. We use Sentry for crash reporting. We do not use advertising identifiers and we do not track you across other companies' apps or websites.
  • Sign-in and security events: sign-in attempts, session activity, password changes, and account requests, kept for security and audit.
  • QuickBooks Online information, if your organization connects its QuickBooks Online company, as described in section 5.
  • Bluetooth: the mobile app uses Bluetooth only to connect to Socket Mobile barcode scanners you pair. It does not derive location from Bluetooth and does not scan for other devices.
  • Website cookies and analytics: this website uses Google Analytics and HubSpot, which set cookies to count visits and show which pages are read and which links or ads brought visitors here. If you send us a form, HubSpot connects it to the pages you viewed on this site. Vercel Web Analytics also counts page views, without cookies. This website also remembers, in your browser's own storage, the page you first landed on and any campaign or ad tags in the link you followed (the ad tags for up to 30 days), so that a form you send later is credited to the right ad.

What we do not collect

  • Precise location. The mobile app does not request location permission.
  • Your contacts, messages, or files other than the photos you choose to upload.
  • Audio. The app does not request microphone access.
  • Full payment card numbers. Card data is handled by the payment processor.

3. How we use information

  • Provide, secure, and support Dryline VMS, including signing you in and keeping your organization's data separate from everyone else's.
  • Show your organization its machines, inventory, sales, and reports, and reconcile card sales to slots.
  • Provide the optional AI features in DrylineVMS Pro, which suggest a machine's planogram and each product's tax category.
  • Post entries to your organization's own QuickBooks Online company, when it adds QuickBooks Online sync.
  • Diagnose crashes and performance problems and improve the product.
  • Communicate with you about your account, security, service changes, and support requests.
  • Respond to demo and partnership inquiries.
  • Understand how visitors find and use this website, and measure whether our advertising leads to demo requests.
  • Bill your organization for its Dryline VMS plan and Rain Pay services.
  • Meet legal, tax, and accounting obligations and enforce our terms.

We do not sell personal information and we do not use it to target third-party advertising. To measure our own ads, we may share a one-way hashed (scrambled) copy of the email address or phone number from a website form with Google Ads, so Google can report whether an ad click led to that request. If you clicked one of our ads on Reddit in the 30 days before you send a form, we share the same hashed copy with Reddit, together with the click identifier Reddit added to the ad's link, for the same purpose.

4. How information is shared

  • Your organization. Dryline VMS is a workplace tool. Your organization's administrators can see the accounts in their organization, the changes each account makes, and all of the organization's machine and sales data.
  • Service providers that process data on our behalf and under contract: the Rain Pay card processor (iPOSpays / Dejavoo Systems), hosting and database infrastructure, crash and diagnostics reporting (Sentry), email delivery, product-data lookup for unknown barcodes, website analytics (Google Analytics), customer relationship management and website analytics (HubSpot), and Intuit Inc. (QuickBooks Online), for organizations that connect QuickBooks Online (see section 5).
  • AI providers (OpenAI and Anthropic), for the optional AI features in DrylineVMS Pro. They receive product, slot and sales information and any notes or supplier files an operator adds for a suggestion, never payment, cardholder or customer information, and process it on our behalf under terms that do not allow them to train their models on it.
  • Hardware partners. If you use a Socket Mobile scanner, the scanner's companion software may collect its own diagnostics under Socket Mobile's privacy policy. We do not send them your account or sales data.
  • Legal reasons. When required by law, regulation, legal process, or to protect the rights, property, or safety of Cactus Wash Systems LLC, our customers, or the public.
  • Business transfers. As part of a merger, acquisition, financing, or sale of assets, with notice as required by law.

5. QuickBooks Online

Organizations that add QuickBooks Online sync connect their own QuickBooks Online company. You sign in to Intuit yourself and approve the connection there. We never see your Intuit password, and we ask Intuit only for access to accounting data.

  • What we read: your QuickBooks company's settings, its list of accounts, and the entries Dryline VMS posted. We use them only to post and correct those entries.
  • What we post: one journal entry per location for each day, with that day's vending sales (card and cash), sales tax collected, and refunds, to the accounts your organization chooses. If your organization turns them on, we also post a daily cost of goods entry based on the product costs it entered, and an entry for each recorded cash collection. When a day's figures change, we correct its entry or post an adjustment entry. Entries carry totals only and never include card details. If your organization asks us to, we also create the accounts these entries use in its QuickBooks company.
  • What we keep: the access keys and your QuickBooks company ID, stored encrypted, along with the accounts your organization chose and a record of each entry we posted.
  • Intuit: Intuit Inc. provides QuickBooks Online. What your QuickBooks company holds, including the entries we post, is handled under your organization's own agreement with Intuit.
  • Disconnecting: your organization can disconnect at any time in Dryline VMS, which revokes our access with Intuit and deletes the keys, or by removing Dryline VMS from its connected apps in QuickBooks Online. If the add-on ends, posting pauses and your settings are kept; after 100 days paused, we revoke our access and delete the keys. Entries already posted stay in your QuickBooks company.

6. Security

All traffic between the apps and our servers is encrypted in transit (TLS). Passwords are hashed, sessions can be revoked centrally, and access to data is limited by organization and role. On mobile, session tokens are stored in the device's secure keychain or keystore, not in app backups. No system is perfectly secure, so we also monitor for abuse and require sign-in again when a session is stale.

7. Retention

We keep account information for as long as the account exists. Machine, inventory, and sales records belong to your organization and are kept for as long as the organization keeps its Dryline VMS subscription, then deleted or anonymized according to the organization's agreement with us and our legal retention obligations (for example, transaction records we must keep for tax and payment-network rules). Diagnostics data is kept for a limited period and then deleted. What is sent to the AI features and what comes back is deleted after 30 days; we keep only usage figures, such as how many suggestions were made and what they cost.

8. Your choices and rights

  • Delete your account. Because accounts are managed by your organization, you request deletion rather than deleting from the app directly. In the mobile app, open Account and tap Request account deletion, or email support@drylinevms.com from the address on the account. Your organization's administrator removes the account and we delete the personal information tied to it within 30 days, except where we must keep a record by law. The organization keeps its own business records (for example, which account restocked a machine), which are not personal information about you once the account is removed. See how account deletion works.
  • Access and correction. You can see and edit your name in the app. For anything else, or to receive a copy of the personal information we hold about you, contact us at the address below.
  • Photos and Bluetooth. You can revoke the app's camera, photo-library, and Bluetooth permissions at any time in your device settings. Scanning with the camera and pairing scanners will stop working until you allow them again.
  • Regional rights. Depending on where you live, you may have additional rights to access, correct, delete, restrict, or port your personal information, or to object to certain processing. We honor those requests as the law requires and will not discriminate against you for making one.

9. Cookies and analytics

The web app uses essential cookies for sign-in and security only. This marketing website uses cookies from Google Analytics and HubSpot to count visits, see which pages are read, and learn which links or ads brought visitors here; if you send us a form, HubSpot connects it to the pages you viewed on this site. Vercel Web Analytics also counts page views, without cookies. The website also keeps the page you first landed on and any campaign or ad tags from the link you followed in your browser's own storage (the ad tags for up to 30 days), and sends them only with a form you submit. You can block or delete cookies and site storage in your browser settings, and this website still works without them. The mobile app does not use cookies.

10. Children

Dryline VMS is a business tool and is not directed to children under 13. We do not knowingly collect personal information from children.

11. Changes to this policy

We will post any changes here with a new effective date. For material changes we will also notify organization administrators by email or in the product.

12. Contact

  • Email: support@drylinevms.com
  • Mail: Cactus Wash Systems LLC, 29834 N Cave Creek Rd., Suite 118 - 1039, Cave Creek, AZ 85331

See also our Terms of Service and Support page.