Your data, plainly.

WrapKu handles personal information in two main ways. When WrapKu decides how information is used—such as account information, website analytics, support messages, and information about our relationship with a shop—WrapKu acts as the controller or business responsible for that information. When a shop enters information about its customers, employees, contractors, jobs, or vehicles, the shop generally determines why and how that information is used; in that situation, the shop acts as the controller or business, and WrapKu acts as its processor or service provider. If you are a customer of a shop that uses WrapKu, that shop’s privacy policy and practices also apply to the information it collects about you.

Website and waitlist information. When you use wrapku.com or join the beta waitlist, we may collect your email address, information you provide about your shop, role, or business needs, and information submitted through forms or communications. Account and workspace information. Name, email address, shop or business name, role and workspace permissions, account identifiers and authentication information, profile settings and preferences, and information about workspace invitations and authorized users. Shop, customer, and job data. Shop and employee information; customer names, email addresses, phone numbers, and other contact details; vehicle information; job descriptions, measurements, notes, schedules, and status; quotes, estimates, invoices, deposits, and payment records; photos, artwork, documents, and other uploaded files; and messages and communications associated with a job. Some of this may be personal information about a shop’s customers, employees, contractors, or other individuals. Payment and transaction information. When a shop connects Stripe or accepts a payment, we may receive limited information from Stripe, including connected Stripe account identifiers and status; transaction amount and currency; invoice or payment status; payment date and time; payment-method type; card brand and last four digits, when provided by Stripe; Stripe customer, payment, refund, payout, and dispute identifiers; refund, chargeback, dispute, and payout status; and fraud, risk, restriction, or account-status information made available to the platform. Stripe collects and processes full payment-card information directly. WrapKu does not receive or store full card numbers or card security codes. Usage, device, and diagnostic information. IP address; approximate location derived from IP address; browser and device type; operating system; pages, screens, features, and buttons used; login, session, and activity timestamps; referring pages or links; error reports, crash data, performance data, and technical logs; and security and fraud-prevention events. Communications. Information you provide when you contact support, send us an email, participate in beta feedback, report a problem, complete a survey, or submit suggestions or feature requests.

We collect personal information directly from you; from a shop, workspace administrator, or authorized user; automatically from your browser or device; from Stripe when payment features are used; from service providers that help us operate, secure, and analyze the Service; and from public or business sources where permitted by law.

We use information to: provide, operate, maintain, and support the Service; create, authenticate, and secure accounts; manage workspaces and permissions; process and display shop, customer, vehicle, and job information; enable Stripe-connected payment features; display transaction, refund, payout, chargeback, and dispute status; communicate about the Service, support requests, updates, security notices, and beta feedback; diagnose errors and improve performance; develop and improve features; understand how the website and application are used; prevent fraud, abuse, unauthorized access, and security incidents; enforce our agreements; comply with law and respond to valid legal requests; and protect the rights, safety, and property of WrapKu, our users, and others.

When we process customer personal information on behalf of a shop, we use it according to the shop’s instructions, our Terms, and our Data Processing Addendum. We may use aggregated or deidentified information that cannot reasonably identify a person or business to analyze, secure, and improve the Service.

When a shop enters personal information about its customers, employees, contractors, or other individuals, WrapKu processes that information on the shop’s behalf. The shop is responsible for providing any required privacy notice, having a lawful reason to collect and use the information, obtaining any required consent, deciding how long the information should be kept, responding to privacy requests from its customers, and ensuring that its instructions to WrapKu comply with applicable law. WrapKu will reasonably assist shops with applicable privacy requests and data-protection obligations as described in our Data Processing Addendum.

If you are a customer of a shop and want to access, correct, or delete information the shop entered about you, contact the shop first. If the shop sends us an appropriate request, we will assist it as required by our agreement and applicable law.

We do not share personal information except as described below. With authorized workspace users. Information submitted to a workspace may be visible to its owner, administrators, employees, contractors, or other authorized users according to the workspace’s permissions. Service providers. We use service providers and other third parties to operate the Service. Depending on the activity, a provider may act as our subprocessor, a shop’s processor, or an independent controller. Current providers include:

• Vercel — application hosting and delivery.
• Neon — database infrastructure and storage.
• Cloudflare — website delivery, network security, and related services.
• Resend — transactional and notification email delivery.
• PostHog — product and website analytics.

We may update our providers as the Service changes. Legal, safety, and enforcement disclosures. We may disclose information when we reasonably believe it is necessary to comply with applicable law, court orders, subpoenas, or valid government requests; enforce our agreements; investigate fraud, abuse, security incidents, or unlawful activity; or protect the rights, property, safety, or security of WrapKu, our users, or others. Professional advisors. We may share information with attorneys, accountants, insurers, auditors, and other professional advisors where reasonably necessary and subject to appropriate confidentiality obligations. Business transactions. We may disclose or transfer information in connection with a proposed or completed financing, merger, acquisition, reorganization, bankruptcy, sale of assets, change of control, or similar transaction. Where required, we will provide notice or require the recipient to continue protecting the information.

Stripe provides payment-processing and connected-account services. When a payment is made, payment information is submitted directly to Stripe; Stripe processes information under its own agreements and Privacy Policy; Stripe may act as an independent controller for certain legal, regulatory, fraud-prevention, identity-verification, and financial-services purposes; Stripe may also process information for a shop to complete transactions; and WrapKu receives limited account and transaction information necessary to provide the payment features. Payment information may also be shared with banks, card networks, payment-method providers, fraud-prevention providers, and other entities involved in completing or reviewing a transaction. The shop receiving the payment also receives information concerning its customer and transaction.

We use cookies and similar technologies to keep users signed in, maintain security, remember preferences, understand website and product usage, and diagnose problems and improve performance. PostHog may collect information about how users interact with the Service. You can control cookies through your browser settings; blocking necessary cookies may prevent parts of the Service from working. We do not currently use personal information for cross-context behavioral advertising through the Service.

WrapKu does not sell personal information for money. We also do not currently sell or share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws. If our practices change, we will update this Policy and provide any notices or opt-out methods required by applicable law before the new practice begins.

We keep information for as long as reasonably necessary to provide the Service, maintain an active account or workspace, complete transactions and maintain related records, provide support, secure the Service, comply with legal, tax, accounting, and regulatory obligations, and resolve disputes and enforce agreements. The retention period depends on the type of information, why it was collected, legal requirements, and the instructions of the shop that provided it. When an account closes or a shop requests deletion, we may delete or deidentify information from active systems after a reasonable period, subject to technical limitations and legal obligations. Deleted information may remain temporarily in encrypted or restricted backups until those backups are overwritten through our normal backup process. Stripe independently determines how long it keeps information under its own legal obligations, agreements, and privacy practices.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information based on the nature and risk of the information. These may include access controls and workspace permissions, authentication measures, encryption in transit, restricted administrative access, monitoring, logging, and security protections, and provider and infrastructure security controls. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we discover a security incident affecting personal information, we will investigate and provide legally required notices; when we process information for a shop, we will also notify and assist the shop as required by our Data Processing Addendum and applicable law.

You may access and update certain account information through the Service. You may also email [email protected] to request that we confirm whether we process personal information about you, provide access to personal information we control about you, correct inaccurate personal information, delete personal information, or provide a portable copy of certain personal information.

Depending on where you live and subject to applicable exceptions, you may have some or all of these rights, as well as rights to opt out of the sale or sharing of personal information, opt out of targeted advertising, opt out of certain profiling, limit or withdraw consent for certain sensitive information, appeal a decision concerning a privacy request, and use an authorized agent to submit a request. WrapKu does not currently sell personal information or use it for cross-context behavioral advertising.

We may need to verify your identity or authority before completing a request. A request may also be limited or denied where permitted by law, such as when information must be retained for security, fraud prevention, legal compliance, transaction records, or the rights of another person. We will respond within the period required by applicable law. If we deny a request and applicable law gives you a right to appeal, you may email [email protected] with the subject line “Privacy Appeal”; include enough information for us to identify the original request and review the decision. We will not unlawfully discriminate against you for exercising an applicable privacy right.

If your request concerns information entered or controlled by a shop using WrapKu, submit your request directly to that shop. We may forward your request to the shop or tell you how to contact it, and we will assist the shop as required by applicable law and our agreement with the shop.

The Service is intended for businesses and business users who are at least 18 years old and is not directed to children. We do not knowingly allow children to create WrapKu accounts or knowingly collect personal information directly from children through account registration. A shop may upload job information or photos that incidentally contain information about a minor; the shop is responsible for having the legal authority to submit and use that information. If you believe personal information was collected directly from a child without appropriate authorization, contact [email protected].

WrapKu is based in the United States. We and our service providers may process information in the United States and in other locations where those providers operate. Privacy and data-protection laws in those locations may differ from the laws where you live. Where required by applicable law, we will use appropriate measures for cross-border data transfers.

We may update this Privacy Policy as the Service, providers, or legal requirements change. We will update the effective or “last updated” date when changes are made. For material changes, we will provide reasonable notice through the Service, by email, or through another reasonable method.

Questions, concerns, and privacy requests may be sent to WrapKu LLC at [email protected].