Privacy Policy

We collect the following categories of information, which may include personally identifiable information ("PII"):

• Account information: name, email address, password (hashed), company/organization name.
• Billing information: billing name, billing address, and payment details processed through PayRight, our payment processing brand, which is powered by a third-party PCI-DSS compliant payment processing partner. (See Section 7 on payment data.)
• Usage data: how you interact with the Service — features used, actions taken, timestamps, session data, log files, device/browser type, and IP address.
• Communications: information you provide when you contact support or otherwise communicate with us.
• Consent records: a record of your agreement to our Terms of Service, Refund Policy, and this Privacy Policy, including the date/time, IP address, and version of the document you agreed to (see Section 10).

In addition to the account-level information above, we collect operational data entered into the Service in the course of doing business — for example, services performed, vehicle records, and film/material data logged by shops using the platform. This data is collected across all shops and end customers on the platform, and is used and, where applicable, shared in de-identified form:

• Shop-level data: which services are offered, service volumes, vehicle types serviced, and film/material types and quantities used, collected across all shops using the Service. We use this in aggregate — for example, to build industry benchmarks, improve product features, or generate platform-wide analytics — without identifying which specific shop the data came from, unless a shop separately requests or consents to shop-identified reporting.
• End-customer-level data:vehicle and service details relating to a shop's own customers (e.g., vehicle make/model, service or film applied, service dates) entered into the Service by a shop. This data is used to help operate the Service for that shop and, in aggregate, to inform platform-wide insights and improvements — without identifying the individual end customer (e.g., without name, contact information, or other details that would identify a specific person).

We do not tie this operational/industry data back to a shop's identity or an end customer's personal identity when using it for analytics, benchmarking, product improvement, or any external release. It is handled separately from the identifiable account and billing information described in Section 1, which remains necessary to operate individual shop accounts.

A note on end-customer data:When a shop enters information about its own customers into the Service, that shop is the party responsible for determining why that information is collected and for providing any required notices or obtaining any required consent from its customers — we act on the shop's behalf to store and process that information as part of providing the Service (a role sometimes called a "service provider" or "processor" under privacy laws such as the CCPA). Shops using the Service are responsible for their own compliance with applicable privacy laws with respect to their customers' data.

We use the information we collect, internally, to:

• Provide, operate, and maintain the Service, including authenticating your account and processing your subscription;
• Process billing and manage your subscription;
• Communicate with you about your account, updates, security notices, and — where you've consented — product updates;
• Monitor, analyze, and improve the performance, security, and functionality of the Service;
• Build aggregate, de-identified industry and platform insights from the operational data described in Section 2;
• Detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service;
• Comply with legal obligations and enforce our agreements.

Internally, account-level data (Section 1) is tied to your identity (account, email, usage history, etc.) so that we can operate and support your account. Access to identifiable data internally is limited to personnel and systems that need it to perform the functions above.

We do not sell your personal information. We disclose information in the following circumstances:

• Service providers: We share information with vendors who perform services on our behalf (e.g., cloud hosting, email delivery, analytics, customer support tools), under contractual obligations to protect your data and use it only for the purposes we specify. This includes our texting/calling integrations, Quo and RingCentral, which receive the phone numbers and message content necessary to send texts or calls initiated through the Service (by you or your customers, as applicable).
• Legal requirements: We may disclose information if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Wrap Right, our users, or the public.
• Business transfers: If Wrap Right is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy (or a materially similar policy).
• Aggregated / de-identified data: Where we publish, release, or share data externally — for example, product analytics, industry benchmarks, or research drawn from the shop- and end-customer-level operational data described in Section 2 — that data is aggregated and/or de-identified so that it cannot reasonably be used to identify a specific shop or end customer. Any external release of data does not include personally identifiable information.

We use cookies and similar technologies to keep you logged in, remember preferences, and understand how the Service is used (analytics). You can control cookies through your browser settings; disabling some cookies may affect Service functionality.

We retain personal information for as long as your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Consent records (Section 10) are retained for as long as necessary to demonstrate agreement to our terms, including after account closure, as evidence of contract formation. De-identified operational/industry data (Section 2) may be retained and used indefinitely, since it is not tied to an identifiable shop or individual.

Billing is handled through PayRight, our payment processing brand. PayRight is powered by a third-party payment processing partner, which is responsible for handling and securing your payment card details in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). We retain the billing and transaction records necessary to operate your subscription (e.g., billing history, last-four card digits, transaction status, and payment status), but full card numbers and sensitive authentication data are collected, processed, and stored by our processing partner, not directly by us. We do not share your full payment credentials with any party other than this processing partner.

We use administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, or destruction. No system is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have rights to:

• Access, correct, or delete the personal information we hold about you;
• Object to or restrict certain processing;
• Request a copy of your data in a portable format;
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at wraprightapp@gmail.com. We will respond within a reasonable time and in accordance with applicable law. Note that deleting certain data may require us to close your account, and we may retain limited records (e.g., consent and billing records) as required by law or for legitimate business purposes such as dispute resolution. Because the operational/industry data described in Section 2 is de-identified before use in aggregate analytics, it may not be linkable back to a specific shop or end customer to fulfill an individual deletion request once aggregated.

When you click "I Agree" (or similar) to accept our Terms of Service, Refund Policy, or this Privacy Policy, we create and retain a timestamped record of that acceptance, including the account/user identifier, IP address, the specific version of the document you agreed to, and the method of acceptance. This record serves as evidence of your agreement and is retained as part of our business records.

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If we learn we have collected information from a child under 18, we will delete it.

Wrap Right is based in the United States, and information we collect is processed and stored in the United States. If you access the Service from outside the U.S., you consent to your information being transferred to and processed in the U.S., which may have different data protection laws than your jurisdiction.

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date, and, where required, we will provide additional notice (e.g., email or in-app notice) and/or request renewed consent.

Questions or requests regarding this Privacy Policy: wraprightapp@gmail.com