This Privacy Policy explains how Wrapstart APP INC ("Wrapstart", "we", "our", or "us") collects, uses, and shares information when you or your business use the Wrapstart software platform, websites, mobile applications, and related services (collectively, the "Services"). Wrapstart is a shop-management platform built for vehicle wrap, paint protection film, ceramic coating, and detailing businesses.
Wrapstart APP INC is a Canadian corporation with its registered office at 1051 26th Street NE, Calgary, Alberta, Canada. You can reach our privacy team at support@wrapstart.com.
When you sign up for a Wrapstart account as a shop owner or operator, Wrapstart is the controller of your personal account information. When your shop uses Wrapstart to manage records about your own customers (leads, bookings, invoices, etc.), your shop is the controller of that customer data and Wrapstart is the processor acting on your instructions. This distinction matters under GDPR, PIPEDA, and CCPA/CPRA.
When you create a Wrapstart account we collect your name, email address, business name, business address, phone number, password (stored hashed), subscription plan, and billing status. Authentication is handled through Supabase Auth.
Wrapstart stores the business records you create inside the platform — customer contacts, leads, vehicles, quotes, invoices, bookings, calendar events, photos, documents, warranties, notes, messages, and similar records. You remain the owner of this content; Wrapstart processes it on your behalf to provide the Services.
When you send or receive SMS, email, voice calls, or review-request messages through Wrapstart, we store the message content, phone number / email address of the other party, timestamps, and delivery status so you can see the conversation history in your inbox. SMS is delivered via Twilio; email via Supabase + our email provider; voice calls via Bland.ai.
Wrapstart does not store full credit card numbers, CVV, or bank account numbers. Payments are processed by Stripe or Square (whichever your shop has connected). We store only the metadata those providers return to us — amount, currency, status, transaction ID, last-four digits of the card, brand, and payout destination. See Stripe's privacy policy and Square's privacy policy.
If you choose to connect a third-party account (Google Business Profile, Google Calendar, QuickBooks, Webflow, Zapier, etc.), we store the OAuth access and refresh tokens needed to call those APIs on your behalf, plus any configuration you choose. See Section 6 for specifics on Google user data.
We collect basic device and session information — IP address, browser type, operating system, timestamps of requests, pages viewed inside the app, and error logs — to operate the Services, prevent abuse, and debug issues. We do not use third-party advertising trackers.
We do not sell your personal information, and we do not share it with third-party advertisers.
Some Wrapstart features use artificial intelligence models (provided by Anthropic) to draft messages, extract data from uploaded documents, summarise calls, and generate suggestions. When you invoke these features, the relevant input (e.g. a customer message you want help replying to) is sent to the AI provider for processing. We do not allow AI providers to use your data to train their models. AI outputs may be inaccurate and should be reviewed before use.
We share information with third-party service providers ("sub-processors") who perform services on our behalf under confidentiality obligations. Current sub-processors include:
We may also disclose information when required by law, to protect the safety of users, or in connection with a merger, acquisition, or sale of assets (in which case continued handling of your information will be bound by this policy or an equivalent successor policy).
If you choose to connect your Google Business Profile to Wrapstart, we use Google OAuth to request the https://www.googleapis.com/auth/business.manage scope. Wrapstart's use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
OAuth refresh tokens and cached review data are stored in our Supabase database with per-user row-level isolation. You can disconnect your Google account at any time from Settings → Integrations; disconnecting deletes the tokens and marks cached review data for removal. Cached data is also removed when you delete your Wrapstart account.
Wrapstart shops send SMS messages to their own customers (and receive replies) using phone numbers provisioned through Twilio. Standard message and data rates may apply for the customer receiving the message. Customers can reply STOP to any Wrapstart-originated SMS to opt out; Wrapstart honours STOP requests automatically and suppresses future automated messages. Reply HELP for assistance. For the full Twilio messaging policy, see twilio.com/legal/messaging-policy.
Wrapstart uses first-party cookies and browser local storage to keep you signed in, remember interface preferences (theme, privacy mode, column settings), and prevent abuse. We do not use third-party advertising cookies. You can clear cookies at any time through your browser settings; doing so will sign you out.
Wrapstart's primary production data is hosted by Supabase in data centres located in the United States. If you are accessing the Services from Canada, the European Economic Area, the United Kingdom, or elsewhere outside the United States, your information will be transferred to and processed in the United States. We rely on standard contractual clauses and other safeguards where applicable.
Depending on where you live, you may have the right to:
California residents have additional rights under the CCPA/CPRA, including the right to know what personal information is collected and to opt out of "sharing" as defined by California law. Wrapstart does not "sell" personal information and does not "share" it for cross-context behavioural advertising.
To exercise any of these rights, email support@wrapstart.com from the email address on your account. We respond within 30 days (or as required by applicable law).
We retain account and business records for as long as your Wrapstart account is active. When you delete your account, we delete or de-identify your personal information within 90 days, except where we are required to retain it for legal, tax, or fraud-prevention purposes.
We protect information in transit with TLS encryption and at rest with database-level encryption. Access to production data is restricted to a small number of authorised Wrapstart personnel. No system is perfectly secure, however, and we cannot guarantee absolute security — if you believe your account has been compromised, contact support@wrapstart.com immediately.
Wrapstart is a business-to-business product intended for adults operating a vehicle services business. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, for significant changes, notify account administrators by email at least 14 days before the change takes effect.
Wrapstart APP INC
1051 26th Street NE
Calgary, Alberta, Canada
support@wrapstart.com