Privacy Policy

WrapDesk provides operating software for vehicle wrap, PPF, tint, ceramic coating, detailing, and related automotive shops. This policy applies to shop owners, staff, installers, customers whose information is added to a shop workspace, people who receive shop or installer outreach, public website visitors, and people who contact us for support or a demo.

Shops using WrapDesk are responsible for the customer and staff information they enter or connect to their workspace. For many customer CRM records, WrapDesk acts as a service provider to the shop and processes that information so the shop can run its workflow.

The information we collect depends on how you use WrapDesk and which integrations are connected. It can include:

• Account and profile details, including name, email, phone number, WhatsApp number, role, login details, and authentication session data.
• Shop details, including business name, subdomain, address, suburb, city, state, postcode, bay count, service catalogue, calendar connection status, subscription status, and payment setup status.
• Installer details, including display name, location, service radius, daily rate, bio, experience, skills, vehicle experience, availability, preferred contact method, profile image, portfolio content, verification status, ratings, and Stripe onboarding status.
• Customer and lead details entered by shops, customers, or integrations, including name, phone, email, source, messages, internal notes, tags, quote history, booking details, review requests, payment status, and contact preferences.
• Vehicle and job records, including vehicle year, make, model, colour, condition, requested services, materials, dates, rates, job notes, proof requirements, issue reports, completion notes, film usage, and job timeline events.
• Photos, files, and uploaded content, including customer vehicle photos, job proof photos, portfolio files, profile images, PDFs, file names, content types, file hashes, quality warnings, and public or signed storage URLs.
• Messages and call records, including SMS, email, WhatsApp, Meta/Facebook/Instagram, phone call metadata, call recordings, transcripts, summaries, queued messages, delivery status, opt-out records, and provider message IDs.
• Integration and payment records, including Stripe customer, subscription, checkout, payment-intent, charge, balance-transaction, connected-account, transfer, refund, dispute, onboarding, requirement, payout, fee, reserve-liability, payout-reconfirmation, completion-release, and immutable payment-event metadata; Google Calendar OAuth tokens and event IDs; Meta page/account IDs and access tokens; Twilio/Resend setup details; and encrypted integration secrets.
• Mobile app data, including access tokens presented to the API, push notification tokens, platform, app version, device model, availability updates, request responses, counter-offers, proof uploads, account deletion requests, and optional latitude/longitude supplied with job status updates.
• Website and support data, including demo requests, signup source, contact forms, analytics events on public marketing pages, click information, page path, approximate device/browser information, logs, diagnostics, and security events.

Some information is provided directly by you. Some is provided by a shop, installer, customer, payment provider, messaging provider, calendar provider, mobile device, browser, or webhook from a connected service.

We use personal information where reasonably necessary to provide and improve WrapDesk, including to:

• Create and authenticate accounts, manage roles, maintain sessions, and keep the app secure.
• Run shop CRM workflows, including enquiries, lead queues, customer records, quotes, bookings, deposits, jobs, review requests, follow-ups, and staff notifications.
• Match shops and installers, send job requests, handle installer responses and counter-offers, manage availability, confirm assignments, and record completion evidence.
• Send operational messages through email, SMS, WhatsApp, Meta channels, push notifications, and calendar invitations.
• Connect third-party services requested by shops, including Google Calendar, Stripe, Twilio, Resend, Meta/Facebook/Instagram, WhatsApp, and Firebase Cloud Messaging.
• Process payments, subscriptions, deposits, connected accounts, payouts, refunds, disputes, fees, and related accounting or compliance records.
• Generate or refresh AI summaries, call transcripts, action items, lead intent signals, lead prefill suggestions, shop dashboard summaries, and default vehicle images where those features are enabled.
• Provide support, investigate errors, prevent abuse, enforce opt-outs, verify webhooks, comply with legal obligations, and improve product reliability and usability.

We may also use aggregated or de-identified information to understand product usage, improve workflows, and report business metrics, provided that the information no longer reasonably identifies an individual.

We share information with the people and organisations needed to run the requested workflow. For example, a shop can see customer, lead, quote, booking, job, message, and payment records in its workspace; an assigned installer can see job details needed to complete the work; and a customer may receive booking, quote, deposit, or follow-up messages from the shop.

We also use service providers and connected platforms, including:

• Vercel for application hosting, serverless processing, delivery, and related platform logs.
• Supabase for authentication, database, file storage, and related infrastructure services.
• Stripe for subscriptions, booking deposits, checkout, connected accounts, onboarding, payment metadata, payouts, refunds, disputes, and compliance checks.
• Twilio for SMS, sender IDs, phone numbers, voice calls, call routing, recordings, delivery status, and inbound message webhooks.
• Resend for transactional and operational email delivery and delivery event webhooks.
• Google services for Google sign-in where used, Google Calendar OAuth, calendar event creation, calendar invites, Google Analytics on public marketing pages, and Firebase Cloud Messaging for push notifications.
• Meta services, including Facebook, Instagram, and WhatsApp Business, when a shop connects or uses those messaging channels.
• OpenAI when AI transcription, summarisation, intent classification, prefill, or vehicle image generation features are enabled.
• Professional advisers, authorities, courts, regulators, payment networks, fraud-prevention parties, or business-transfer recipients where reasonably necessary.

We do not knowingly sell customer CRM, installer, or job data. Public marketing analytics may involve Google processing analytics identifiers and website interaction data under Google's services.

WrapDesk sends operational communications such as login links, invitations, job requests, booking confirmations, reminders, quote follow-ups, payment notices, review requests, staff notifications, and support messages. These may be sent by email, SMS, push notification, WhatsApp, Facebook, Instagram, or other connected channels depending on the shop setup.

SMS opt-outs such as STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT are recorded where supported. START or UNSTOP can re-enable SMS where supported. For email, messaging, or other opt-outs, contact the shop that sent the message or email support@wrapdesk.app.

Shops are responsible for ensuring their own outbound campaigns, call recording notices, customer consents, sender IDs, and contact practices comply with applicable law and platform rules.

WrapDesk can use AI-assisted features to make operational work easier. These features may transcribe call recordings, summarise calls, summarise leads or shop queues, identify likely customer intent, suggest prefilled vehicle or service details, generate action items, and create default vehicle images from vehicle make, model, year, and colour.

AI outputs are intended as workflow aids for shop staff and installers. They may be incomplete or incorrect and should be reviewed by a human before being used with customers, payments, bookings, or job decisions. We do not use these AI features to make legal or financial eligibility decisions about people.

When Google user data is obtained through Google APIs, WrapDesk uses it only to provide the connected Google feature, such as calendar connection and event creation. We do not use Google Calendar data to train general AI models.

Job files and portfolio files can include photos, PDFs, file names, timestamps, file hashes, and other metadata. Some job and portfolio files are stored with public URLs so they can be displayed in the app, booking flows, emails, or approved portfolio pages. Do not upload private, sensitive, or unrelated files unless they are needed for the workflow.

Installer portfolio projects can include uploaded photos, vehicle details, work descriptions, shop attribution settings, and approval status. Published or approved portfolio content may be shown to shops or used in installer outreach. Content can be reported at support@wrapdesk.app.

Call recordings are stored separately from ordinary job files and are made available through signed links for a limited time when authorised shop users request playback. Recordings may also be transcribed and summarised if call processing is enabled.

If you use WrapDesk directly, you can ask us to help with the following privacy choices. If your information was added by a shop, we may need to work with that shop to respond.

• Ask for access to personal information we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete information where deletion is available and not inconsistent with operational, legal, tax, security, fraud-prevention, or dispute requirements.
• Opt out of marketing or non-essential communications, and use SMS STOP or equivalent provider controls where available.
• Ask us to review a privacy concern or complaint. If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.
• If you are outside Australia, you may also have local privacy rights, such as rights to access, deletion, portability, objection, restriction, or complaint to a local regulator.

Installer app users can request account deletion from the mobile app. Deletion removes or disconnects account access, mobile profile data, push devices, and known mobile-owned storage objects where WrapDesk is able to do so. Some operational records, such as job history, payment records, logs, dispute records, or records needed by a shop, may be retained where required or reasonably necessary.

You can revoke connected Google access through your Google account settings, and shops can disconnect or disable integrations in their WrapDesk settings where supported. You can also use browser controls to limit cookies or analytics on public website pages.

We keep personal information while it is needed to provide WrapDesk, support customers, maintain accurate business and payment records, meet legal or tax obligations, resolve disputes, prevent fraud or abuse, enforce agreements, and maintain security. Retention periods vary by record type and connected provider.

We use reasonable administrative, technical, and organisational safeguards. Integration secrets are encrypted before storage where the app supports tenant credentials. No online service can guarantee complete security, so users should avoid adding information that is not needed for the workflow.

WrapDesk and its providers may process information in Australia, Japan, the United States, and other countries where our hosting, storage, payment, messaging, analytics, AI, and support providers operate. Where required, we take reasonable steps to protect personal information disclosed to overseas recipients.

WrapDesk requires legality review, challenges requests that appear unlawful or overbroad where legally permitted, limits any disclosure to the minimum information legally required, and maintains restricted documentation of each request, response, legal reasoning, and decision-maker.

The full process is described in the WrapDesk Government Requests Policy.

WrapDesk is designed for businesses, installers, staff, and customers managing automotive services. It is not directed to children, and we do not knowingly collect personal information from children.

For privacy questions, access or correction requests, account deletion help, opt-out help, complaints, or content reports, contact support@wrapdesk.app.

You can also review the WrapDesk Terms and Conditions and Government Requests Policy.