Privacy policy

Which rules apply depends on whose data it is, so it is worth separating the two up front.

Shops that subscribe to WrapMe. We decide what is stored about your shop account, so we are the data controller for it.

People who build a wrap on a shop’s configurator. That enquiry belongs to the shop. We store and deliver it on the shop’s behalf, which makes us a processor and the shop the controller. If you built a wrap and want your details removed, contact the shop you sent it to — or contact us and we will pass it on.

When someone sends a build to a shop we store what they typed into the form — name, email address, phone number and any note — together with the build itself: the vehicle, the film SKUs per panel, any tint or underglow, a preview image of the render, a link that reopens the build, and which site it was submitted from.

For a subscribing shop we store the shop name, its address on our service, its plan, its branding (logo, name, website), the domains allowed to embed the configurator, an embed key, and a reference to whatever payment proved the subscription, along with its status and renewal date.

This is short because the system is genuinely narrow, and we would rather state it plainly than let a long policy imply otherwise.

• No cookies. WrapMe sets none at all — not for analytics, not for advertising, not for sessions.
• No analytics or tracking. There is no Google Analytics, no tag manager, no advertising pixel and no session recorder anywhere on the site or in the embed.
• No IP addresses or device fingerprints are written to our database with an enquiry.
• No cross-site tracking, and we never sell, rent or share personal information for advertising.

The only thing stored in your browser is a short-lived entry called wrapDesign, which holds the build you are working on so it survives moving between pages. It lives in session storage, never leaves your browser, and is discarded when you close the tab.

Loading any web page reveals your IP address to whoever serves it. Three third parties are involved in serving WrapMe, and we list them because that disclosure is the honest version:

• Vercel hosts the site and serves every page.
• Supabase hosts the database where shop accounts and enquiries are stored.
• Google serves our two webfonts and a small decoder file the 3D engine needs to open compressed vehicle models. One demo vehicle is also loaded from threejs.org.

None of these receive the contents of an enquiry except Supabase, which stores it for us.

Enquiries are kept for as long as the shop they belong to has an account, because they are that shop’s customer records. A shop can ask us to delete any enquiry, or all of them, at any time.

If a shop stops subscribing we keep its configuration and saved builds rather than deleting them, so the setup is still there if it comes back. A shop that wants everything erased instead can ask, and we will.

Depending on where you live — including under the UK and EU GDPR and under California law — you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. We do not charge for this and we do not treat you differently for asking.

Email privacy@wrapme.app. If your request is about an enquiry you sent to a shop, tell us which shop so we can route it to them, since the record is theirs.

Everything is served over HTTPS. Database access uses row-level security, and the key that bypasses it is held only on the server and never reaches a browser. Embed keys are scoped to the domains a shop nominates, so a key lifted from one site will not work on another.

No system is perfectly secure, and we would rather say that than imply otherwise. If you find a problem, email security@wrapme.app and we will respond.

If what we collect changes, this page changes with it and the date at the top moves. We will not quietly broaden what we gather and leave the wording as it was.

privacy@wrapme.app for anything on this page, or hello@wrapme.app for everything else.