How we handle your data.

Who This Policy Covers

• WrapAlly is a platform for vehicle- and cabinet-wrap installers and businesses ("Users"). This policy explains how we handle personal information for two groups.
• Users: the installers, business owners, and team members who create WrapAlly accounts and use the CRM, scheduling, invoicing, and Get Leads features.
• Homeowners and prospective customers ("Customers"): the individuals whose contact details, project information, and photos reach WrapAlly through lead-generation forms, the sample picker, the kitchen visualizer, or information a User enters. Customers do not have WrapAlly accounts, and much of their data is handled on behalf of the User or lead-generation partner who collected it.

Information We Collect From Users

• Account information: name, email address, phone number, profile photo, authentication status, organization membership, and organization role (provided via our authentication provider, Clerk).
• Organization data you enter into WrapAlly, including leads, customer contact details, tasks, schedules, templates, invoice content, activity history, uploaded files and photos, and related notes.
• Billing information for paid features: when you save a card for the Get Leads marketplace or enable customer payment collection, your card details are collected and stored by Stripe. WrapAlly stores only limited card metadata (brand, last four digits) and Stripe identifiers — never full card numbers.
• Integration data needed to connect services such as Gmail and DocuSign, including connection status, account identifiers, and encrypted access or refresh tokens.
• Technical and usage data needed to operate and improve the service, such as request logs, device and browser information, error logs, security events, and cookies or similar technologies used for authentication, analytics, and session replay.

Information We Collect About Homeowners and Prospective Customers

• When a homeowner submits a quote request, uses the sample picker, or uses the kitchen visualizer, we may collect their name, email address, phone number, address or ZIP code, project details (such as cabinet style, door count, and estimate range), photos of their kitchen or space, and the finishes or samples they select.
• We may also collect advertising and attribution identifiers when a homeowner arrives from an online ad, including advertising click identifiers, campaign parameters (UTM values), and cookie-based identifiers set by advertising platforms (for example, Meta/Facebook Pixel identifiers). See "Advertising and Conversion Measurement" below.
• This information is used to create and route the lead to an installer, to let the homeowner preview finishes, and to measure the performance of the advertising that generated the inquiry. Some lead information is collected through funnels operated by us or by our lead-generation partners and is shared with the installer who receives the lead.

AI Image Generation (Kitchen Visualizer)

• The kitchen visualizer and sample picker let a User or a homeowner upload a photo and generate an AI preview of how a finish would look. To create the preview, the uploaded photo and the selected finish are sent to a third-party AI provider for processing.
• The provider processes these images to return the generated preview under its applicable terms. Do not upload photos containing sensitive personal information you do not want processed by a third-party AI service.

How We Use Information

• To provide the WrapAlly CRM, task, template, invoice, scheduling, sample, visualizer, and lead-routing features.
• To create, route, and deliver leads to installers, and to bill installers for leads they receive through the Get Leads marketplace.
• To send emails, invoices, signature requests, and notifications when an authorized User takes that action or has opted in.
• To measure and improve advertising performance and to report conversions to advertising platforms.
• To maintain security, troubleshoot issues, prevent abuse, and improve product reliability.

Gmail Data and Google API Use

• WrapAlly requests Gmail send permission so you can send customer follow-up emails from your own connected Gmail account.
• WrapAlly does not read your Gmail inbox, search your mailbox, import contacts, delete messages, or manage labels.
• Email content is created from templates you control, previewed before sending, and sent only after you click the send action.
• Gmail access and refresh tokens are stored encrypted and are used only to send user-approved emails through Gmail.
• WrapAlly's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. (Note: the separate AI image-generation feature described above is a distinct third-party service used only to produce visual previews.)

DocuSign and Other Integrations

• If you connect DocuSign, WrapAlly uses the connection to create and send signature envelopes from invoice or document workflows you approve.
• Integration tokens are used only for the connected workflow and are not sold or used for advertising.
• You can disconnect supported integrations from your WrapAlly settings.

SMS / Text Message Notifications

• If you provide a mobile phone number and opt in, WrapAlly sends SMS text notifications alerting you when a new lead is delivered to your pipeline.
• We do not sell or share your mobile phone number or SMS opt-in consent with third parties or affiliates for their own marketing purposes. Mobile opt-in information is never shared.
• Message frequency varies based on your lead volume. Message and data rates may apply.
• You can opt out at any time by disabling lead text alerts in your Settings, or by replying STOP to any message. Reply HELP for assistance.

Advertising and Conversion Measurement

• We and our lead-generation partners use advertising cookies and identifiers to measure the performance of online ads and to report conversions back to advertising platforms such as Meta (Facebook) and Google.
• This may include storing advertising click identifiers, UTM campaign parameters, and cookie-based identifiers (such as Meta Pixel _fbc/_fbp values) alongside a lead, and later sending conversion signals to those platforms to measure which ads generated inquiries or completed jobs.
• Depending on your location, you may be able to control advertising cookies through your browser settings or the advertising platforms' own opt-out tools. Some of this activity may be considered "sharing" for cross-context behavioral advertising under certain state privacy laws — see "Your Privacy Rights" below.

Analytics and Session Recording

• WrapAlly uses Microsoft Clarity for product analytics and session replay (behavioral metrics, heatmaps, and recordings of page interactions) so we can understand usage and improve the service. Clarity is associated with your signed-in identity so we can diagnose issues on a per-account basis.
• Clarity is configured with text masking enabled, so on-screen text and form-input content are masked in recordings rather than captured. Session replay still records layout and interaction patterns.
• Usage data collected through Clarity is processed under Microsoft's privacy terms. For more information, see the Microsoft Privacy Statement at privacy.microsoft.com.

Cookies and Similar Technologies

• We use cookies and similar technologies for three purposes: strictly necessary cookies for authentication and security; analytics and session-replay technologies (Microsoft Clarity); and advertising/attribution identifiers set by us or advertising platforms.
• Strictly necessary cookies are required for the service to function. Analytics and advertising technologies are used to understand usage and measure advertising, as described above.
• You can control cookies through your browser settings. Where required by law, we will provide additional consent controls.

Service Providers and Data Sharing

• We share data with service providers ("processors") only as needed to operate WrapAlly. These include: Clerk (authentication); our application hosting and database provider; a cloud storage provider (file and photo storage); Resend (transactional email delivery); Stripe (payment processing and card storage); Google (Gmail sending for connected accounts); a third-party AI provider (image previews); Microsoft Clarity (analytics and session replay); a lead-routing/CRM provider (for certain funnels); Meta and Google (advertising and conversion measurement); a sample catalog and checkout provider; DocuSign (signature workflows); and our SMS delivery provider.
• When a lead is generated, the homeowner's contact and project information is shared with the installer who receives that lead, and — for certain funnels — forwarded to a connected CRM/lead-routing provider used by us or our partner.
• We do not sell your personal information for money. However, some sharing of advertising and analytics identifiers with the platforms above may be considered "sharing" or a "sale" for cross-context behavioral advertising under certain U.S. state privacy laws. See "Your Privacy Rights."
• We may disclose information if required by law, to protect rights and safety, or to investigate abuse of the service.

Security and Retention

• WrapAlly uses access controls, encrypted integration tokens, and hosted infrastructure safeguards to help protect data.
• No internet service can guarantee perfect security, but we work to keep access limited to authorized users and operational service providers.
• We retain data while your account or organization uses WrapAlly and as needed for the purposes described here, unless deleted or removed according to product functionality, support requests, or legal requirements. Lead and billing records may be retained as needed for accounting, dispute, and legal purposes.

Your Privacy Rights and Choices

• Users can update or remove many lead, template, task, and organization records inside WrapAlly, and can export their data using the "Download my data" option in Settings.
• You can disconnect Gmail or DocuSign from the Settings page, and opt out of SMS as described above.
• You can request access to, correction of, or deletion of your personal information by contacting us at contact@wrapally.com. Homeowners may also contact us to request access to or deletion of information we hold about them; where a lead was collected on behalf of an installer or partner, we may direct the request to them.
• Depending on your state or country, you may have additional rights (such as to access, delete, correct, or opt out of certain sharing of your personal information). To exercise these rights, contact us at contact@wrapally.com. We will respond as required by applicable law.

Children's Privacy

• WrapAlly is not directed to children under 18 and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to This Policy

• We may update this Privacy Policy from time to time. We will update the effective date above and, for material changes, provide notice by email or in-app notice.

Contact

For privacy questions or data requests, contact WrapAlly at contact@wrapally.com.