Privacy Policy

We collect information you provide directly, including:

• Account information — name, email address and password hash when you create an account.
• Communications — messages and details you send through our contact page or support channels.
• Payment information — processed by our payment providers; we do not store full card numbers on our servers.

We also collect information automatically:

• Usage data — pages visited, scripts downloaded, features used, and interactions with the Service.
• Device & log data — IP address, browser type, operating system, referring URLs and timestamps.
• Cookies and local storage — see the Cookies section below.

We use the information we collect to:

• Create and manage your account, and authenticate you when you sign in.
• Provide, maintain and improve the Service, including downloads and the premium vault.
• Process one-time payments for premium templates.
• Respond to your questions, support requests and feedback.
• Send service updates, security alerts and (with your consent) product news.
• Monitor usage, diagnose issues and prevent abuse or fraud.
• Comply with legal obligations and enforce our Terms of Service.

If you are located in the European Economic Area, we process personal data based on the following legal grounds:

• Performance of a contract — providing the Service you requested.
• Legitimate interests — improving the Service, preventing fraud, and securing our platform.
• Consent — where we ask for it, such as marketing communications.
• Legal obligations — where required by law.

We use cookies and local storage to keep you signed in and remember preferences such as your theme. Specifically:

• Authentication cookies — required to keep you signed in. These are necessary for the Service to function.
• Preference storage — such as the light/dark theme you select and the “remember me” choice, stored in your browser’s local storage.
• Analytics — aggregated, privacy-respecting usage statistics to understand how the Service is used. When enabled, analytics run through Plausible or Umami (cookie-free, no personal data, no cross-site tracking), so no consent banner is required.

You can clear cookies and local storage through your browser settings. Doing so may sign you out and reset your preferences.

We do not sell your personal information. We share data only in these cases:

• Service providers — hosting, payment processing, email delivery and analytics vendors that process data on our behalf under contract.
• Legal compliance — when required by law, subpoena or court order, or to protect the rights, property and safety of Wholesaas, our users or the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, with notice to you where practicable.

We use industry-standard safeguards to protect your data: passwords are hashed with bcrypt, sessions use signed JWT tokens, and all traffic is encrypted in transit via TLS. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we work to protect your information and review our practices regularly.

We retain account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to retain records for legal, tax or auditing purposes. Usage analytics are retained in aggregated form.

Depending on your location, you may have the right to:

• Access, correct or update your personal information.
• Request deletion of your account and personal data.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at hello@wholesaas.dev. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We operate globally, which may involve transferring data to countries other than your own. When we transfer personal data from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

We may update this Privacy Policy from time to time. Material changes will be highlighted on this page and, where appropriate, notified by email. The “Last updated” date at the top reflects the most recent revision.

Privacy questions? Email hello@wholesaas.dev or use our contact page. Our data protection contact is the Wholesaas team, 1000 Market Street, Wilmington, DE 19801, United States.