Privacy Policy

1. Who we are

WholesaleIQ ("we", "us", "our") provides a business analytics platform designed for wholesalers and small businesses. Our service helps you understand your sales, costs, cash flow, and inventory in one place. By using WholesaleIQ you agree to this Privacy Policy.

2. Information we collect

• Account information — your name, email address, and a hashed (never plain-text) password when you register. If you sign in with Google, we receive your Google profile name, email, and profile photo.
• Business data you upload — sales orders, vendor transactions, customer invoices, payment records, receipts, and any other files you import into the platform. This data is used solely to power your analytics dashboard.
• Bank and financial account data (via Plaid) — if you choose to connect a bank or card account, we use Plaid Technologies, Inc. to access that data on your behalf. Plaid retrieves transaction history and balance information from your financial institution. We store only the data needed to display your analytics (transactions, balances, and the Plaid access token that authorises the connection). We do not sell or share this data. You can disconnect your bank at any time from the Connections page, which immediately revokes our access token with Plaid.
• Usage data — page views, feature interactions, and error logs used to improve the product. This data is not linked to individually identifiable records.

3. How we use your information

• To provide, operate, and improve the WholesaleIQ platform.
• To generate analytics, forecasts, and recommendations visible only to you.
• To send transactional emails (password resets, weekly digest if opted in).
• To detect and prevent fraud, abuse, or security incidents.
• To comply with legal obligations.

We do not sell your personal data or business data to third parties. We do not use your financial data for advertising purposes.

4. Plaid disclosure

WholesaleIQ uses Plaid Technologies, Inc. ("Plaid") to connect to your financial accounts. By connecting a bank or card account through WholesaleIQ, you agree to Plaid's End User Privacy Policy. Plaid acts as our data processor for the purpose of retrieving financial account data on your behalf.

We access your financial data in read-only mode. We never initiate payments or transfers on your behalf. You may revoke our access at any time by disconnecting the account in WholesaleIQ's Connections settings or through your bank's third-party app management page.

5. Payment processing (Stripe)

When you subscribe to a paid plan, your payment is processed by Stripe, Inc. ("Stripe"). Card numbers and other payment details are entered directly into Stripe's secure checkout and are never transmitted to or stored on WholesaleIQ's servers.

We receive and store only limited billing information from Stripe needed to manage your subscription — such as your Stripe customer ID, subscription status, plan, and billing history. This is used solely to grant access to paid features and to support you with billing questions.

Stripe's use of your payment information is governed by Stripe's own Privacy Policy.

6. Data storage and security

• All data is stored in a managed PostgreSQL database hosted on Replit's cloud infrastructure, which encrypts data at rest using AES-256.
• All data in transit between your browser and our servers is encrypted using TLS 1.2 or higher.
• Passwords are hashed using scrypt and are never stored in recoverable form.
• Access to production data is limited to authorised personnel only.

7. Data retention

We retain your data for as long as your account is active. You can permanently delete your account and all associated data at any time from the Settings page. Upon deletion, your data is removed from our database within 30 days, except where we are required by law to retain it longer.

WholesaleIQ uses Google (the Gemini API) to read the photos and PDF documents you send us or that arrive as attachments through a connected email account (supplier bills, customer invoices and payroll stubs, for example), to answer your questions in the copilot, to draft the messages, replies and posts you ask for, and for the app's other AI features, such as reading the layout of a file you import, plain-English recipe entry and product research. The audio of what you say is sent to Google to be turned into text, in the copilot's voice mode when it is available and when you dictate a post, and in voice mode the answers we read back to you are turned into speech there. We use only Google's paid service for all of this. Under that service's terms Google does not use what we send it to improve its products; it logs it for a limited period of time solely to detect and prevent violations of its Prohibited Use Policy, and it processes it as our data processor. Files you upload may be read by our AI providers, Google (Gemini) and Anthropic (Claude), to understand their layout; they are not used to train models. We keep the photos you send through photo capture, including from the copilot; we do not store the audio ourselves. In voice mode, the text of what you said is kept in your copilot history like any typed message.

8. Your rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — delete your account and all data via Settings, or contact us.
• Portability — export your business data at any time from the platform.
• Withdraw consent — disconnect any data integration (bank, Google, etc.) at any time.

9. Cookies and sessions

We use a single session cookie to keep you signed in. This cookie is HTTP-only, secure, and expires when you sign out or after a period of inactivity. We do not use advertising cookies or third-party tracking pixels.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify registered users by email.

11. Customers of businesses that use WholesaleIQ

Some businesses use WholesaleIQ to run a public page where their own customers can ask for something, book a time, or choose whether to hear about offers. For those customers' details, the business that runs the page is responsible. We store them for that business, and we do not sell them.

When someone sends a request on one of these pages, we keep the name, email address or phone number they gave, what they asked for, a booking time if they chose one, any note they wrote, which offer boxes they ticked, and when they sent it. If they came by a tagged link we keep the tag. For 30 days we also keep a scrambled code made from their network address, used only to stop abuse; the address itself is not kept. The request also adds the person to the business's customer list, and a business can add people to it by hand. We use these details to handle the request and to show it to the business that received it.

Offers are a separate choice. When a business has its request form switched on, the page shows an empty offers box for each channel that business can use: email, and WhatsApp once the business has linked a number. Nobody is signed up for offers unless they tick a box, and ticking one does not sign them up on the other.

A customer can stop offers at any time. On WhatsApp they reply STOP, and they can also ask the business directly. Any message about an order or a booking is not an offer, so stopping offers does not stop it.

A business can delete a customer from its customer list at any time, which removes the name, email address and phone number kept there. When it does, it is asked whether to delete that customer's requests and bookings as well. If it chooses not to, those requests and bookings keep the details given on them. A business can also delete one request or one booking at a time. A request with a payment noted on it is kept as part of the business's records of money.

If the customer had asked not to be messaged, one line is kept for each address they asked about: the address itself (the email address or phone number), which channel they stopped, and when. It holds no name. It stays so that the customer is not messaged again if the business adds them back.

We keep a customer's entry in the customer list until the business deletes it or closes its WholesaleIQ account. Requests and bookings are kept until the business deletes them or closes its account. When the account is closed, its customer details, requests, bookings and these lines are deleted with it, as described under Data retention.

To ask about a customer's details, contact the business first. You can also contact us at privacy@wholesaleiq.app.

12. Contact us

If you have questions about this Privacy Policy or want to exercise your data rights, please contact us at privacy@wholesaleiq.app.