Privacy Policy

The product you deal with is WreckerSync. The legal entity and parent company (data controller) is Digital Stanza. Contact: hello@wreckersync.com. We serve auto-parts businesses, including in Australia, from an Indian company. Data may be processed in India, Australia, the United States, and other countries where our hosts operate (see section 8).

Enquiries and accounts

• Business name, contact name, email, phone, website URL, country
• Message content, products of interest, notes our staff add
• Portal login (email plus a hashed password if we issue one)

Billing

• Subscription amount, cycle, status, expiry, invoice numbers, payment-link IDs
• Which plugins a paid amount covers (snapshot on each invoice)
• Payment confirmation from Razorpay (not full card numbers — Razorpay holds those)

Licence heartbeat (WordPress plugins)

• Licence key, plugin slug, site URL, site title, admin email
• WordPress, PHP, and plugin versions
• Public IP of the server making the request, last check-in time

Support vault (only if you give it to us)

• Encrypted dashboard passwords and WordPress API secrets for support and to turn AI chat on or off
• Access is logged (who revealed a secret, when)

Website cookies

• Essential cookies for admin and portal login (session)
• Optional analytics or marketing cookies only if you accept the banner (public pages)

AI chat on your store

Messages between your website visitors and the chat widget are processed to answer them. We are a processor of that content for you. You are responsible for telling your visitors that a chat is in use. We do not sell chat transcripts. We may retain operational logs needed to run and secure the service.

We use information to:

• Respond to enquiries and quote maintenance (legitimate interests / steps to a contract)
• Issue licences, invoices, and payment links; collect fees (contract)
• Validate that a plugin is running on an authorised site (contract / legitimate interests)
• Turn AI chat on or off to match payment status (contract)
• Send renewal reminders and service notices (contract / legitimate interests)
• Detect abuse, fraud, and security incidents (legitimate interests / legal obligation)
• Comply with tax, accounting, and dispute records (legal obligation)

We do not use licence heartbeat or vault credentials for advertising. We do not sell personal information.

• Hosts: Vercel (application), Neon or equivalent Postgres (database), email delivery providers
• Payments: Razorpay — they process cards under their own policies
• AI providers: model APIs we use to generate chat replies (content of the conversation may be sent to them to produce an answer)
• Your WordPress site: we POST widget on/off to the endpoint and secret you configured
• Professional advisers or courts if required to defend a claim or by law

We do not share your Pinnacle or eBay credentials with advertisers. Third-party platforms you connect (Pinnacle, eBay, WooCommerce) have their own privacy policies.

• Enquiry and client records: for the life of the account plus at least seven years for invoices and tax
• Licence check-in history: while the licence exists and a reasonable period after
• Vault secrets: until you ask us to delete them or the account is closed, unless we must keep a record of access for security
• Chat operational logs: as needed to operate and debug, then deleted or aggregated

We use HTTPS, hashed portal passwords, encrypted vault fields, and access logging for secret reveal. No method is perfectly secure. You must use strong unique passwords for WordPress and dashboards and tell us promptly if a licence key or secret is leaked.

Depending on where you are (including Australia and, if applicable, GDPR regions), you may request access, correction, deletion, or a copy of personal information we hold, object to some processing, or complain to a regulator (OAIC in Australia; relevant Indian authority). Email hello@wreckersync.com. We may refuse requests that are unfounded, repeat, or would break a legal retention duty (for example invoice records). Business contact details on a live paid account are needed to perform the contract.

Data is stored on infrastructure that may be outside your country. By using the Service you accept that transfer. We take contractual and technical steps that are reasonable for a small B2B SaaS (TLS, access control, processor terms with hosts).

The Service is for businesses. We do not knowingly collect data from children. Chat on your store is your responsibility under your own privacy notice.

We may update this policy by posting a new version. The date at the top will change. Material changes may be emailed to the address on your client record.