Privacy Policy

Listing data about businesses

Listings are compiled from publicly available sources, including a business's own website and public business listings. For each shop we store its business name, address, coordinates, phone number, website, email, opening hours, services offered, a public listing identifier and map link, and a star rating with review count. The rating renders as a number that links out to the public map listing.

We never store or show review text, reviewer names, or photos from those listings.

Some listing details, such as a business phone number or email at a sole proprietorship, can also be personal information. Because of that, a shop can ask to correct or remove its listing at any time. Every shop page has a "Report wrong info" form (reason, details, and a hashed IP address), and a shop can also take control of its listing through the claim flow described below.

Quote requests from visitors

Requesting a quote is the core purpose of the site: it sends your request and contact details to the shop or shops you selected. When you submit the quote form we collect your name, email, phone number (optional), vehicle, the service you asked about and that service's detail fields (for example coverage, material, finish), an optional message, and up to 6 optional photos of your vehicle. You also confirm an explicit consent checkbox, and we record the version of the consent text shown to you at the time. We create one lead record per shop your request goes to, all under one shared request ID.

There are two ways a request can be routed, and the consent checkbox states which one applies to your request. In broadcast mode, the request is sent to every shop shown at once. In cascade mode, the request is sent to the nearest shop first and, if that shop does not respond within an hour, it is handed off to up to 3 more nearby shops one at a time until one replies.

The lead email we send to a shop sets your email address as the Reply-To, so the shop can reply to you directly. After you submit, we give you a private tracking link that shows which shops received your request and the status for each. Anyone who has that link can see the page, so treat it as private.

If a shop later claims its listing, the quote requests already sent to that shop are converted into leads inside its WrapForce workspace, so it can respond to and manage them there.

Vehicle photos

Photos uploaded through the quote form are capped at 6 per request and 5 MB each, and must be JPEG, PNG or WebP, with the file's actual bytes checked against the type it claims to be. Photos are stored in a private Cloudflare R2 bucket, not a public one. They are not listed or indexed anywhere, and are reached only through a long, unguessable link included in the email sent to the shop or shops your request went to.

Location

The "Use my location" option uses your browser's geolocation only with your permission, and the coordinates are used solely to sort nearby shops by distance. They are not stored with a profile. Alternatively, you can type in a city or a US zip / Canadian postal code, which is looked up through the public api.zippopotam.us service and cached.

Anti-abuse

We never store IP addresses in raw form. They are one-way hashed with a secret salt and kept alongside quote requests and report submissions for abuse prevention, along with short-lived per-IP rate limit counters. Cloudflare Turnstile provides bot protection on quote and claim submissions.

Claiming a listing

A shop owner can verify ownership of a listing in one of three ways: an email sent to an address at the business's own website domain (an 8-digit code with a 15 minute expiry and 5 attempts), an SMS or automated voice call to the phone number already on the listing (shown masked, and it cannot be edited by the claimant), or a manual review where the claimant uploads a business licence or utility bill.

Documents uploaded for manual review are identity evidence and are stored in a private Cloudflare R2 bucket, never a public one.

Once verified, an owner gets a management link by email to upload a logo and banner and edit the shop's services and hours, and can continue on to create a free WrapForce account.

Email to shops

Shops receive quote request emails at the business email address published for the business. Every one of these emails carries a one-click unsubscribe, both as a link and as the RFC 8058 one-click header, and the physical mailing address. Unsubscribing stops the email permanently for that shop.

Volume is capped: a shop receives at most one immediate email per day, and anything further is bundled into a single later digest.

Cookies and analytics

The site sets no advertising cookies and runs no cross-site ad tracking, and we do not sell personal information. Web fonts are loaded from Google Fonts, so Google receives the request for those font files.

Who we share it with

We share information only with the service providers ("sub-processors") we rely on to run the site, each of which is bound to use it only for the services they provide to us:

• Supabase, database hosting.
• Cloudflare, hosting on Workers, R2 file storage, KV caching, and Turnstile bot protection.
• Resend, delivery of transactional email.
• Twilio, delivery of SMS and voice verification codes for claims.
• api.zippopotam.us, postal code lookup.

Data is processed primarily in North America. We may also disclose information if required by law, or to protect the rights, safety and security of Car Wrap Shops, WrapForce, our users, or the public. If the business is ever transferred to another owner, data would move with it under this same policy.

Your rights and choices

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and offer the same rights described below to people wherever they live: access, correction, deletion, a portable copy, and withdrawing consent.

• As a visitor, you can withdraw your consent or ask for your quote request to be deleted by emailing privacy@carwrapshops.com.
• As a shop, you can unsubscribe from lead email in one click from any email you receive.
• As a shop, you can ask to have your listing corrected or removed entirely by emailing privacy@carwrapshops.com or using the "Report wrong info" link on your listing page.

Once a request has been emailed to a shop, that shop holds its own copy of it and controls it, so if you want that copy deleted you should contact the shop directly. Once a shop claims its listing and its stored requests convert into leads inside a WrapForce workspace, the WrapForce Privacy Policy governs that workspace copy, and the shop controls it.

How long we keep it

Quote requests and their photos are kept so shops can respond to them, and so a shop can still receive its past requests if it later claims its listing. They are deleted on request. Hashed IP addresses and rate limit counters are kept only briefly for security. Unsubscribe records are kept permanently, because that is what makes an opt-out stick.

Children

Car Wrap Shops is not directed to children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy as the directory evolves. When we do, we will change the "last updated" date above. Continuing to use the site after an update means you accept the revised policy.

Contact

Questions or requests about this policy: privacy@carwrapshops.com. For questions about WrapForce, the app used by shops that claim their listing, see wrapforce.io/privacy.