Privacy Policy

Effective October 4, 2026. Wunshop is a suite of business software services operated by Four Brooks LLC, Texas, USA (“we,” “us”). This policy explains what personal information we collect through our websites, apps and services (the “Services”), why, who we share it with, and the choices you have. It is part of our Terms of Service; capitalized terms not defined here have the meaning given there.

1. Two roles

• Businesses that use Wunshop (“Customers”) and their staff. For their account, billing and our own websites, we decide how information is handled, and this policy covers it.
• Their customers (“End Customers”). When someone orders from or pays a business that uses Wunshop, that information is the business's. We hold and process it on the business's behalf, as its service provider, under its instructions and our Terms. The business's own privacy notice describes its practices. If you ordered from a shop and want your details changed or removed, ask the shop; we will help them do it.

2. What we collect

• Account and business: names, email, phone, role, business name, address, tax and settings, and passwords (stored hashed, never in plain text).
• Business records: items, prices, menus, orders, discounts, payments, expenses, receipts, bookkeeping entries and reports entered into or produced by the Services.
• End Customer orders: the name, phone or email given when ordering, what was ordered, notes, pickup or delivery details, consents given, and order status.
• Connected services: where a business connects a payment, bank or messaging account, the account identifiers, status and transaction records those services return.
• Billing: what you are charged and paid, through our payment processor.
• Acceptance of these terms: when a business joins, the name and title of the person accepting for it, the business's legal name, what they agreed to and which version, and the time, IP address and browser — the record of our agreement with that business.
• Communications: what you send us, such as support requests and feedback.
• Technical: IP address, device and browser type, pages and actions, timestamps and error logs, kept for security, debugging and reliability.

We never see card numbers. Card details go straight from the payer to the payment processor; they do not pass through or rest on our servers.

3. How we use it

• To provide, operate, maintain and support the Services, including on a business's behalf.
• To secure the Services, prevent fraud and abuse, and enforce our Terms.
• To bill and collect fees.
• To communicate with Customers about their account, the Services, changes and, unless they opt out, our products. Service and legal notices cannot be opted out of while an account is open.
• To meet legal, tax and accounting obligations and respond to lawful requests.
• To improve and develop the Services, including by creating aggregated or de-identified data that no longer identifies anyone, which we may use for any lawful purpose.

Where a law such as the GDPR applies, we rely on performing our contract, our legal obligations, and our legitimate interest in running, securing and improving the Services.

Text messages

Where a business turns them on, we send SMS about orders on that business's behalf.

• Today we send order messages only — order confirmed, order ready, order changed. A phone number given at checkout is used for that order and nothing else.
• Consent is collected where the number is entered, with the purpose stated beside the field.
• If a business later offers promotional messages, those need their own separate opt-in and are never sent on the strength of an order alone. Replying STOP stops every message from that business's number, order messages included; texting START turns order messages back on.
• Message and data rates may apply. Frequency depends on order activity.
• Reply STOP to stop messages from that shop, or HELP for help.
• Phone numbers collected for order messages are never sold, rented, or shared with anyone for their own marketing.

4. Cookies

We use a small number of strictly necessary cookies and browser storage: to keep you signed in, to remember a cart before checkout, and to keep the Services secure. We do not use advertising cookies, and we do not track people across other websites. Our sites do not respond to “Do Not Track” signals because they do not track in that way.

5. Who else sees it

Only those who need it to run the Services, and only what each needs:

• Payment processing — currently Stripe, to take payments and pay businesses. Stripe's use is governed by the Stripe Privacy Policy.
• Bank connections — currently Plaid, where a business chooses to connect a bank account. By connecting, you acknowledge that Plaid collects and processes your bank data under the Plaid End User Privacy Policy.
• Messaging — currently Twilio and telecommunications carriers, to deliver texts.
• Hosting, storage, network and email — currently including Cloudflare, to serve the Services, store uploads and protect against attacks.
• The business you ordered from — End Customer details go to that business, and only that business.
• Professional advisers — lawyers, accountants and auditors, under confidentiality.
• Authorities and others — where the law requires it, or to protect the rights, property or safety of us, our users or the public.
• A successor — if Wunshop or Four Brooks LLC is merged, acquired, reorganized or sold, information may transfer as part of it, subject to this policy.

Each business sees only its own data; businesses cannot see each other's customers, orders or records. We do not sell or rent personal information, and we do not “share” it for cross-context behavioral advertising. We do not share it with advertisers or data brokers, we do not use business records or End Customers' details to train anyone's AI models, and we do not use End Customers' details for our own marketing. Companies that only run parts of the Services for us, such as hosting, storage and email, may use what they receive only to do that work for us. Stripe, Plaid, Twilio and the carriers are independent companies: they handle what they receive under their own terms and privacy policies, which we do not control, and we are not responsible for how they use it.

6. How long we keep it

• Accounting and tax records: seven years, because tax law requires records to be retained and reproducible.
• Order records: for as long as the business keeps its account, as part of its books, then as above.
• Consent records for messages: as long as the law and carriers require proof.
• Technical logs: a short period, typically weeks, then deleted.
• Closed accounts: 30 days in which the account can be restored or exported, then deletion of everything not covered above. Backups roll off on their own schedule.

7. Security

Data is encrypted in transit, secrets are encrypted at rest, passwords are hashed, access is limited to what an account is entitled to, and each business's data is separated at the database level so one business cannot read another's. Uploaded files are private and reachable only through short-lived links. No system is perfectly secure, and we do not guarantee that it is. If a breach affects your information, we will notify you as the law requires.

8. Your choices and rights

You can ask us for a copy of the personal information we hold about you, to correct it, to delete it, or to limit or object to certain uses. Email [email protected]; we will verify the request and respond within 45 days (30 days where a law requires). Depending on where you live — for example California, other US states, or the EU and UK — you may have further rights, including to appeal a decision on your request, to use an authorized agent, and not to be treated differently for exercising them. If we decline a request, we will say why. If you ordered from a shop using Wunshop, your records belong to that shop, so we will pass your request to them and help them act on it.

California: in the past 12 months we collected the categories in section 2 for the purposes in section 3, and disclosed them to the recipients in section 5. We do not sell or share personal information and do not use sensitive personal information to infer characteristics about anyone.

9. Where it is processed

Wunshop is run from the United States, and our own servers and database are there. Some of the providers listed above, such as Cloudflare, Stripe, Twilio and Google, also process information in other countries under their own policies. If you use the Services from outside the United States, you understand your information will be transferred to and processed in the United States and those other places, where the law may differ from yours.

10. Businesses' responsibilities

A business that uses Wunshop is responsible for its own privacy notice to its customers, for having a lawful basis and any consents needed to collect their information through the Services, and for honoring their requests. We provide tools and help, as our Terms describe.

11. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it.

12. Changes

We may update this policy. We will post the new version with a new effective date and, for material changes, notify account holders by email or in the Services before they take effect. Continuing to use the Services after that means you accept the updated policy.

Contact

Four Brooks LLC, operator of Wunshop · Texas, USA · [email protected]