Wah! SMARTDEALS - Vendor Privacy Policy
Effective date: October 7, 2026
This policy describes how WahSmartDeals LLC ("Wah!", "we", "us") collects, uses, shares, and protects personal information related to vendors and the people who register and operate a vendor account. It should be read with the Vendor Terms of Service, Cookie Policy, and Disclaimer. Much of the information we hold about a vendor is business information; this policy focuses on personal information about the individuals who register and operate a vendor account.
1. Information we collect
| Category | Examples | Source |
|---|---|---|
| Business profile | Legal business details, DBA, branches, addresses (including map/place data via Google Maps/Places), hours, contact persons and branch managers, operational data, and any external business-profile link (such as a Google Maps listing) you choose to provide for customer review invitations. | You, during onboarding and profile edits. |
| Account holder identity | Name, phone, and email of the person who registers the account, and of any branch contacts you add. A business account is one login. | You. |
| Verification & compliance | Business licence (uploaded as a document), food permit (food businesses), insurance evidence (optional), document expiry dates, and related metadata. | You; reviewed by Wah! staff. |
| Uploaded documents & media | Verification documents and any logo, deal image, deal video, or welcome video you upload or record (the welcome video uses your device camera and microphone), stored in our cloud storage. | You. |
| Authentication & security | One-time-passcode events, session/device identifiers, audit logs, and a record of your acceptance of our terms and privacy policy with the time, your IP address, and your device/browser string. Optional biometric login uses a credential stored locally on your device; Wah! does not receive or store biometric data. | Automatically. |
| Commercial activity | Deal configurations, coupon/redemption records, lead records and the member's consent record for each lead, reviews and ratings customers leave on your deals, and fee/wallet ledger entries (which may include a customer's display name for a redeemed coupon). | Your use of the Platform. |
| Payment & Stripe metadata | Stripe's customer and card reference IDs, the card brand, the last four digits and the expiry month and year, and records of wallet top-ups, lead block purchases, refunds and withdrawals, and Treat invoice references and paid status. Your card number and security code are entered on Stripe's secure page and stored by Stripe; Wah! never sees or stores them, nor your full bank numbers. | Stripe and our systems. |
| Support & communications | Support chats and tickets with Wah!, notifications, and moderation and policy-enforcement records. Chat is with Wah! support only; there is no messaging between you and a customer inside Wah!. | You and Wah!. |
| Technical usage | Error and performance reports, page requests (including IP address and device string), and the browser or device storage the app needs to work (see Cookie Policy). The app sets no cookies and uses no analytics or advertising trackers. | Automatically, from your device. |
2. Customer data you access - by deal type
Depending on the deal type, you may access limited customer data. This mirrors the disclosure in the Customer Privacy Policy (Section 3), and your use of it is governed by the Vendor Terms (Sections 11–12):
| Deal type | What you receive |
|---|---|
| Sponsor (live) | The member's full name, phone number, email, street address (apartment, city, state and ZIP), community, answers to your survey questions, and the visit time she chose. She agrees to share these with you for the offer and your own future promotions before the coupon is issued, and Wah! keeps a record of that agreement. You can download them as a CSV file, and Wah! staff may also email lead details to you. Wah!'s own survey questions (for example interests and job interest) stay with Wah! and are not shown to you. You see a coupon's redeem code only after it has been redeemed. You must honor any request to stop contacting her, and you are solely responsible for TCPA and marketing-law compliance (Vendor Terms Section 12). |
| Treat (live) | Only a shortened name (such as "First L."). You do not receive the member's phone, email, or address. |
| Retail (parked; past records only) | Operational fulfilment: to validate and honor a coupon, you may see the name associated with the coupon (shown in shortened form, such as "First L.", in lists) at claim or redemption. Analytics: otherwise aggregate redemption counts and revenue totals, and aggregate community counts. You do not receive the customer's phone, email, or address. |
Reports, and the CSV or PDF exports made from reports, leave out member personal details; the lead list is the exception. You may use customer data only to deliver and follow up on the offer and for lawful marketing consistent with the member's consent; you must honor opt-outs and STOP requests directly and keep the data secure; you must delete a member's data when she asks you to, including after she deletes her Wah! account; you act as an independent controller of any customer data you retain; and unauthorized marketing, profiling, resale, or sharing is prohibited. After a member deletes her account, you see anonymised values in Wah!, but any copy you already exported or were sent stays with you.
3. How we use vendor data
- Onboarding, document verification by Wah! staff, and legal/compliance checks.
- Operating deal publication, coupon lifecycle, wallet accounting, fee collection, and notifications, including notices about your documents, deals and wallet and the automatic pause of live deals when a required document lapses.
- Administering customer reward programs (currently Wah Rewards points for eligible in-app reviews); no vendor fee is charged for voluntary customer posts on external review sites.
- Fraud detection, abuse prevention, quality assurance, and dispute handling.
- Regulatory reporting, legal compliance, and security monitoring.
4. Service providers and subprocessors
We use trusted service providers strictly to operate, secure, and improve the Platform:
| Purpose | Provider |
|---|---|
| Hosting, database, login, file storage, and server functions (US East, Ohio) | Supabase |
| Website and app hosting (sees page requests, including IP address and device string) | Vercel |
| Your card on file, wallet top-ups, lead block purchases, and refunds (contact email, business name, and reference IDs; card numbers go straight to Stripe's hosted pages) | Stripe |
| Login codes and a few text alerts (phone number and message) | Twilio |
| Transactional and account email (us-east-2) | Amazon Web Services (SES) |
| Mobile push notifications (device token, title, body, badge) | Google Firebase Cloud Messaging |
| Error and performance monitoring (errors, page URL, device type; about 10% of production page loads are sampled for performance; no session replay; no user identifiers set) | Sentry |
| Drafting helper for deal and review-reply wording, used only when you start it (see Section 5) | Anthropic (Claude) |
| Sign-in, address lookup (the characters you type in address fields), map links, fonts on three static marketing pages | Google (including Google Maps / Places) |
| Sign-in, private relay email, map link | Apple |
| Human check at sign-up and at the business review step | Cloudflare Turnstile |
| ZIP code lookup to fill in city and state at sign-up | Zippopotam.us |
| Drawing the QR code on a deal share page (the share link) | QRServer.com |
| Sharing, only when you tap share (the share text) |
We also disclose information for regulatory/legal requirements (law, subpoena, court order, or safety) and in corporate transactions (mergers, reorganizations, financing, due diligence, or asset transfers). We do not sell vendor personal information for monetary consideration.
5. Automated processing and AI
Wah! does not use AI to moderate reviews or to detect fraud, and decisions about your approval, your deals, your reviews and your account are made by Wah! staff. Some actions happen automatically by rule, for example a human check at sign-up, rate limits on claims, coupon and report requests, and the automatic pause of live deals when a required document lapses. You may email admin@wahsmartdeals.com to ask a person at Wah! to look again at a decision that affects you.
The one place we use AI is an optional drafting helper that runs only when you start it. It sends your business name, category, and deal name and description to Anthropic (Claude) to suggest wording; for a review reply it also sends the review text (first 600 characters), the rating, and the reviewer's name. It is not used for moderation or fraud checks.
6. Payments, Stripe, and tax reporting
The card you add to pay for leads and wallet top-ups is stored by Stripe, not by Wah!, and charged under Stripe's own terms. You enter your card on Stripe's secure page: Wah! never sees or stores your card number or security code. Wah! keeps only Stripe's reference IDs for the card, its brand, the last four digits and the expiry month and year, so you can recognize it and so we can ask Stripe to charge it. You can remove the card at any time from Payment method. When you withdraw unused wallet money, it is refunded to the card that paid, not to a bank account. Treat payments are made by invoice outside the app. Wah! does not store your full bank numbers. You are responsible for your own taxes, as described in the Vendor Terms; Wah! will issue tax forms where the law requires it.
7. Legal basis and consent
Where required by law, we rely on lawful bases including contract performance, legitimate interests, legal compliance, and consent. You may withdraw consent where legally allowed.
8. Data retention
| Category | Typical retention |
|---|---|
| Business, verification & financial records | For the life of the account and as required by tax, accounting, anti-fraud, and legal obligations (we keep transaction and audit records for up to 7 years, or longer where the law requires). |
| Support & communications | Retained on a long-term, append-only basis for audit, safety, and dispute resolution. |
| Security, audit, acceptance, and coupon-lifecycle logs | Long-term, append-only, for security, fraud prevention, and compliance. This includes the record of your acceptance of our terms, with its IP address and device string. |
Certain records may be retained beyond account termination where the law requires.
9. Security, storage, and device permissions
We apply reasonable technical and organizational safeguards and maintain incident-response controls; no method of storage or transmission can be guaranteed as fully secure. These include database row-level security on every table, private storage for sensitive files opened only through short-lived signed links (five minutes), a one-time code for administrator actions, rate limits on claims, coupon and report requests, a human check at sign-up and at a Sponsor claim, and HTTPS everywhere. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by applicable law.
Public and private files. Deal images, deal videos, review photos, profile pictures, business logos, and your welcome video are served by public link, so anyone with the link can see them. Business documents, support attachments, and coupon QR codes are private.
Device permissions. The mobile app may ask for the camera (to scan coupon QR codes and take photos), the photo library (for uploads), the microphone (for the welcome video), and Face ID or fingerprint through your phone's operating system. It does not ask for your location or your contacts.
10. International transfers
Wah! is based in the United States. We process data in the United States and in other countries where our service providers operate.
11. Vendor account closure
You can request closure of your business account in the app. A request is refused while any of your deals is live, any coupon is outstanding, or your wallet holds money. Wah! staff can remove a business only when it has no deals, no wallet transactions and a $0 balance; removal deletes the profile, documents, branches, and wallet. If Wah! staff deactivate your account, your live deals end, active coupons are cancelled, your wallet is frozen, and your reviews are hidden. We retain business, financial, audit, and compliance records after closure as described in Section 8 and as required by law.
12. Your rights and requests
Subject to law, vendor users may request access, correction, deletion, or portability of certain personal data. Requests may be limited where retention is required for compliance, fraud prevention, payment obligations, or active disputes. Many U.S. state privacy laws exempt business-to-business and commercial information, but they may apply to personal information about the individuals who operate a vendor account. You can edit your business profile in the app; changes to verified fields need Wah! staff re-approval. There is no self-service data export tool. Requests are handled by hand: email admin@wahsmartdeals.com. We may require verification and supporting documents. Where required by law, we will treat a recognized opt-out preference signal, such as Global Privacy Control, as a valid opt-out of sale/share to the extent we engage in such activity and as we implement support for it.
13. Jurisdiction-specific override
Where mandatory local law grants additional rights or imposes stricter obligations, those mandatory provisions apply to the limited extent required by law.
14. Policy updates
We may revise this policy from time to time and will post the revised version with an updated effective date. For material changes, we will provide reasonable notice.
15. Contact
WahSmartDeals LLC
13235 Affirmed Avenue
Frisco, TX 75035
United States
Privacy and legal: admin@wahsmartdeals.com
Vendor support: contact@wahsmartdeals.com