WrappYoo Privacy Policy

Last updated: Sep 20, 2026

1. Who We Are

WrappYoo ("WrappYoo," "we," "us," "our") is a company incorporated in Hong Kong SAR. This policy explains how we collect, use, disclose, and protect personal data when you use the WrappYoo mobile app on Android and iOS and related services (the "Service"), including generating AI visualizations of vehicle wrap designs from photos you upload, and where you choose to order a physical wrap connecting you with an independent, third-party Wrap Shop to print and install it.

This policy is written to meet the baseline requirements of Hong Kong's Personal Data (Privacy) Ordinance, Cap. 486 ("PDPO"), enforced by the Office of the Privacy Commissioner for Personal Data ("PCPD"), and is supplemented by the region-specific rights in Section 13 for users in the United States, Canada, Thailand, and the United Arab Emirates.

2. What We Collect

●       Account data: name, email address, password (or third-party sign-in token), country/region

●       Content you upload: photos and/or videos of vehicles, which may incidentally contain images of other people, license plates, or surroundings

●       Generated content: AI-produced wrap-visualization videos and any design prompts or settings you provide

●       Device & usage data: device type, operating system version, app version, crash logs, and approximate location (only if you enable location permissions)

●       Payment data (if applicable): processed by our third-party payment processor Stripe; we do not store full card numbers ourselves

●       Support communications: messages you send us for help, feedback, or to report content

3. How We Use It

●       Operate the core Service, including processing your uploaded photos through our AI video-generation pipeline to create your wrap visualization

●       Maintain, secure, and improve the app (bug fixes, performance, new features)

●       Communicate with you (service notices, support responses)

●       Detect and prevent fraud, abuse, and violations of our Acceptable Use Policy (see the Terms of Service)

●       Comply with legal obligations and respond to lawful requests from authorities

We do not sell your personal data.

4. How We Handle Photos Specifically

Photos of vehicles can incidentally include information about people other than you — a passerby, a reflection, a neighboring license plate, or a visible house number or street sign. To protect anyone who might appear in your photo, and to reduce rejections from our AI video-generation provider, WrappYoo automatically detects and blurs faces and license plates in uploaded images before they are processed, including your own license plate, since it isn't needed to generate your wrap visualization. This happens automatically.

Separately, if an upload appears to be a deliberate reproduction of someone else's professional marketing or branded material (a business logo, dense ad copy, a QR code, contact details) alongside a real person's likeness, we do not attempt to auto-fix it. That upload is rejected and may be routed to manual review, and you may be asked to confirm you hold the rights to the artwork.

Our AI video-generation provider also runs its own independent safety checks and may independently decline to process an image it flags as containing identifiable people or private information. This decision is made by the provider's system, not by WrappYoo.

4a. Sharing Your Design and Order Details with Wrap Shops

If you choose to order a physical wrap through WrappYoo, we act as an intermediary connecting you with an independent, third-party Wrap Shop ("Wrap Shop") to print and install your design. To fulfill that order, we share with the assigned Wrap Shop the information necessary to complete the job, which may include your approved design file, vehicle make/model, your installation location or appointment details, and contact information for scheduling.

Wrap Shops are independent businesses, not WrappYoo employees or agents. They are contractually required (see our Wrap Shop Partner Agreement) to use this information solely to complete your order, and to handle it consistent with our privacy commitments, including deleting it once the order and any applicable warranty period are complete.

5. Who We Share Data With

●       Our AI video-generation provider(s), solely to generate your visualization

●       Wrap Shops / installation partners you choose to order through; see Section 4a

●       Artists, if you purchase a design through the Artist marketplace. We share only aggregate sales/royalty information (e.g., that a purchase occurred) needed to pay the Artist, not your personal identity or vehicle photos, unless you separately choose to share those (e.g., to request a custom variation)

●       Cloud hosting / storage providers

●       Payment processor / facilitator — Stripe (via Stripe Connect), to process your payment and, for physical-wrap orders, to remit funds to the Wrap Shop on your order. See the Terms of Service, Section 9b, for how the marketplace payment structure works, including a known caveat for Thailand- and UAE-based Wrap Shops

●       Analytics / crash-reporting tools (if used)

●       Law enforcement or regulators, where legally required

We do not share your uploaded photos or generated videos with other users, or publicly, beyond what's described above, unless you take an action to share them yourself (e.g., a "share" or "export" feature).

6. International Data Transfers

Because our team, our AI provider, and our cloud infrastructure may be located outside Hong Kong and outside your home country, your data will likely be transferred internationally as part of providing the Service.

7. Data Retention

●       Uploaded photos and generated videos are retained for as long as your account is active, plus 90 days. You may request deletion of your uploaded images and any content generated from them at any time by contacting us (Section 12).

●       Images automatically rejected for containing potential third-party information are retained for 14 days to support review requests, then permanently deleted.

●       General account data (profile information, preferences, and non-transactional activity) is retained for 30 days after account closure, then deleted.

●       Financial and transaction records are retained for 7 years from the date of the transaction, as required under Hong Kong's Inland Revenue Ordinance, regardless of account closure.

8. Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, consistent with PDPO Data Protection Principle 4. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

At minimum, under Hong Kong's PDPO (Data Protection Principle 6), you have the right to:

●       Be informed whether we hold personal data about you

●       Access a copy of that data

●       Request correction of inaccurate data

●       Request deletion of your account and associated personal data

Depending on where you live, you may have additional rights. See the Regional Rights Addendum (Section 13).

To exercise any of these rights, including account deletion, contact us using the details in Section 12.

10. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, contact us and we will take steps to delete it.

11. Changes to This Policy

We may update this policy from time to time. We will post the updated version in the app and/or on our website with a new "Last updated" date, and for material changes we will provide additional notice via in-app notification or email.

12. Contact Us

For privacy questions, access/correction/deletion requests, or complaints, contact us at info@wrappyoo.com

If you are in Hong Kong and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data (PCPD). Users in other markets may have a right to complain to their local regulator. See Section 13.

13. Regional Rights Addendum

●       United States — Depending on your state of residence, you may have rights such as access, deletion, correction, and opt-out of certain data uses under state privacy laws (e.g., California's CCPA/CPRA, and similar laws in other states).

●       Canada — Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access your personal information, challenge its accuracy, and know how it is used and disclosed. You may complain to the Office of the Privacy Commissioner of Canada.

●       Thailand — Under the Personal Data Protection Act B.E. 2562 (PDPA), you have rights to access, rectify, erase, restrict, and object to the processing of your personal data, and to data portability. You may complain to the Personal Data Protection Committee (PDPC).

●       United Arab Emirates — Depending on which regime applies to your data (the federal Personal Data Protection Law, the DIFC Data Protection Law, or the ADGM Data Protection Regulations), you may have rights to access, rectify, erase, and object to processing, and to lodge a complaint with the relevant authority.