Privacy Policy

Last updated: October 10, 2026

1. Introduction

WISMO ("we", "our", "us") is a mobile order tracking platform for small business owners. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your information.

2. Data We Collect

Account Data (Sellers)

  • Phone number: used for authentication via Firebase phone/OTP
  • Email address: used for CSV exports and account notifications
  • Business name & owner name: displayed on tracking pages and used for branding
  • Currency preference: the currency your orders are priced in, stored on your account
  • About your business (optional): if you answer them during setup: your trade, roughly how many orders you take in a week, what takes up most of your time, and where your customers find you (for example WhatsApp or Instagram). We use these to set the app up for you and, linked to your WISMO account ID only, to understand which kinds of businesses use WISMO. They are never shown to your customers
  • Notification preferences: your choices for push notification types
  • Terms acceptance timestamp: when you accepted these terms

Order Data

  • Customer information: name, phone number, email, Instagram handle (as entered by the seller)
  • Order details: description, due date, status, seller notes, courier tracking URLs
  • Payment records: payment amounts, modes, and dates
  • Order updates: status changes and seller notes with timestamps
  • Messages you paste to fill in an order: when you use the paste or screenshot icon on the new order screen, or share a message to WISMO, the text or the screenshot you choose is sent to our server and to Anthropic to read the order details. We do not store the message or the screenshot. Only the order you save is kept
  • Voice notes: audio you record on an order, with its length and a small waveform. Only you can hear them. They are never shown to your customers, on tracking pages, in emails or on your store page. To record, the app asks for the microphone, and uses it only while you hold the record button

Device Data

  • Push notification tokens: Expo push tokens stored to deliver notifications to your device
  • App usage: which days you open the app, which screens you view, key steps such as finishing signup or creating an order, and which notifications you open. Linked to your WISMO account ID only, never to your phone number, email or business name
  • Install source: on Android, the campaign tag of the Google Play link you installed from, if it had one

3. How We Use Your Data

  • To provide the core service: order management, tracking pages and status updates
  • To authenticate your identity via phone number verification
  • To send push notifications (due reminders, unpaid order alerts, daily digests)
  • To send email notifications to your customers when order status changes (if enabled)
  • To generate and deliver CSV exports of your order data
  • To display your business name and branding on customer-facing tracking pages
  • To understand how the app is used, so we can fix where sellers get stuck and decide what to build next
  • To measure which of our ads bring in new sellers

4. Third-Party Services

We use the following third-party services to operate WISMO:

  • Firebase Authentication (Google): phone number verification and authentication
  • Neon: PostgreSQL database hosting for all application data
  • Expo Push Notification Service: delivering push notifications to mobile devices
  • Resend: sending transactional emails (order updates to customers, CSV exports)
  • RevenueCat: managing in-app subscriptions and purchase validation
  • Railway: hosting the backend server and tracking pages
  • Cloudinary: storing photos you add to orders, your logo, catalogue and store page, and your voice notes. Voice notes are stored privately. They have no public link, and the app gets a link that works for one hour each time you play one
  • Google Analytics: anonymous usage analytics on the landing page only
  • Meta Pixel: on the wismo.live website only (not the app's customer tracking pages or store pages). It records which pages you visit so we can measure our Facebook and Instagram ads and show them to people likely to be interested
  • Anthropic: reads a customer message or chat screenshot that you choose to paste, and returns order details (customer name, phone, items, price, due date) for you to check. It is used only when you tap "Paste message" or "Choose screenshot". Anthropic does not use this data to train its models. Anthropic may keep it for up to 30 days for safety and security checks, and then deletes it
  • PostHog (US hosting): product analytics in the mobile app, keyed to your WISMO account ID. No session recording
  • Meta (Facebook) SDK: measuring whether our ads on Facebook and Instagram lead to app installs, sign-ups and subscriptions. The app sends Meta the install and app opens, a completed sign-up, order creation (as an event only, never order or customer details) and subscription starts (via RevenueCat), together with device information and, on Android, the advertising ID. We never send your name, phone number, email, business name or any customer data. On iOS the app asks for your permission first (Apple's "Allow to track" prompt). If you choose "Ask App Not to Track", your device identifiers are not shared, and Meta receives results only in aggregate. You can change this at any time in your iPhone's Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID in your phone's settings

Each service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

5. Cookies & Tracking

The WISMO mobile app does not use cookies. Customer tracking pages (wismo.live/track/*) are server-rendered HTML with zero JavaScript and no cookies or tracking pixels. When a tracking page is opened, our server records the date and time and a one-day pseudonymous visitor code (a keyed hash of the IP address and browser type, which changes every day), so a seller can see how many customers opened their link. The raw IP address is not stored. The landing page (wismo.live) uses Google Analytics for anonymous visitor statistics, and the Meta Pixel, which sets a first-party cookie (_fbp) and sends Meta the pages you view along with your browser and device information, to measure and target our ads on Facebook and Instagram.

6. Data Retention

Your data is retained for as long as your account is active. When you delete your account (via Settings in the app):

  • Your account is deactivated and you lose access immediately
  • Your Firebase authentication record is removed, allowing re-registration with the same phone number
  • Device push notification tokens are permanently deleted
  • Voice notes you recorded on orders are permanently deleted
  • Your profile information, orders, order updates, payment records, and customer data are retained in our systems for legal, audit, and operational purposes

If you sign up again with the same phone number, a new account is created. Your previous account data is not restored, and you cannot access it. Retained data may be permanently purged after a reasonable retention period at our discretion.

7. Your Rights

You have the right to:

  • Access your data: export all your order data as a CSV file from the Settings screen
  • Delete your data: close your account from the Settings screen. Access ends immediately and your login is removed; see “Data Retention” above for what we keep afterwards and why
  • Update your data: edit your profile, business information, and notification preferences at any time
  • Control notifications: toggle individual notification types on or off

8. Data Security

We protect your data using:

  • HTTPS encryption for all data in transit
  • Firebase Authentication for secure phone-based login
  • Server-side token verification for all API requests
  • Database-level access controls on Neon PostgreSQL

9. Children's Privacy

WISMO is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or email. The "Last updated" date at the top reflects the most recent revision.

11. Contact

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at support@wismo.live or on Instagram.