Privacy policy

Who we are and how to contact us

Warly provides digital warranty record software for businesses and their customers. In this policy, “Warly”, “we”, and “us” refer to the provider of that service. This policy describes personal information handled through warly.app, its business workspace, public certificates, and contact form. For privacy questions or requests, email support@warly.app or choose Privacy on the Contact page. The date above identifies the current published version.

Our role and the issuing business's role

We decide how to use information needed to run Warly's own accounts, security, website administration, optional website analytics, and support. Where applicable data-protection law uses that term, we act as the controller for those activities.

A business that enters its customers' details and warranty or service records decides why those records are created and what they contain. We host and process those records to provide the service to that business. Where the relevant law uses those terms, the business ordinarily acts as controller and Warly acts as processor for that activity. A business may have its own privacy notice.

If your concern is about a purchase or warranty record, start with the business identified on the certificate. You can also contact us so we can help route your request or address information for which we are responsible.

Information you or a business provide

Account information includes an email address, account identifier, authentication information, business membership, role, and account status. Authentication is managed through Amazon Cognito. Administrator accounts also use an authenticator app for an additional sign-in check.

Business profiles include a name, business category, telephone and WhatsApp numbers, email address, address, optional logo, and default warranty settings. Account and membership records may include a staff member's name and email.

Customer records include a name and telephone number, and an email address if supplied. A warranty may include a snapshot of those customer details, product name, brand, model, category, serial number, purchase date, warranty duration and dates, invoice reference, purchase price and currency, terms, notes, and an assigned technician.

Service records may include the service date, type, technician, work description, parts, cost, and notes. Uploaded receipts, invoices, and product photos contain whatever information the business chooses to include. Businesses should provide only relevant information and avoid sensitive material that the service does not need.

The contact form collects your name, email address, selected topic, and message. We also receive the content and ordinary delivery information of emails you send us. Do not send passwords, payment-card details, identity documents, or sensitive customer records in a contact message.

Technical and activity information

Our infrastructure processes network and device information needed to deliver requests and protect the service, including IP addresses and browser information. Application audit records can include the signed-in actor, business, action, affected record, timestamp, request identifier, IP address, and browser information. Public certificate visits do not create a customer account.

For the contact form, we derive a short-lived hashed identifier from the request's IP address and a daily scope to count submissions and limit abuse. This identifier is pseudonymous, not anonymous. The contact message itself does not store the sender's IP address. Security counters and request logs are separate from the message content.

We keep operational logs for faults and request outcomes. The application is designed not to log passwords, access tokens, message bodies, full customer records, or private document links in those operational logs.

Why we use information

We use account and business information to register and authenticate users, apply permissions, manage the business's allowance, and provide the workspace. We process customer, product, warranty, document, and service information to save records, show authorized users their information, generate public certificates, and maintain history.

We use contact details and messages to review, route, and reply to enquiries. A form submission does not subscribe you to a marketing list. We use activity information and security counters to investigate faults, prevent misuse, maintain an audit history, and administer the platform.

Where a legal basis is required, information necessary to provide a service you request is used to perform or take steps toward that agreement. Business-contact and security processing may rely on our legitimate interests in operating a reliable service and answering enquiries, balanced against individual rights. We may also process information to meet a legal obligation. Optional website analytics relies on your consent, as described below. We will explain and request consent separately before any further consent-based use. A merchant is responsible for determining the basis for the customer records it asks us to process.

What a public certificate reveals

Anyone with a certificate link or QR code can open it without signing in. It displays product details, a masked serial number when available, purchase and expiry dates, the recorded warranty status, the entered warranty terms, and the business's contact information, address, and available logo.

The public response excludes the separate customer contact fields, the full serial-number field, purchase price, internal notes, and uploaded warranty documents. This protection cannot remove personal information a business types into a public product description or warranty term. Businesses should review public fields before sharing a certificate.

Public links can be copied, forwarded, or published by their recipients. Contact the issuing business or Warly if a certificate contains information that should not be public.

Who can receive information

Authorized users of the issuing business can access information according to their role and assignment. Warly administrators can inspect records for support, security, and platform oversight, and relevant inspections or changes are audited.

Amazon Web Services provides Warly's hosting, authentication, database, file storage, and operational monitoring. Service providers process information needed to perform those functions. Messages sent to support@warly.app and our replies also pass through the email services used by us and by the sender or recipient.

When you accept optional analytics, Google receives the analytics information described below and provides Google Analytics reports to Warly. This is separate from AWS hosting and from the information you submit to a business or our contact form.

If you choose a WhatsApp or email link, information in that link or the message you send goes to the external service you select. Those services apply their own privacy practices.

We may disclose relevant information when required by applicable law or where necessary to protect rights, investigate misuse, or resolve a dispute. Warly does not sell personal information or use customer warranty records for targeted advertising.

Storage locations and international access

Warly's primary application database, private files, and authentication resources are configured in the AWS Europe (Paris) region in France. Public website content is delivered through hosting infrastructure that can serve visitors from locations around the world.

Using Warly from another country involves sending information to this infrastructure. Service operation and email support can also involve access from the operator's country or processing by providers in other countries. A Paris storage location does not mean that all processing stays within France. Google Analytics information is processed through Google's infrastructure, which can involve servers and access outside your country and outside France. Google's published privacy information describes its international processing and transfer arrangements. Contact support@warly.app for information about the processing locations and any transfer arrangements relevant to your use of the service.

Browser storage and external content

Warly uses browser local storage for authentication session information so signed-in users can continue using their workspace. Signing out removes the active session for that portal. You can also clear Warly's site data in your browser, which can sign you out. Blocking storage may affect sign-in.

Our fonts are served with the site. WhatsApp and email are opened when you choose their links; the site does not embed their messaging services. Browser storage used for sign-in is separate from the records stored on Warly's servers.

Optional analytics and advertising measurement

Optional analytics and advertising measurement are separate choices in Analytics settings. Both start off unless you have a current applicable permission. Rejecting either does not limit access to Warly. Essential account and security storage continues to operate.

With analytics permission, Warly records public visits, acquisition campaign labels, signup starts and confirmed business lifecycle outcomes. We may use Google Analytics for sanitized public page views and confirmed registration, workspace creation, first-warranty activation, trial, payment, renewal and refund events. With analytics permission, public-site Google client and session identifiers can connect backend-confirmed events to the same consented browser. Private page URLs, verification codes, email addresses, form values, warranty details and customer records are excluded; only expressly permitted advertising click parameters may be included in sanitized public landing URLs. Google signals and advertising personalization remain disabled. Google receives network information when your browser contacts it and may derive approximate location.

With separate advertising permission, Warly may use Meta Pixel and Conversions API to report confirmed registrations, trials and verified payments. Meta receives a pseudonymous event and browser identifier, event time, and confirmed amount/currency for purchases. Permitted advertising click identifiers and Meta browser cookies can assist matching. We do not send customer records, email addresses, phone numbers, warranty serials or claim contents. The Meta tag runs in an isolated measurement frame with a fixed URL. Global Privacy Control disables browser advertising collection. After the Google Ads integration and its privacy settings are approved, a new advertising choice may also permit Google advertising cookies and measurement data, including click identifiers and confirmed conversion amounts. Earlier Meta-only consent does not enable Google advertising. Google Ads may receive conversions imported from Google Analytics or delayed verified first payments through the Data Manager API, with one delivery source per Ads conversion. Refunds may adjust a previously reported payment value. Advertising personalization, enhanced conversions and automatic collection of email or phone identifiers remain off.

Consented acquisition records can include UTM source, medium, campaign, content and term; a sanitized public landing path; referring hostname; and first/last-touch timestamps. Advertising click identifiers, including fbclid, gclid, gbraid and wbraid, are retained only with advertising permission. A random browser token is reconciled to a verified account and its newly created workspace without using email as identity. The default attribution window is 90 days. Missing attribution remains unknown.

We remember your choices for up to 180 days. Consented visitor and identity records default to a 90-day lifetime; internal marketing event records default to 180 days. Provider cookies are bounded where our integration controls them. Database cleanup is asynchronous. Minimal operational lifecycle, audit and payment evidence is retained under the applicable account and financial retention rules independently of optional visitor tracking.

You can withdraw either permission in Analytics settings. Warly stops browser collection immediately and clears accessible measurement cookies. It also updates server delivery preferences when connected; an authenticated withdrawal applies to future optional server analytics and advertising delivery for the account. Unsent account preference changes are retained locally for retry after reconnecting or signing back into the same account. An already in-flight request cannot be recalled. If offline, reconnect so the server opt-out can be received. Withdrawal does not automatically delete data already sent to Meta or Google. Contact support@warly.app for access or deletion requests; we verify authority and handle provider-side deletion and backup retention separately.

Pseudonymous measurement data can still be personal information. Google and Meta may process it under their terms and in other countries. Learn more from Google's Privacy Policy at https://policies.google.com/privacy and Meta's Privacy Policy at https://www.facebook.com/privacy/policy/. Optional integrations remain disabled until their configuration and privacy review are complete.

How long information is kept

Warranty and service information is retained to provide the ongoing record for the business, including after the displayed expiry date. Voiding a warranty, reaching the free allowance, or suspending a business does not automatically delete its records. Account, warranty, audit, and contact-message records currently have no automatic deletion schedule in the application.

We assess requests for correction, closure, or deletion by considering the purpose of the record, the issuing business's instructions, active support matters, applicable retention duties, and a need to preserve evidence for a dispute or security issue. Contact support@warly.app to request a review; we will explain any information that must be retained.

API request and application-error logs are configured for 30-day retention. Contact-abuse counters are marked for expiry after their counting window plus 24 hours; the storage provider's background cleanup may occur later.

Analytics information already sent to Google is subject to the retention settings in Warly's Google Analytics property and Google's applicable service terms. Detailed event and browser-level information has separate retention controls from standard aggregated reports, which can remain available for longer. The 180-day browser-cookie limit is not a promise that all server-side analytics data expires after 180 days. Contact support@warly.app for the applicable analytics retention information or a deletion request.

Backups and previous file versions can outlast a change to an active record. Older file versions are configured to expire after 365 days. The database also uses recovery backups. Any deletion request needs to account for these copies and the restrictions that apply to their use.

Security and your choices

Warly applies explicit opt-in to optional analytics and advertising worldwide, including where your country is unknown. We do not infer your location from your business address or trust a country value supplied by your browser. Analytics and advertising choices are separate; Google advertising measurement requires its own recorded permission. Rejecting these choices does not prevent use of the service. Global Privacy Control disables advertising tracking. Advertising personalization and enhanced conversions remain off.

We use encrypted connections, access controls, private document storage, encryption at rest, and activity records to protect information. Private document access uses links that expire after five minutes. A person with such a link may use it until it expires, and a downloaded copy remains on their device. No online service can guarantee absolute security.

Depending on the law that applies, you may be able to request access, correction, deletion, a portable copy, or limits on processing. You may also have a right to object to processing based on legitimate interests. If processing relies on your consent, you may withdraw that consent without affecting processing already carried out lawfully.

Send requests to support@warly.app. We may need proportionate information to verify your identity or authority, and may involve the issuing business for records it controls. You may also raise a complaint with the data-protection authority that has jurisdiction over your situation. Your rights and the applicable response periods depend on the relevant law.

Required information, automation, and children

An email address is needed for account authentication. Required business, customer, and warranty fields are needed to create the corresponding record. The contact form needs its required fields so we can understand and reply to the message; you can use email instead.

Warly calculates a displayed warranty status from recorded dates and void actions and enforces account and submission limits. It does not automatically decide whether a customer is legally entitled to a repair, refund, or other warranty remedy.

The business workspace is intended for authorized business users, not as a service directed to children. If you believe a child has provided information that should not be held, contact us so we can assess it.

Updates

We may update this policy when our practices or the service change. We will show the updated publication date and provide additional notice where the relevant law requires it. You can contact support@warly.app with questions about this policy or an earlier version.