Privacy Policy

What we collect

When your account is created we store your name and email address, and a password you choose, which we keep only as a salted hash. Signing in also requires a code from your authenticator app. We also store the information you add while using the app, such as contacts, notes, and tasks.

How we use it

We use this information only to run the app: to sign you in, show your account, and provide the features you use. We do not sell your data or share it with advertisers.

Gmail data (Google API Services)

The Wholesale Network is used by our team to run supplier outreach on behalf of the Amazon sellers we work with. Each seller gives us a dedicated outreach mailbox for their store and connects it to their account in the app. Once a mailbox is connected, we use the gmail.readonly scope to sync that mailbox's messages so supplier conversations appear in the app's shared inbox, the gmail.send scope to send the outreach emails and replies composed in the app from that same address, and the gmail.settings.basic scope, read-only, so a rep can import the mailbox's existing Gmail signature into our signature editor instead of retyping it.

Message headers, bodies, and attachments from a connected mailbox are stored so threads stay readable inside the app, and OAuth tokens are encrypted at rest. By connecting a mailbox, the mailbox owner is asking us to work those conversations for them: the account owner and the The Wholesale Network team members assigned to that account can read the synced messages and reply to suppliers from inside the app. No one outside that account's team sees them. We do not use Gmail data for advertising, we do not sell it, we do not transfer it to anyone other than the service providers that host the app, and we do not use it to train generalized AI or machine-learning models. Beyond the assigned team described above, humans access the data only to resolve a support issue you report, for security purposes, or where required by law.

The Wholesale Network's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect a mailbox in the app at any time, or revoke access from your Google Account, and you can ask us to delete the synced messages by contacting us.

How we protect your data

All traffic to The Wholesale Network is encrypted in transit over HTTPS/TLS. OAuth access and refresh tokens are encrypted at rest with AES-256-GCM before they touch our database, using a key that is never stored alongside the data it protects. Our database and file storage run on managed cloud infrastructure that encrypts data at rest at the storage layer.

Access to a workspace's data — including synced Gmail messages — is restricted to the members of that workspace and enforced at the database query level by role and account assignment; no one outside a workspace can query into it. Internally, only engineers troubleshooting a reported issue or a security incident access underlying data directly, and only as needed to resolve it.

We retain synced mailbox data for as long as the mailbox stays connected. Disconnecting a mailbox deletes its synced messages and threads immediately, not on a delayed schedule, and you can trigger that at any time from the app. You can also ask us to delete your account and all associated data by contacting us, and we will do so within 30 days.

Sharing

We share data only with the service providers that help us run the app (for example, hosting and authentication), and only as needed to operate it. We may disclose information if required by law.

Your choices

You can ask us to access or delete your account and data at any time by contacting us. Revoking the app's access from your Google or Microsoft account will stop future sign-ins.

Contact

Questions? Email us at [email protected].