Privacy Policy

Last updated: 16 May 2026 — added cookie consent banner; wp_consent preference cookie disclosure

1. Who We Are

Wearpro is a trading name of Vidhav Ltd, a company registered in England and Wales. We operate the Wearpro platform (wearpro.co), which provides uniform programme management services for businesses with uniformed teams.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Vidhav Ltd is the data controller. If you have any questions about this policy or how we handle your data, please contact us at hello@wearpro.co.

2. What Data We Collect

We may collect the following categories of personal data when you use our platform, visit our website, or communicate with us:

Account & Profile Data

Name, email address, job title, company name, and phone number provided when you create an account or complete a contact form.

Uniform Programme Data

Sizing information, department allocations, garment preferences, and order history submitted by you or your organisation as part of managing a uniform programme on the platform.

Usage Data

Information about how you interact with our website and platform, including pages visited, features used, browser type, IP address, and device information.

Behaviour Analytics & Session Recordings

We use Microsoft Clarity to better understand how visitors and signed-in users interact with our pages. Clarity captures anonymised mouse movement, clicks, scroll depth, and viewport-level session replays — what was on screen and where you clicked. Replays are intended to show us where users are getting stuck so we can improve the platform; they are not used to identify individuals. Clarity automatically masks form input fields and elements we have tagged as sensitive (financial figures, AI chat content, customer / supplier specifics) so the contents of those fields don't appear in replays. See section 4 ("Data Sharing") for Microsoft's role as a data processor.

Communication Data

Records of correspondence when you contact us via email, contact forms, or other channels.

Workforce Sizing Data

When your organisation invites staff to complete a sizing form via a token-gated link, each staff member submits sizes (and optionally their name and email if you choose to capture them) so the correct quantities can be ordered. We hold this data for the organisation as part of the uniform programme record; staff members are not the platform's account holders.

AI-Assisted Feature Inputs

If you use the AI Spec Assistant or AI Sketch features (admin-side only), the prompts you submit and the spec / sketch data we generate are sent to a third-party large-language-model provider (currently OpenAI; we may swap providers and will update this list when we do). We do not send customer-identifying data to AI providers; we send garment descriptions and admin-typed text only.

3. How We Use Your Data

We process your personal data for the following purposes and on the following lawful bases under the UK GDPR:

• To provide and operate the platform — including account creation, programme management, order processing, and user support. Lawful basis: performance of a contract.
• To communicate with you — including responding to enquiries, sending service-related notifications, and providing updates about your account. Lawful basis: performance of a contract and legitimate interests.
• To improve our services — including analysing usage patterns, diagnosing technical issues, and developing new features. Lawful basis: legitimate interests.
• To comply with legal obligations — including maintaining records as required by law and responding to lawful requests from authorities. Lawful basis: legal obligation.
• To send marketing communications — only where you have given your explicit consent. You can withdraw consent at any time. Lawful basis: consent.

4. Data Sharing

We do not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary for the purposes described above:

• Platform counterparts — If you are a business user, your suppliers on the platform may see relevant order and programme data, and vice versa, as necessary to fulfil programme activities.
• Service providers — Trusted third-party providers who assist us in operating the platform. These providers are bound by data-processing agreements. The current list is below.
• Legal requirements — If required by law, regulation, or legal proceedings.

Third-party processors we use

The following providers process personal data on our behalf. Each is a data processor (we remain the controller). We review this list quarterly and update it when providers change.

• Hetzner Online GmbH (Germany) — primary application hosting and Postgres database via the Coolify control plane.
• Supabase, Inc. (USA / EU) — authentication (cookie-based sessions, password reset emails, password storage), and S3-compatible storage for uploaded assets (logos, garment images, spec PDFs, supplier invoices).
• Cloudflare, Inc. (global) — secondary object storage via Cloudflare R2 (where configured) and edge CDN for asset delivery.
• Stripe Payments Europe Ltd (Ireland) — card payments and Stripe Checkout sessions. Card data is collected by Stripe directly; we never see it.
• Chargebee Inc. (USA / India) — subscription billing and customer/supplier invoice book-keeping.
• Resend, Inc. (USA) — transactional email delivery (account confirmation, password reset, order updates, support replies).
• Functional Software, Inc. (Sentry) (USA / EU) — error reporting and performance monitoring. We strip personally identifying data from stack traces where reasonably possible.
• HubSpot, Inc. (USA / EU) — marketing-site analytics and inbound-lead forms. Loaded only on the public marketing pages (/, /about, /contact, /for-business, /for-suppliers, /blog/*), not inside the authenticated app.
• Microsoft Corporation (Clarity) (USA) — behaviour analytics, heatmaps, and session-replay recordings on both marketing and authenticated portal pages. Sensitive inputs and tagged elements are masked at the source before being recorded. Data is processed under Microsoft's privacy statement and the Clarity-specific Clarity privacy notice.
• Arcjet, Inc. (USA) — rate-limiting and bot-protection signals based on IP address and request shape.
• OpenAI, LLC (USA) — large-language-model API for the admin-side AI Spec Assistant and AI Sketch features. See section 2 ("AI-Assisted Feature Inputs") for what we send.
• Unsplash, Inc. (USA) — image CDN for stock photography on the marketing site. No user data is sent; images are loaded by the visitor's browser directly.
• Lordicon — icon-animation CDN on the marketing site. No user data is sent; assets are loaded by the visitor's browser directly.

5. International Transfers

Your data may be processed by service providers located outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), to protect your data in accordance with the UK GDPR.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retentions:

• Active account data (user profile, organisation, sites, suppliers) — retained for the duration of your account. On request, we mark accounts as deleted; deletion is logical (the row is preserved with a deletedAt timestamp) for 30 days during which a restore is possible, then we hard-delete or anonymise.
• Order, invoice, and payment records — retained for 7 years from the order date to satisfy UK HMRC tax record-keeping requirements (Companies Act 2006 / VAT Regulations).
• Support thread + message records — retained for 2 years after the last message; can be deleted earlier on request.
• Fraud / audit log records — retained for 2 years to support security investigations and dispute resolution.
• Workforce sizing submissions — retained as part of the organisation's uniform programme record. When an organisation deletes a programme, the related sizing data is deleted with it.
• AI assistant prompts / responses — telemetry logs (which prompts were sent, whether the response was accepted) are retained for 1 year for product-improvement analysis. The OpenAI conversation itself is governed by OpenAI's retention terms.
• Marketing-site visitor data — governed by the HubSpot data-processing agreement; we don't store it ourselves.

7. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct inaccurate or incomplete data.
• Right to erasure — You can ask us to delete your personal data in certain circumstances.
• Right to restrict processing — You can ask us to limit how we use your data.
• Right to data portability — You can request your data in a structured, commonly used format.
• Right to object — You can object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — You can request human intervention if decisions are made solely by automated means.

To exercise any of these rights, please contact us at hello@wearpro.co. We will respond within one month as required by law.

8. Cookies

Our website uses cookies and similar technologies to ensure the site functions properly, to analyse usage, and to improve your experience. Specifically:

• Essential — Authentication cookies (sb-*-auth-token, set by Supabase): cookie-based session that keeps you signed in. Strictly necessary, set without consent.
• Essential — CSRF protection: set by Next.js to protect against cross-site request forgery on server actions.
• Essential — Consent preference (wp_consent): records your accept / reject decision from the cookie banner so we don't re-ask on every visit. 12-month TTL.
• Optional — Marketing analytics: HubSpot tracking cookies (__hstc, __hssc, __hssrc, hubspotutk) on the marketing pages (/, /about, /contact, /for-business, /for-suppliers, /blog/*) measure inbound traffic and form conversions. Set only with your consent on first visit.
• Optional — Behaviour analytics: Microsoft Clarity cookies (_clck, _clsk, CLID, and similar first- and third-party identifiers) recognise returning visitors and group their interactions into a session for heatmap + replay analysis. Loaded on both marketing and authenticated portal pages; sensitive form inputs are masked at source.

Your control: on your first visit you will see a banner with Accept and Reject buttons covering all optional cookies. Choosing Reject means the HubSpot and Microsoft Clarity scripts are never loaded — no analytics cookies are set at all. Choosing Accept loads both. You can clear the wp_consent cookie in your browser to see the banner again and change your decision.

You can also manage your cookie preferences at any time through your browser settings, and opt out of Microsoft analytics via Microsoft's privacy controls. Withdrawing consent for optional cookies does not impact authenticated app functionality.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction. These include encryption in transit and at rest, access controls, and regular security reviews.

10. Children

Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. We will notify you of material changes by posting the updated policy on our website with a revised "Last updated" date. We encourage you to review this page periodically.

12. Complaints

If you have concerns about how we handle your personal data, please contact us first at hello@wearpro.co. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Vidhav Ltd (trading as Wearpro)
Email: hello@wearpro.co
Registered in England & Wales