Privacy Policy

wamert (operating at wamert.com) is a multi-tenant SaaS for export-oriented companies: brand-site building, CRM, SEO/GEO tooling and billing. It is operated by 温州大唐盛世传媒有限公司 (CHINAHEYDAY MEDIA), Yueqing, Wenzhou, Zhejiang, China.

This policy covers the platform accounts and the data tenants keep inside wamert. Visitor analytics on brand sites built with wamert is described separately in the brand-site privacy policy.

Only for: (a) providing wamert service (cockpit, SEO engine, brand sites, billing); (b) product improvement (aggregated, de-identified metrics); (c) support and necessary notifications. We do NOT use your data to train general AI models, do NOT sell to third parties, do NOT use for marketing retargeting.

Tenant data and audit logs are stored in self-hosted servers located in mainland China. Databases, object storage and cache run on infrastructure we operate ourselves. Tenants share one database: tenants share one database; rows are isolated by tenantId and cross-tenant access is rejected at the API layer.

Transport is forced to TLS 1.2+ (HSTS enabled). Sensitive fields (password, tokens) are hashed or encrypted at rest. Administrative access is gated by role checks (RBAC) and every consequential action is written to the audit log.

Audit logs are kept for 365 days by default; expired rows are removed by an administrator-triggered purge task (dry-run first, then an explicit confirmation). Export files are written to temporary storage and are intended to live 24 hours; each export is capped at 5000 rows.

Account data stays while your tenant is active. Deletion is anonymisation (identifying fields such as name, email, phone and website are cleared; necessary business records are kept): identifying fields (name, email, phone, website) are cleared and the change is recorded in the audit log; business records required for billing and tax reconciliation are kept. Records that belong to a customer of yours can be erased in bulk, up to 100 rows per request.

Platform sign-in uses a single session cookie (access token). Brand sites built with wamert show a consent banner before any analytics is collected; the choice is stored in the browser, no analytics request is sent until you accept, and declining does not affect browsing. You can change your choice by clearing site storage, or by emailing privacy@wamert.com.

1. Export: Settings → Data Export produces a CSV file of customers, products or orders, capped at 5000 rows per run. Every export is logged.
2. Erase: customer and contact records are anonymised through the data-erasure endpoint, which requires selecting records explicitly — each erasure is logged with masked before/after values. Today the endpoint is called from the platform backend; a self-service screen is in progress, so requests can also be sent to privacy@wamert.com. Bulk erasure beyond 100 rows is rejected — split the request.
3. Correct: account and business data are editable at any time in the platform.
4. Delete the account: email privacy@wamert.com from the tenant owner address; we confirm within 5 business days. Deletion anonymises identifying fields and removes the tenant's access.

Rights under GDPR (EU/EEA), CCPA (California) and China's PIPL are honoured the same way. Contact privacy@wamert.com.

We do not sell data. To run the service we send the minimum necessary content to the following categories of processors:

Some of these processors may be located outside mainland China, so a limited cross-border transfer can occur: only the text needed for the specific task (copy, translation, lookup keywords, recipient address) is sent, and customer contact details are not included in AI requests. Where a tenant operates under stricter rules, the corresponding integration can be switched off by deployment configuration.

If Google Search Console access is ever re-enabled, wamert will strictly comply with Google API Services User Data Policy (including Limited Use): access only after explicit consent, used only to display search performance inside wamert, never transferred or sold, never used to train models, never used for ad targeting. Today this section imposes no obligation because the integration is withdrawn.

wamert is a B2B service and is not directed to minors under 18. If you believe a minor's data reached us, contact privacy@wamert.com and we remove it.

We may update this policy. Material changes are announced on the cockpit dashboard before they take effect. The effective date at the top always reflects the current version.