Privacy Policy
Effective date: September 2, 2026
This policy explains what information Mad Ventures, LLC, doing business as WareMap ("WareMap," "we," "us"), collects when you use our website at waremap.co, the WareMap app, the pages that open when you scan a WareMap label, and our emails (together, the "Service"); how we use it; and who we share it with.
It applies to:
- Customers — the businesses that store goods with us, and the admins who manage their account;
- Authorized Users — the people a Customer adds to its organization so they can scan labels and record moves;
- Visitors — anyone who browses waremap.co or sends us a message through the contact form.
If you are an Authorized User, note that your organization — not you — chose to add you to the app, and your organization can see what you record there. See §7.
In plain English
- We collect what we need to run a warehouse and keep an audit trail: who you are, what you store, where it is, who moved it, and when.
- We don't sell your information and we don't run advertising or tracking on the site.
- The app uses one cookie, to keep you signed in.
- Photos you upload are stored at unguessable web addresses, not behind a login. Don't photograph anything you need kept private.
- Your device's location is attached to a move only if you allow it in your browser.
- Addresses you type in for places are sent to a mapping service so we can put them on a map.
- Your organization's other users, and WareMap staff, can see your name next to the moves you record. Other customers never can.
1. Information we collect
Account and people information. When a Customer sets up an organization, or an admin adds a person to it, we collect the organization's name and, for each person, their name, whether they are an admin, and optionally their email address. We generate each person's six-digit PIN; we store only a one-way code derived from it and cannot see or recover the PIN itself.
Items, places, and shows. The records you create in the app: item names, descriptions, kinds, quantities, dimensions, weights, and photos; places (names and street addresses — convention centers, offices, hotels); and shows (names, venues, booth numbers, dates, and notes).
Moves. Every time an item is shipped, marked as arrived, relocated, counted, or annotated, we record what happened, which item, from where, to where, any tracking number, carrier, and note entered, the name of the person who recorded it, and the date and time. If the person has allowed location access in their browser, we also record the device's approximate latitude and longitude at the time of the move.
Photos. Photos you take of items (a portrait of an item, or condition photos attached to a move). Photos are resized on your device before upload, which removes embedded camera data such as GPS coordinates and timestamps.
Sign-in and security information. When you request a sign-in link we record your email address and the time; links are single-use and expire in 15 minutes. When someone enters a PIN we record the organization, the IP address, and the time of each failed attempt so we can lock out guessing. Our hosting provider also keeps standard server logs (IP address, browser type, pages requested, timestamps) for a limited time.
Contact form. If you write to us through the site: your name, email address, company, and message.
Shipping information. Tracking numbers and the addresses of places you ship to, which we pass to carriers.
What we don't collect. Payment card numbers. We accept all payment methods, but payments are handled outside the app, so card details never pass through it. Your contacts, your other browser tabs, or anything from your device beyond what you deliberately enter, photograph, or allow.
2. Camera and location permissions
The scan screen asks your browser for camera access so it can read QR codes. Video from the camera is processed on your device to find a code; it is never sent to us or stored. If you deny camera access, you can type codes instead.
After you sign in, the app asks once for location access. If you allow it, your device's coordinates are attached to the moves you record on that device, so the history shows where a scan happened. If you deny it, we don't ask again on that device and no location is recorded. You can change either permission at any time in your browser's site settings.
3. How we use information
We use the information above to:
- run the warehouse and the app: receive, store, locate, and ship your goods, and show you where they are;
- keep an audit trail: every move is attributed to a named person so your organization knows who did what;
- sign you in and send you PINs and sign-in links by email;
- suggest destinations when you move items, based on your organization's own shows and history (suggestions are computed only from your organization's data, never from other customers');
- place your places and items on a map;
- respond when you contact us;
- protect the Service: rate-limit lookups, lock out PIN guessing, detect abuse;
- bill you and keep the records we're required to keep;
- comply with law and enforce our Terms.
We don't use your information for advertising, and we don't build profiles of individuals for any purpose other than the audit trail described above.
4. Photos
Photos uploaded to the app are stored with a file-storage provider at web addresses that are long and random, which is what keeps them private: anyone who has a photo's address can view it, without signing in. Addresses are shown only inside the app to people in your organization and to WareMap, and in CSV exports you request. We don't publish or index them. Even so, don't photograph anything confidential, and tell your Authorized Users the same.
Photos attached to a move are part of the permanent history and are kept as long as the move is (see §8). Photos taken in the scan screen but never attached to a move may remain in storage until we clear unattached files.
5. Cookies and on-device storage
We use one cookie, wm_session, which keeps you signed in for up to 30 days. It is strictly necessary for the app to work, and it contains only an identifier for your session, your organization, your role, and an expiry — never your PIN or email. There are no analytics, advertising, or third-party cookies on waremap.co or in the app.
The scan screen keeps the list of codes you've scanned, and any photos waiting to be attached, in your browser's temporary storage so that nothing is lost if your connection drops. That data stays on your device and is cleared when you clear the list or close the browser tab.
6. Who we share information with
Within your organization. Everyone in your organization can see its items, places, shows, moves, and photos, including the name of the person who recorded each move, the time, and (if shared) the location. Admins see this in the dashboard; PIN users see it on the scan pages and the items list.
WareMap. We can see every record for every customer. We need that to run the warehouse. We use it only to provide the Service, keep it secure, and meet legal obligations.
Other customers: never. Every record belongs to one organization and is only ever shown to that organization. If someone in another organization scans one of your labels, they see only that the label belongs to another organization — not your name, the item's name, or where it is. If you scan a label that isn't yours, you see the same.
Service providers. Companies that process data for us, under contracts that limit what they may do with it:
| Provider | What they do | What they receive |
|---|---|---|
| Vercel | Hosts the website and app | Everything that passes through the app; server logs |
| Neon | Hosts our database | All account, item, place, show, and move records |
| Cloudflare (R2) | Stores photos | Photo files |
| Resend | Sends our email | Recipient email addresses and the content of sign-in, PIN, and notification emails |
| OpenStreetMap / Nominatim | Turns addresses into map coordinates; serves map images | The street addresses of places you create (sent from our server when you save a place); when you view the map, your browser requests map images directly from the tile server, which sees your IP address |
All of these providers process data in the United States.
Carriers. When we ship your goods, we give the carrier (FedEx, UPS, or another you choose) the destination address and contact details for the shipment.
Our label printer. Receives only label codes and the web address each code opens. No customer or item information is ever on a label or sent to the printer.
Legal. We may disclose information if required by law, subpoena, or court order; to protect our rights, property, or safety or those of others; or to investigate fraud or abuse of the Service.
Business transfers. If WareMap is sold or merged, your information may transfer to the new owner, who will be bound by this policy for the information collected under it.
We do not sell personal information, and we don't share it with anyone for their own marketing.
7. If your organization added you to the app
A Customer admin can add people to its organization so they can scan labels. If that's you:
- Your organization decided to collect your name (and optionally your email) and to record the moves you make, with your name, the time, and — if you allow it — your location.
- Your organization is responsible for telling you that, and for its own rules about how it uses the app.
- Questions about why you're in the app, or requests to be removed from it, should go to your organization's admin first. They can deactivate you. We'll also help directly if you contact us (§10).
- Moves you've already recorded stay in the history (see §8), because the audit trail is the point of the app. On request we can replace your name on past moves with a neutral label.
8. How long we keep information
| Information | Kept |
|---|---|
| Items, places, shows, and people | While the Customer's account is open. Items can be retired and people deactivated, but their records remain for the history. |
| Moves and their photos | Permanently while the account is open. Moves are append-only: we don't edit or delete them. |
| Sign-in links | 15 minutes, or until used. |
| Failed PIN attempts | 24 hours. |
| Server logs | A few days, per our hosting provider's standard retention. |
| Contact-form messages | 2 years, or until you ask us to delete them. |
| Billing records | As long as tax and accounting law requires. |
When an account closes, we keep the records for 90 days so the Customer can request an export, then delete them, except for billing records and anything we must keep by law. Backups are overwritten on a rolling basis after that.
9. Security
The Service is served over HTTPS only. There are no passwords to steal: sign-in links are single-use and expire in 15 minutes, and PINs are stored only as a one-way code. Each organization's data is isolated from every other organization's at the database level. Access to production systems is limited to WareMap staff who need it. Uploads are limited to images.
No system is perfectly secure. If you believe your PIN or a sign-in link has been compromised, tell your admin or contact us and we'll reset it. If you find a security problem in the Service, please tell us at hello@waremap.co.
10. Your choices and rights
- See and correct your information. Customers can view and edit their records in the app. Anyone can ask us for a copy of the personal information we hold about them, or ask us to correct it.
- Export. Customers can export item and move records as CSV from the app, and can ask us for a full export.
- Delete. Customers can retire items and deactivate people in the app, and can close their account. Individuals can ask to be removed; see §7 for how the audit trail is handled.
- Location and camera. Controlled in your browser's site settings at any time.
- Email. Sign-in links, PINs, and notices about your account are part of the Service and can't be turned off while you have an account. We don't send marketing email.
To make a request, email hello@waremap.co. We'll respond within 30 days. We may need to verify that you are who you say you are, usually by replying from the email address on file.
U.S. state privacy laws. WareMap is a small business-to-business service and is generally not subject to laws such as the California Consumer Privacy Act. We honor the requests above for everyone regardless. We don't sell personal information or use it for targeted advertising, and we don't respond to browser "Do Not Track" signals because we don't track.
Outside the United States. The Service is offered in the United States and all data is processed here. If you use it from elsewhere, you understand your information will be transferred to and processed in the U.S.
11. Children
The Service is for businesses and their staff. It isn't directed to anyone under 18, and we don't knowingly collect information from anyone under 18. If you believe we have, contact us and we'll delete it.
12. Changes to this policy
We'll update this policy when the Service changes. The effective date at the top shows the current version. For changes that materially affect how we use information you've already given us, we'll email Customer admins at least 30 days before the change takes effect.
13. Contact
Mad Ventures, LLC (doing business as WareMap)
PO Box 1752
Traverse City, Michigan 49685
hello@waremap.co