Privacy Policy

DRX is a privacy-first operating system designed for independent regulated retail businesses. This policy explains how Wrelik Brands LLC ("Wrelik," "we," "us," or "our") collects, uses, encrypts, retains, and protects personal and business information when people visit our website or use DRX.

A subscribing business generally acts as the data controller or primary business steward for the retail customer, inventory, sales transaction, and workforce records its authorized operators enter into DRX. Wrelik processes those operational records to deliver the service in accordance with tenant configuration and applicable law. Wrelik separately determines the means and purposes of processing information required for platform security, infrastructure integrity, billing, legal compliance, and customer support.

Depending on the features an operator configures, DRX processes:

• Account and operator credentials: names, business email addresses, secure authentication identifiers, assigned roles (Owner, Manager, Supervisor, Cashier, Staff), system permissions, and audit logs.
• Business profile information: legal business name, store locations, time zones, functional currency, approved sales tax rates, and operational settings.
• Retail customer profiles: aliases, names, phone numbers, optional contact email addresses, delivery addresses, customer notes, purchase histories, store credit balances, and age-verification indicators when a merchant chooses to record them.
• Product and inventory records: SKU codes, barcodes, product titles, batch identifiers, unit costs, selling prices, stock quantities, receiving logs, count adjustment reasons, and category specifications.
• Sales and register transactions: cart line items, quantities, discounts applied, taxes collected, tender types (cash, third-party card, store credit), delivery fee allocations, refund and void records, and daily cashier drawer counts. DRX is not configured to store full payment-card primary account numbers (PANs) or CVVs.
• Device, network, and diagnostics: app build version, device model, operating system version, anonymized IP-derived network metadata, crash logs, and error traces. The Android and iOS apps do not access precise GPS background location.
• Communications and SMS details: support requests, feedback, contact details (including mobile phone numbers), communication preferences, and text messaging consent records when you opt in to receive SMS or other communications.

We use the information we collect and process to:

• Provide, operate, synchronize, maintain, and improve DRX features across web and mobile platforms;
• Authenticate users, issue secure session tokens, and strictly enforce tenant isolation, business boundaries, and role permissions;
• Process inventory changes, sales transactions, store credit balances, deliveries, financial summaries, and merchant-directed workflows;
• Support encrypted offline register caching and reconcile approved offline sales batches upon network reconnection;
• Send requested transactional notifications, account security alerts, delivery updates, operational notices, and relevant communications (including text messages where express opt-in consent is obtained);
• Measure aggregate platform reliability, diagnose system defects, prevent fraud or unauthorized access, and protect the security of our infrastructure;
• Respond promptly to merchant customer support inquiries and data privacy requests;
• Comply with applicable legal mandates, tax compliance guidelines, court orders, and enforce our service agreements; and
• Execute automated data retention cleanup protocols according to merchant-configured policies.

Our native mobile applications adhere strictly to the Apple App Store Review Guidelines and Google Play Developer Program Policies:

• Device permissions:
  • Camera: Used solely when the operator taps the camera scan button to read a physical product barcode. Barcode scanning processes image data locally in memory; camera frames are never recorded, saved, or transmitted to external servers.
  • Push notifications: Used only with explicit user permission to send critical operational alerts, delivery handoff notices, and security warnings. Notification permissions can be toggled off anytime in operating system settings.
  • No precise GPS location: DRX does NOT request, collect, or monitor continuous or background GPS location.
• Financial services disclaimer (Google Play policy): DRX is an enterprise business operations platform and point-of-sale register system. DRX is NOT a personal loan provider, payday loan app, peer-to-peer money transmitter, or consumer credit broker. Customer store account ledgers represent internal merchant credit lines between a store and its patrons.
• Account deletion capability (Apple Guideline 5.1.1(v)): Store owners and operators can request complete deletion of their account and associated personal data directly through the application settings or by emailing privacy@deelrxcrm.com. Deletion removes operator credentials, profile records, and active sessions within 30 days.

• Consent and opt-in: We require verifiable express consent prior to sending SMS notifications. Consent is logged with timestamp, user identity, and opt-in medium.
• Standard keywords: Recipients can reply STOP to immediately cancel text communications, or HELP for customer support instructions.
• Rates and carriers: Message and data rates may apply. Message frequency varies based on store activity and notification preferences. Wireless carriers are not liable for delayed or undelivered messages.

Wrelik employs multi-layered administrative, technical, and cryptographic defenses to safeguard retail business data:

• Encryption in transit: All network traffic between web browsers, iOS devices, Android devices, and DRX cloud infrastructure is enforced over TLS 1.3 using strong cipher suites with forward secrecy. HTTP connections automatically redirect to HTTPS.
• Encryption at rest: All databases, cloud data volumes, and system backups are encrypted at rest using AES-256 encryption.
• Field-level encryption: Sensitive data attributes—such as customer contact details, delivery drop-off addresses, and authentication tokens—receive field-level cryptographic protection before writing to persistent database storage.
• Multi-tenant isolation: DRX enforces server-side tenant scoping at the database query and mutation layer. Every data operation verifies the authenticated user's active business membership and assigned role. Cross-tenant queries are architecturally barred.
• Protected mobile & offline storage: On mobile devices, session credentials reside in secure platform keychains (iOS Keychain and Android EncryptedSharedPreferences). Approved offline register caching utilizes an encrypted SQLCipher database.
• In-store screen privacy: Cashier registers feature an optional Screen Privacy mode that masks customer account balances and phone numbers to prevent shoulder surfing by in-store shoppers.

DRX provides an automated Privacy Protocol engine designed to prevent the indefinite accumulation of customer records:

• Alias Mode: Collects minimal customer aliases. Inactive records qualify for permanent deletion after a default of 30 days of inactivity.
• Standard Mode: Allows optional customer contact details. Inactive records qualify for permanent deletion after a default of 180 days.
• Full Customer Mode: Retains comprehensive customer records. Inactive records qualify for permanent deletion after a default of 365 days.

When retention cleanup executes, qualifying records are permanently hard-deleted from active production tables. Cleanup automatically skips customer records with an active positive credit balance or an unresolved operational dispute. Encrypted rotation backups cycle out according to scheduled disaster-recovery lifecycles.

Wrelik Brands LLC respects constitutional and statutory privacy rights while complying with lawful government process:

• Legal process standard: We disclose business or customer records to government agencies or law enforcement only upon receipt of valid, legally binding legal process—such as a search warrant, court order signed by a judge, or formal grand jury subpoena issued by a court of competent jurisdiction. We scrutinize every request for statutory validity, jurisdiction, and overbreadth, and challenge unlawful or overreaching demands.
• Notice to affected businesses: Unless strictly prohibited by a court-ordered gag order, statutory non-disclosure requirement, or verified emergency involving imminent death or physical harm, our policy is to provide prompt written notice to the affected business owner before disclosing records, allowing them an opportunity to seek protective judicial relief.
• Zero-knowledge and data we DO NOT have access to share:
  • No payment card numbers: DRX does not store credit card numbers, CVVs, or magnetic stripe data. We cannot produce payment card details because we do not possess them.
  • No plain-text passwords: User passwords are salted and hashed using strong cryptographic hashing algorithms. We have no access to plain-text passwords.
  • No uncollected customer data: In Alias Mode, merchants record only an alias (such as "Customer 104"). Wrelik cannot produce legal names, government IDs, or phone numbers that were never entered.
  • No deleted records: Once records are purged via retention cleanup or merchant deletion, they are hard-deleted from production storage. We cannot reconstruct or produce permanently destroyed records.
  • No banking deposits: We are not a bank and do not hold merchant funds, escrow accounts, or consumer deposits.

Security is a shared responsibility between Wrelik and your retail crew. We strongly advise store owners to enforce these operational security best practices:

• Enforce individual operator logins: Never share an owner password or master manager PIN. Give each cashier and supervisor their own account so audit trails remain distinct and accountable.
• Apply least-privilege roles: Assign cashiers only POS register permissions. Restrict financial reports, inventory cost editing, and customer deletion to trusted managers and owners.
• Enable Screen Privacy: Turn on Screen Privacy in Settings during retail shifts so shoppers standing at the counter cannot view customer balances or phone numbers.
• Lock counter devices: Configure iPads, tablets, and POS terminals to auto-lock after brief inactivity, and train staff to lock registers when stepping away.
• Conduct daily offline exports: Export reconciliation CSVs from Reports at the close of every business day and store them in secure, encrypted, offline storage.
• Immediate staff offboarding: When an employee departs, immediately remove their account in Manage Team to revoke access across all devices instantly.

Depending on your jurisdiction (including California, Colorado, Connecticut, Virginia, Utah, and other states), you may have statutory rights regarding your personal information:

• The right to know what personal information is collected, used, and disclosed;
• The right to request deletion of personal information;
• The right to correct inaccurate personal information;
• The right to non-discrimination for exercising privacy rights; and
• The right to opt out of the sale or sharing of personal information (note: Wrelik does NOT sell or share personal data for cross-context behavioral advertising).

To exercise privacy rights regarding a Wrelik-administered account, submit a request to privacy@deelrxcrm.com. For retail customer records held by a subscribing store, retail patrons should submit requests directly to the store where they made purchases.