WEBRA Mobile App Privacy Policy

Version dated 01.10.2026

1. Who we are

WEBRA SYSTEMS LLC (ТОВ «ВЕБРА СІСТЕМС»), company code (EDRPOU) 44673938, address: 5 Pecherskyi Uzviz, office 109, Kyiv, Ukraine (hereinafter "WEBRA", "we") — the developer of the WEBRA cloud B2B platform and the WEBRA mobile application.

For some contracts, the operator is sole proprietor (FOP) Akim Ametov. In each specific case, the operator is the party to the contract concluded with your supplier.

Contact for data processing matters: support@webra.cloud

This document describes what data is processed when the WEBRA mobile application is used, for what purposes, to whom it is disclosed, and how it can be managed.

2. Roles in data processing

The application is not a standalone service. It connects to the B2B portal of a supplier — the wholesale company your business purchases from. The portal address is entered at sign-in.

The roles are allocated as follows:

• the supplier whose portal is used determines the scope and purposes of data processing; the supplier owns the user accounts, contracts, orders, and documents on its portal;
• WEBRA provides the supplier with software and infrastructure and processes data on the supplier's instructions.

Questions about the content of data, prices, contracts, and documents should be addressed to the supplier. Questions about the operation of the application should be addressed to WEBRA.

The user works in the application as an employee or representative of a purchasing business (counterparty). Some data relates to the user personally: full name, phone number, email address, and device details. Other data relates to the business: orders, invoices, delivery notes, and mutual settlement records. The data deletion procedure is described in Section 8.

If the user works with several suppliers through one application, the data of each account is processed separately and is not shared between suppliers.

3. What data is processed

3.1. Account data. Full name, email address, phone number, position or role, link to the counterparty and contracts, supplier portal address, interface language. Provided by the user at sign-in or registration, or created by the supplier.

3.2. Device data. Device model, operating system version, application version, push notification identifier, application installation identifier, IP address, date and time of last activity. This data is available to the supplier's portal administrator in the mobile device management section and is used for access control.

3.3. Usage data. Shopping cart, placed orders, order history, catalog sections viewed, access to documents and reports.

3.4. Delivery data. When placing an order, the user specifies the delivery method, address or pick-up branch, and recipient details: name and phone number, and where required, the organization name and its company code (EDRPOU). This data forms part of the order and is transferred to the supplier.

Directories of carriers' cities and branches are loaded into the application from the carriers' public directories; no personal data is transferred to carriers in the process.

3.5. Uploaded content. Files and photos attached to an order: payment orders, powers of attorney, product photos. They are transferred to the supplier's portal and are available to its staff.

3.6. Camera access. Requested for scanning product barcodes and photographing order attachments. During barcode scanning, recognition is performed directly on the device: the image is not stored or transmitted; only the code is read.

3.7. Application crash data. When the application crashes, a technical report is generated: error type, location in the program code, device model, operating system version, and application version.

Crash reports contain no personal data of the user: transmission of the name, email address, IP address, and other identifying details is disabled. Reports are processed on WEBRA's own infrastructure and are not disclosed to third parties.

3.8. Processing limitations. The application does not collect data for advertising, does not track user activity in other applications or on websites, does not use advertising identifiers, and does not transfer data to advertising networks. No web analytics or behavioral analysis systems are used in the application.

4. Purposes of processing

• providing access to the personal account and the catalog under the terms established by the contract;
• receiving, processing, and supporting orders;
• generating and issuing documents: invoices, delivery notes, mutual settlement reports;
• transferring to the supplier the delivery details required to dispatch the order;
• sending notifications about orders and their statuses;
• technical support, diagnostics, and troubleshooting;
• ensuring access security and preventing abuse;
• storing order history and documents on the supplier's instructions.

5. Legal bases for processing

• performance of the contract between the user's business and the supplier;
• consent — for optional notifications and camera access; consent may be withdrawn in the application or device settings;
• legitimate interest — ensuring the security and operability of the service.

With respect to portal data, WEBRA acts as a processor on the supplier's instructions; the legal basis for processing such data is determined by the supplier.

6. Who data is disclosed to

6.1. The supplier whose portal is used — in full, since the supplier is the counterparty of the user's business, including delivery and recipient details.

Further use of this data is determined by the supplier: in particular, to dispatch an order, the supplier itself transfers the recipient details to the chosen delivery service. Such transfer takes place outside the application and outside the WEBRA platform.

6.2. Google LLC — for the delivery of push notifications. The Firebase Cloud Messaging service receives the push notification identifier, application installation identifier, device model, and operating system version; without this, notification delivery is technically impossible.

The Google ML Kit component is used for barcode recognition: recognition is performed on the device; on first use, a recognition model is downloaded from Google servers.

6.3. The infrastructure provider: servers are located in a data center in Frankfurt, Germany; the service provider is DigitalOcean, LLC.

WEBRA does not sell user data and does not disclose it to third parties for advertising purposes.

7. Retention periods

• account data — for as long as the account is active, and thereafter in accordance with Section 8;
• device data — for as long as the account is active, and thereafter in accordance with Section 8;
• technical logs and crash data — 6 months;
• orders, invoices, delivery notes, and mutual settlement records — the retention period is determined by the supplier, who owns this data; deletion of the user's account does not affect it.

8. Account deletion

The account can be deleted in two ways:

• in the application: Profile → Delete account;
• via the web form at webra.cloud/account-deletion — without installing the application.

Deleted: the account and portal access, the user's personal data (full name, phone number, email address), push notification identifiers, linked devices, notification settings.

Retained: orders, invoices, delivery notes, sales records, returns, and mutual settlement records.

These documents relate to the purchasing business, not to the user personally: the user works in the portal as an employee or representative of the business. Deleting the account terminates the user's personal access but does not affect the business's documents. The decision on their retention is made by the supplier — the owner of the portal data.

Personal data included in such documents — for example, the name of the order author, or the recipient's name and phone number — is retained within them as part of the transaction record.

Requests are fulfilled within 30 days.

If the user has several accounts with different suppliers, deletion applies only to the account specified in the request.

9. User rights

The user has the right to obtain information about the data being processed, to request its correction or deletion, to restrict processing, to withdraw consent, and to lodge a complaint with a supervisory authority.

Since the supplier acts as the controller of the portal data, requests are fulfilled faster when addressed to the supplier. If this is not possible, the request should be sent to support@webra.cloud — WEBRA will forward the request and follow up on its fulfillment.

10. Security

Data transmission between the application and the portal is protected by HTTPS/TLS encryption. Access to data within the portal is segregated by roles and permissions configured by the supplier. Actions are recorded in the portal logs. The application does not store the user's password on the device in plain text.

11. Children

The application is intended for professional use in wholesale trade and is not addressed to persons under 18 years of age. Children's data is not knowingly collected.

12. Changes to this policy

In the event of material changes, the document is updated with a new version date. If the changes affect the scope or purposes of processing, users are notified in the application or by email.

13. Contacts

WEBRA SYSTEMS LLC (ТОВ «ВЕБРА СІСТЕМС»)
5 Pecherskyi Uzviz, office 109, Kyiv, Ukraine
Company code (EDRPOU) 44673938
Email: support@webra.cloud
Phone: +38 (067) 840 00 14
Website: webra.cloud