WPI University — Privacy Policy

Last updated: 28 September 2026

WPI University is an internal sales-training application for employees and contracted sales representatives of Wholesale Payments, Inc. It is not available to the general public: sign-in is restricted to @wholesalepayments.com Google Workspace accounts.

What we collect

Only what a training record is made of.

We do not collect your Google password (we never see it — Google authenticates you and tells us only who you are), your location, your contacts, your advertising identifier, or anything from other apps. We never access your photo library or your camera ourselves. The app requests no device permissions beyond network access. Uploading a document opens your device's own file picker, which needs no permission: only the file you choose is sent, and the app gets no other access to your files. In the iPhone and iPad app, the picker offers documents only, never the camera. On the website and in the Android app it can also offer your photos: a photo is collected only if you choose to upload it as a document, and it is then stored like any other document.

The installation identifier, in full

The mobile apps can be updated in place, so a fix reaches you in hours instead of waiting in a review queue. To do that, the app asks our update service each time you open it whether a newer version exists.

That question includes an identifier for your installation of this app — not for you, and not for your phone as a whole. On iOS it is the identifier Apple gives an app vendor, which changes if you delete every Wholesale Payments app and reinstall. On Android it is a random value the app makes up the first time it runs and forgets when you uninstall. Alongside it go the app version, which update channel you are on, and your operating-system version.

It is not tied to your name, your email, or your training record. The update service is told nothing about who you are, and we do not send it anything that would let it work that out. It is used to decide which version to give you and for nothing else — not advertising, not analytics, not building a profile. This request happens even before we begin using in-place updates, because the update component is already built into the app.

What we do not do

• No advertising, and no advertising identifiers.
• No third-party analytics or tracking SDKs. There is no Firebase Analytics, no Crashlytics, no Facebook SDK, no attribution provider. The update service described above is not one of these: it is told an installation identifier and an app version so it can answer "is there a newer version", and it receives nothing about you or what you do in the app.
• No selling or sharing of personal information with anyone, for any purpose. The service providers listed under Where it lives run parts of the app for us, under contract and on our instructions; that is not selling or sharing, and none of them may use your data for their own ends.
• No profiling beyond showing your own training progress to you and to your manager.

Who can see your training record

• You, all of it.
• Your manager, for the people on their team: name, courses assigned and completed, overall progress, overdue count, and when you last signed in.
• Administrators, the same, across the company.

Access is enforced on the server for every request. A manager cannot see another team by changing anything in the app.

Documents

Documents is where each department keeps its files. An administrator decides which folders each department or role can open, and the server checks it on every request, downloads included.

• What you upload — and every later version of it — can be opened and downloaded by everyone who can open that folder, with your name shown as the uploader.
• Your comments are shown, with your name, to everyone who can open that document. You can delete your own; people who manage documents can delete any. If you can no longer open the document, email support@wholesalepayments.com and your comment will be deleted for you.
• Your stars are yours alone. Nobody else sees what you starred.
• Downloading a document saves it on your device through your browser or, in the app, through the system browser. We keep no record of what you downloaded beyond our hosting provider's ordinary request logs, and the app keeps no copy.
• Deleted documents and folders go to a Trash, where the people who manage documents can restore them. They are kept there for 30 days, then deleted for good (stored files included) within a day after that, along with their versions, comments and stars. Someone who manages documents can also delete them from the Trash for good before then. A record of who did what to them is kept, as set out under How long we keep it.

Where it lives

Your training record lives on Cloudflare infrastructure (Workers and D1) in the United States. Documents and their files are stored with Cloudflare too, under our own account. Training video is hosted there too, on Cloudflare Stream under our own account, and is played through links that expire; the courses we licensed from an outside provider are still served from Vimeo. Three other companies handle a narrow slice on our behalf:

Each is subject to its own privacy policy, and none of them receives your training record.

How long we keep it

Your training record is kept for as long as you have an account, and after you leave for as long as Wholesale Payments must be able to evidence that training was completed. If you delete your account, the record is detached from you at that moment and kept only in that pseudonymised form — apart from a count of the quiz attempts you had used, which is kept against a one-way fingerprint of your email address and is set out in full under Deleting your account. Documents and comments are kept until someone deletes them. A deleted comment is gone at once. A deleted document or folder is kept in the Trash for 30 days, then deleted for good (stored files included) within a day after that. Once it is, a record of the activity on it is still kept: its name, its size, and who uploaded, renamed, moved or deleted it, and when. Its contents, versions, comments and stars are not kept, and no record anywhere keeps what a comment said. Sign-in sessions expire after 12 hours. On the app, signing out removes the stored credential from your device immediately.

Deleting your account

You can delete your account from inside the app, without asking anyone: Settings → Delete account. It takes two steps and asks you to type the word DELETE, because it cannot be undone.

What is deleted, permanently and immediately:

• your name, email address and profile picture
• your team membership and your role
• the courses assigned to you
• your departments, and your comments and stars in Documents
• every signed-in session, including the device you are holding

What is kept, with your name removed:

• the training record itself — lessons watched, quizzes taken, achievements earned. It is detached from you rather than deleted, and kept as evidence that the training was completed, which Wholesale Payments must be able to show. Your name is removed from it and it is not used to identify you again, and reporting that counts people — team progress, for instance — no longer includes you. We call it pseudonymised rather than anonymous, and the difference is honest: the records still describe one person's activity, and somebody with direct access to the database and other information about you could in principle work out which. Nobody has any reason to, and nothing in the product does it.
• documents you uploaded to Documents. They are the company's, so they stay where they are for your colleagues, with your name removed from them.
• a dated security record that the account was deleted, including the email address it used. This exists so the deletion itself can be accounted for. The same security record keeps the changes an administrator made to your account — to your role, team, departments or document-editing permission — with what changed, who changed it, and when. It is kept apart from the training record.

What is kept against your address, without your name:

• how many quiz attempts you had used. For each quiz that limits attempts, which you had attempted and had not yet passed, we keep one number — how many attempts you had taken — stored against a one-way fingerprint of your email address rather than against the address. Quizzes with no limit keep nothing at all. The address itself is not kept. The fingerprint is a SHA-256 hash: it cannot be turned back into your address, only recomputed from an address and compared. It names the quiz, and a quiz belongs to a course, so it does say which courses you had quizzes outstanding on — that is unavoidable, because a cap has to know which quiz it is capping. It holds no name, no score, no answers, and no dates at all: not when you attempted, and not when you deleted your account. It used to hold the date of your last attempt, and that date is why there are no dates now — it was precise enough to pick your own detached training records out from everyone else's, so it was removed rather than blurred. A count is a far weaker signal than a timestamp, but it is not nothing, which is the honest reason this policy says pseudonymised and not anonymous.

A quiz you had already passed carries nothing forward at all: passing it is what the attempts were for, and the record of the pass is detached along with the rest of your training record, so the cap goes with it.

It exists for one reason: deleting your account must not be a way to retake a quiz you have run out of attempts on — unless you had already passed that quiz, in which case it starts over completely, because the record of your pass is detached along with everything else. Without it, deleting and signing in again with the same address handed you a fresh set of attempts, and a quiz result would stop being evidence of anything. That is all it does: the short wait between two attempts starts over on a new account, because keeping it would have meant keeping the date that made your records identifiable, and a fifteen-second wait is not worth that.

Deleting your account does not remove your Wholesale Payments Google account, and does not end your employment or contract. If you sign in again afterwards you get a new, empty account: your previous training history is gone from your side and cannot be restored, and any courses assigned to your role will be assigned again, with their deadlines starting over. The one thing that carries across is the attempt count above — a quiz you had no attempts left on and had not passed still has none.

If you would rather someone did it for you, or you want a copy of your data first, email support@wholesalepayments.com.

Your choices

• Signing out clears the credential from the device.
• Deleting the app removes everything the app stored locally. Your training record remains on the server, because it is a company record.
• Deleting your account — see the section above.
• Access or correction of your personal data: contact your administrator or email support@wholesalepayments.com. Employment records may be subject to retention obligations that limit what can be removed.

Children

The app is for employees and contractors. It is not directed at anyone under 16, and we do not knowingly collect data from children.

Security

• Google Workspace sign-in; we never handle your password.
• All traffic over TLS. The apps refuse cleartext connections outright.
• On the app, the sign-in credential is stored in the iOS Keychain, or on Android in app-private storage encrypted with a key held in the Android Keystore. It expires after 12 hours and can be revoked by an administrator at any time.
• Android backups are disabled for this app, so nothing it stores is copied to Google Drive.
• Session credentials are stored on the server only as a hash.

Changes

Material changes will be announced in the app and the date above updated.

Contact

support@wholesalepayments.com Wholesale Payments, Inc.