Security & Privacy at WKB

• Buyer accounts require email and password sign-in.
• New buyer accounts are reviewed before gaining access to wholesale pricing and ordering.
• Admin functions are restricted by server-side role checks; the client cannot grant itself elevated permissions.
• Password resets are performed via a verified email link.

• Wholesale unit prices, SKUs, and minimum order quantities are hidden from visitors who are not signed in.
• Approved buyers see pricing only after login. Public catalog pages show product name, brand, and descriptive information.

• Traffic to the application is served over HTTPS.
• Database access is gated by row-level security policies so each account can only read and modify its own data.
• Payment proofs, identity documents, and other uploaded files are stored in private buckets and are not publicly browsable.
• Sensitive operations (admin actions, role changes, order modifications) are validated on the server, not on the client.

The application runs on the Lovable Cloud platform, which provides managed hosting, database, authentication, and storage. Lovable Cloud capabilities are a shared responsibility: WKB configures and uses these capabilities; the underlying infrastructure is operated by the platform provider.

• Account details you provide at registration (name, company, contact information, business profile).
• Orders, saved products, and addresses you create.
• Operational logs needed to run the service and investigate issues.

To request a copy of your data, correction of inaccurate information, or deletion of your account, contact us at the email address below. We will respond within a reasonable timeframe.

If you believe you have found a security vulnerability in WKB, please email hello@wkb.com with details and steps to reproduce. Please do not publicly disclose the issue until we have had a chance to investigate and remediate.