Privacy

What we collect

When you request a buyback quote we collect:

• Your name, email, and phone number.
• Your shipping or pickup ZIP (and full street address if you choose to ship the device).
• The device’s IMEI or serial number.
• The condition you reported (functional / screen / body grades).
• Your selected payout method and the account details for it (PayPal email, Cash App $cashtag, Venmo @handle, Zelle / Apple Pay identifier, or ACH bank + routing + account if you chose ACH).

We do not collect device photos or geolocation.

How we use it

• Quote & payment: to compute your offer, verify the device isn’t reported lost or stolen (IMEI lookup via CheckMEND), and pay you out via your selected method.
• Shipping: if you ship the device, your address generates one prepaid carrier label per order.
• Communication: confirmation emails, status updates, payment notification.

How we store it

• IMEIs and payout details are encrypted at rest using PostgreSQL pgcrypto. Plaintext is only decrypted on demand by the buyback operator, and every decryption is recorded in our audit log with the operator’s identity and timestamp.
• Application logs automatically redact 14–16 digit numeric strings to prevent IMEI leakage.
• We do not sell or share your data with third parties beyond the carriers and processors required to fulfill your buyback (CheckMEND for stolen-device check, EasyPost for shipping labels, Stripe for buyback operator billing, Resend for email).

Retention & auto-purge

IMEIs and payout details are automatically purged 12 months after quote creation. After that point they are wiped from our database (replaced with NULL) and a purge timestamp is stored on the lead record.

Other lead fields (your name, email, the offered price, status history) may be retained longer for tax, accounting, and dispute-resolution purposes, but are never used for marketing or shared.

Your rights

You can request, at any time:

• A copy of the data we hold about you.
• Correction of inaccurate data.
• Deletion of your data (“right to be forgotten”) — subject to the retention requirements above for completed buybacks.
• The name of the buyback operator who received your submission.

To exercise any of these, email [email protected] from the address you used to submit the quote, or contact the buyback operator directly.

Buyback operators

WerOrg powers branded buyback websites for independent mobile-phone resellers. The operator who owns the website you submitted on is the data controller for your submission; WerOrg is the data processor. If you’re unsure who that is, check the URL of the page you submitted from — the subdomain or custom domain identifies the operator.