Privacy Policy

wavelymedia.com (the “Site”) and our related services are owned and operated by Wavely Media LLC (“Wavely Media,” “we,” “us”). Wavely Media is the data controller for the personal data described in this Privacy Policy.

This policy explains what personal data we collect, how we use it, who we share it with, the rights you have, and how we use cookies.

It applies in addition to our Terms & Conditions.

For users in the European Union and European Economic Area, we process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”). For users in the United Kingdom, we process personal data in accordance with the UK GDPR as set out in the Data Protection Act 2018.

We have not appointed a Data Protection Officer because we do not fall within the categories of controllers and processors required to appoint one under Article 37 of the GDPR.

By using the Site, you agree to the terms of this Privacy Policy.

Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not make processing carried out before the withdrawal unlawful.

You can withdraw consent through the cookie banner “Preferences,” the unsubscribe link in any email or SMS, your account or app settings (including push notification settings on your device), or by emailing [email protected].

For users in the EU and UK, we process personal data only when we have a legal basis to do so under Article 6 of the GDPR. We rely on:

Consent

You have agreed to the processing for one or more specific purposes.

Legitimate interests

Operating and improving the service; security, fraud prevention and abuse detection; debugging and error logging; measuring performance and reach; non-essential analytics where permitted; internal reporting; and enforcing our Terms. We rely on these interests only where they are not overridden by your rights and freedoms.

Contract

Processing is needed to take steps at your request before entering a contract, or to perform a contract with you. Without this data we may be unable to create your account, deliver requested features (including personalized content and notifications), or provide support.

Legal obligation

Processing is needed to meet legal duties such as recordkeeping, tax and accounting, responding to lawful requests, and honoring opt-out requests.

We collect only the data that helps us achieve the purposes in this policy, and we will notify you before collecting any other data.

Collected automatically

Device and log data

IP address, approximate location, hardware and software details, URLs, request headers, timestamps, status codes, and error or crash reports.

Usage data

Pages, screens and videos viewed, links clicked, on-site searches, feature interactions, and session length.

Security data

Sign-in events, failed logins, rate-limit signals, risk indicators, and hashed tokens.

Performance data

Load times, latency, connection type, bandwidth, and caching metrics.

Push notification tokens

Collected if you enable notifications, so we can send the alerts you request.

Analytics and integrations

Aggregated usage metrics, cookie or device identifiers (where allowed), referrer and campaign parameters (such as UTM tags), and event IDs from integrated services such as video players, hosting and error monitoring.

Provided by you

Depending on how you use the Site, this may include your first and last name, age, date of birth, sex, email address, phone number, postal address, and autofill data. We collect it when you:

• Request access or create an account
• Contact us or ask for support
• Apply to work or contract with us (for example, by sharing a resume or portfolio)
• Submit tips, comments or media where those features are available
• Respond to surveys or feedback requests
• Email or message us directly

We use personal data only for the purposes described in this policy or shown on the relevant pages of the Site:

• Provide, operate and support the Site and its features, and deliver content reliably and quickly
• Personalize content, recommendations and alerts to your settings and activity
• Send non-marketing service notifications (for example, “task completed”) to users and teams who have opted in
• Process work emails routed to us with AI tools to classify, summarize and extract action items, and send the chat notifications you request
• Produce aggregated statistics and analyze trends and feature performance
• Diagnose, troubleshoot and fix errors and performance issues
• Protect accounts and systems, verify identity, and prevent spam, scraping, fraud and abuse
• Research and improve our features using testing and de-identified or aggregated data
• Keep records, comply with the law, respond to lawful requests, manage opt-outs, and enforce our Terms

Our team

Members of our organization who reasonably need access to personal data to achieve the purposes in this policy.

Service providers

We use trusted third-party service providers for hosting and content delivery, authentication, cloud storage, analytics, error monitoring, security and fraud prevention, email and messaging, video embeds, and AI features. They receive only the data reasonably necessary for their service, such as device and usage data, performance and error logs, approximate location, identifiers, support messages and contact details, and, for AI features, the email metadata and excerpts you route to us for processing.

SMS and mobile data

Mobile numbers and SMS opt-in data are used only to deliver the messages you have agreed to receive. We do not share, sell, rent or disclose mobile phone numbers or SMS opt-in data to any third parties or affiliates for marketing, promotional or advertising purposes. SMS opt-in information is provided to a third party only as strictly required to deliver the SMS service (currently our SMS gateway provider, Twilio), under contractual confidentiality obligations. You can opt out at any time by replying STOP to any message or by emailing [email protected].

Other disclosures

We will not otherwise sell or share your data with third parties, except:

• When required by law or for a legal proceeding
• To establish or protect our legal rights
• To buyers or potential buyers if we seek to sell the company

If you follow a link from our Site to another website, we are not responsible for that website's privacy policies or practices.

We keep user data for twenty-four (24) months. We also apply category-based limits, for example: server logs about 90 days; analytics 14–26 months; support records about 24 months; and backups 30–90 days, unless the law requires longer. We will notify you if we keep your data longer than this.

AI providers may keep the inputs and outputs of our requests for a limited period under their own terms. For example, OpenAI may retain API inputs and outputs for up to 30 days for service operations and abuse detection, then deletes them unless the law requires longer. This does not change our own retention periods.

We use industry-standard safeguards, including encryption in transit and at rest, access-controlled infrastructure, threat monitoring, and regular audits. Access is limited to authorized personnel bound by confidentiality agreements; breaches of those agreements result in termination. We comply with applicable U.S. data protection laws.

No system is completely secure. While we take reasonable precautions, we cannot guarantee the security of data sent over the internet beyond what is reasonably practical.

We store data in the United States. Authorized personnel or providers may access or process data from Canada, the Philippines, Ukraine, the United Kingdom and Ireland. We will update this list if those locations change. Wherever data is transferred, we protect it as described in this policy and comply with applicable transfer requirements.

If you are in the EU or UK, we transfer your personal data only if:

• The destination country has been found to provide adequate data protection by the European Commission or, for the UK, under UK adequacy regulations; or
• Appropriate safeguards are in place, such as binding corporate rules, the EU Standard Contractual Clauses, or the UK International Data Transfer Addendum (or another approved mechanism).

EU and UK (GDPR / UK GDPR)

You have the right to be informed, and the rights of access, rectification, erasure, restriction of processing, data portability, and objection. We respond to these requests within one month, which may be extended where the law permits.

U.S. state privacy rights

Depending on your state (for example CA, CO, CT, DE, IA, MD, MN, MT, NE, NH, NJ, OR, TN, TX, UT or VA), you may have the right to know about and access, correct, and delete your personal data, and to opt out of certain processing such as targeted advertising, sale, or profiling for significant decisions. To exercise these rights, email [email protected]. We will verify your request and respond within the time the law requires. You may use an authorized agent where permitted.

We do not use automated decision-making that produces legal or similarly significant effects. We may use profiling for convenience features, such as content recommendations or email classification; you can object at any time by emailing [email protected].

We will not discriminate against you for exercising your privacy rights.

Appeals

If we deny your request, you may appeal by replying to our decision or emailing [email protected] with “Appeal” in the subject line. If you remain unsatisfied, you may contact your state attorney general.

Our services are intended for adults, and our internal platform is for authorized Wavely Media employees and contractors only. We do not direct our services to children and do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it promptly.

To find out whether we hold your personal data, how we have used it and who we have disclosed it to, or to have it corrected or deleted or exercise any other right, contact the Wavely Media Privacy Team at [email protected]. We may ask for information to verify your identity and, if you use an agent, proof of their authorization.

In addition to contacting us, you can opt out of specific collection and uses:

Push notifications

Turn off notifications in your device settings or in your app or account settings.

Cookies and analytics

Use the cookie banner “Preferences” or your browser settings.

Third-party embeds

Use the provider's privacy controls or block third-party cookies in your browser.

A cookie is a small file a website stores on your device to remember information about your visits. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them. We use:

Essential cookies

Required for the Site to work, including sign-in, sessions, security and anti-fraud protection, and load balancing. These cannot be turned off through the cookie banner.

Functional and preference cookies

Remember your choices, such as language, region, theme, autoplay and accessibility settings, across visits.

Analytics and performance cookies

Measure traffic, pages viewed, session length and referrers so we can improve the Site. Manage these in the cookie banner or your browser.

Third-party cookies

Set by our providers (such as video embeds like YouTube, content delivery, analytics and security services) to deliver content, measure usage, improve performance and protect the service.

You can set your browser to notify you when a cookie is set or to block cookies entirely, but some parts of the Site may not work as well.

We do not respond to browser “Do Not Track” signals. Where required by law, we honor Global Privacy Control (GPC) signals as an opt-out of certain processing, such as targeted advertising or “sharing.”

We may update this Privacy Policy to stay compliant with the law and to reflect changes in how we collect data. When we do, we will update the “Last updated” date at the top of this page and, where appropriate, notify users by email. Please review this policy periodically.

If you have a complaint about how we handle your personal data, please contact us first so we can try to resolve it. If you are not satisfied with our response, or at any time, you may complain to a supervisory authority: in the UK, the Information Commissioner's Office (ICO); in Ireland, the Data Protection Commission (DPC); or the authority in the EEA country where you live or work, or where the issue occurred.