Privacy Policy

1. Information We Collect

a. Information from Customers

When you create and use a Waitloop account, we collect:

• Account details — your name, email address, password (stored only as a salted hash), and email-verification status.
• Security settings — if you enable two-factor authentication, the information needed to support it, and, if you sign in with Google or GitHub, the unique account identifier and email address from that provider.
• Billing information — your plan, subscription status, and customer/subscription identifiers held by our payment processor. Payment card details are entered with and handled by our processor; Waitloop never receives or stores full card numbers.
• Configuration & content — the lists, forms, settings, email templates, allowed domains, and integration details (such as a notification webhook) that you create.
• Usage and diagnostic data — submission counts, storage used, log and audit records of actions taken in your account (for example sign-in events, exports, and configuration changes), together with the IP address and browser/device information associated with those actions.

b. Information from Signups (collected on behalf of Customers)

When a person submits a form or joins a waitlist that a Customer runs with Waitloop, we process the data on the Customer's instructions. This can include:

• Form field data — whatever fields the Customer's form requests, which commonly includes an email address and name, and may include other details such as company, phone number, or answers to custom questions.
• File attachments — files (such as images) that a Signup uploads through a form, where the Customer has enabled uploads.
• Submission metadata — technical information automatically recorded with a submission, such as the referring and page URL, marketing campaign (UTM) parameters, a timestamp, browser/device information, and a non-reversible (hashed) representation of the submitter's IP address used for security and de-duplication.

c. Information collected automatically on our website

When you visit our public website, our servers and infrastructure providers process limited technical data — such as IP address, browser type, and pages viewed — to deliver and secure the site. See our Cookies Policy for details on local storage and similar technologies.

2. How We Use Information

We use personal data to:

• provide, operate, and maintain the Services, including capturing and displaying submissions;
• create and secure accounts, authenticate sign-ins, and prevent fraud, spam, and abuse;
• process payments and manage subscriptions;
• send transactional and service messages, such as email verification, password resets, security alerts, team invitations, and notifications you have configured;
• provide analytics and reporting to Customers about their own lists;
• respond to support requests and communicate with you; and
• comply with legal obligations and enforce our terms.

For Signup data, we only use it to provide the Services to the Customer and do not sell it or use it for our own advertising.

3. Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Services to Customers); legitimate interests (to secure, improve, and operate the Services, where not overridden by your rights); consent (where required, for example for certain cookies or optional communications); and legal obligation (to comply with applicable law). For Signup data, the Customer is responsible for establishing a lawful basis for collection.

4. How We Share Information

We do not sell personal data. We share it only as needed to run the Services:

• Sub-processors — vendors who process data on our behalf under contract (see Section 5).
• At a Customer's direction — for example, delivering submissions to a Customer's own webhook, Slack workspace, or analytics property that the Customer has chosen to connect.
• Legal and safety — where required by law, or to protect the rights, property, or safety of Waitloop, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Sub-processors

We use a limited number of trusted third-party service providers ("sub-processors") that process personal data on our behalf, under contract and only as needed to run the Services. They fall into these categories: cloud hosting and storage, email delivery, payment processing, video conferencing for coaching sessions, bot and spam protection, and optional single sign-on. Each processes only the data required for its function, and we remain responsible for their handling of the data.

Customers may also choose to connect optional third-party destinations (such as their own Slack workspace, webhook endpoint, or analytics property). Data sent to those destinations is governed by the third party's own terms and privacy policy.

6. International Data Transfers

We and our sub-processors may process data in countries other than your own. Where we transfer personal data internationally, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (or equivalent mechanisms) to protect that data.

7. Data Retention

We keep personal data only as long as needed for the purposes described in this Policy:

• Customer account data is retained while your account is active and for a reasonable period afterward to meet legal, accounting, and security needs.
• Submission data is retained according to the retention setting chosen by the Customer (for example, automatic deletion after 30, 60, or 90 days, or kept until deleted). Attachments are deleted together with their submission.
• Security and audit logs are retained for a limited period to protect the Services, after which they are deleted or archived.

8. How We Protect Data

We apply administrative, technical, and organizational measures designed to protect personal data, including encryption of data in transit (HTTPS/TLS), encryption of sensitive personal fields at rest, access controls, and audit logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any incident.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights for a Waitloop account, contact us using the details in Section 15. We will not discriminate against you for exercising your rights. You also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of your personal information, to correct inaccurate personal information, and not to be discriminated against for exercising your rights. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA. We also do not use or disclose sensitive personal information beyond the purposes permitted by the CCPA. To exercise your rights, contact us at support@waitloop.io; you may also use an authorized agent to submit a request on your behalf.

Customers can export their account and list data, and can delete a specific person's submissions, directly from the dashboard's Data & Privacy settings.

10. Notice for Signups

If you submitted a form or joined a waitlist operated by a business using Waitloop, that business — not Waitloop — decides what data to collect and how to use it, and is the controller of your data. To access, correct, or delete your information, please contact that business directly. We will assist our Customers in responding to such requests, including by deleting a person's data on the Customer's instruction.

11. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us so we can delete it.

12. Cookies & Tracking

Our websites and dashboard use a limited set of cookies and similar technologies (including browser storage used to keep you signed in). For full details, see our Cookies Policy.

13. Coaching, Masterclass & Meta Lead Ads

In addition to the Waitloop Services, the maker of Waitloop offers live coaching and training — including the Vibe Code Masterclass, 1-on-1 build and rescue sessions, and multi-week MVP and mobile-app sprints (together, the “Coaching Services”). We advertise the Coaching Services on Facebook and Instagram, and we may collect your information through Meta Instant Forms (lead ads) shown on those platforms. For this data, Waitloop is the data controller. This section explains what we collect and how we use it.

a. What we collect

• Booking details you give us on our website when you book a session: name, email address, phone number, what you want to build, your experience level and goals, your chosen date, time and timezone, and your PayPal transaction reference. PayPal processes your payment; we do not see your card or bank details.
• Contact details you submit in the form: name, email address and phone number (some fields may be pre-filled by Meta from your profile and can be edited before you submit).
• Your answers to the form questions — for example what you are building, where you are in the process, and what you want from a first call.
• Ad context that Meta passes to us with the lead: which ad, ad set and campaign you responded to, the platform (Facebook or Instagram) and the submission time.

We do not receive your Facebook or Instagram password, private messages or friends list through lead ads. Meta’s own handling of your data is governed by the Meta Privacy Policy.

b. How we use it

• To contact you by email, phone or text about the Coaching Services you asked about, schedule a call and prepare for it using your answers.
• To deliver and administer the Coaching Services you purchase (scheduling, session materials, invoices and receipts).
• To run your session over a video-call service such as Google Meet or Zoom and, only where you have agreed in advance, to record it for your personal use.
• To send you follow-up information about the same or related Coaching Services. You can opt out at any time by replying “stop” or using the unsubscribe link in any email.
• To measure and improve our advertising, in aggregate (for example, which ad or offer generated a lead). We may share hashed conversion information back to Meta for this purpose.

c. Legal bases

Where GDPR / UK GDPR applies, we rely on your consent (given when you submit the form), contract (to provide Coaching Services you buy) and our legitimate interests in marketing and improving our services, balanced against your rights.

d. Sharing, retention and your choices

• We do not sell your information and we do not share it for cross-context behavioral advertising. We share it only with service providers that help us run the Coaching Services (for example scheduling, email, payment and video-call providers) under contracts that restrict their use of your data, and with Meta as described above.
• We keep lead-ad and booking data for up to 24 months from your last interaction with us, or longer if you become a customer or the law requires it, and then delete or anonymize it.
• Session recordings, if any, are kept for up to 30 days and then deleted.
• You may ask us to access, correct or delete your lead-ad or booking data, or to stop contacting you, at any time by emailing support@waitloop.io. Your other rights are described in Section 9.

The Coaching Services are offered to adults (18+); we do not knowingly collect lead-ad or booking data from anyone under 18.

14. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you. Your continued use of the Services after an update means you accept the revised Policy.

15. Contact Us

If you have questions about this Policy or how we handle your data, contact us at: