Privacy Policy

Last updated: September 6, 2026

1. Information We Collect

WAVE Platform collects and processes the following types of information:

• Account Information: Email, name, profile data
• Usage Data: Streaming metrics, viewer analytics, engagement data
• Technical Data: IP addresses, device information, browser type
• Payment Information: Processed securely through Stripe (we do not store card details)
• Financial Account Data: When you connect a bank account via Stripe Financial Connections, we may access tokenized account and routing numbers, account balances, transaction history, and account ownership details
• Creator Payout Information: Bank account details for receiving creator earnings payouts via ACH transfer
• Card Program Data: If you participate in our creator card program (Stripe Issuing), we process card transaction data, spending limits, and merchant information

1A. Financial data we access via Stripe Financial Connections

When you link a financial account through Stripe Financial Connections, we may access:

• Tokenized account and routing numbers: Used to initiate ACH payouts, pay-ins, and top-ups to your account
• Account balances: Used to verify sufficient funds before initiating transactions and to prevent failed payments
• Transaction history: Used for financial management features and underwriting assessments
• Account ownership details: Used to verify that the bank account belongs to you, helping prevent fraud

This financial data is stored exclusively in the United States. We do not share this data with third parties except as required to process your transactions through Stripe. You can revoke access to your linked financial accounts at any time through your WAVE dashboard settings.

2. How We Use Your Information

• Provide and improve our streaming services
• Process payments and maintain accounts
• Send important service notifications
• Analyze platform usage and optimize performance
• Ensure security and prevent fraud
• Comply with legal obligations

3. Data Security

We implement security measures:

• Built on SOC 2 Type II compliant infrastructure (Cloudflare, Supabase, Stripe)
• TLS 1.3 for all data in transit
• Row-level security on all database tables
• Regular security audits and automated application security testing (SAST, software composition/dependency analysis, and secret scanning) across our code repositories
• GDPR/CCPA alignment and HIPAA-ready controls under a signed BAA

4. Data Retention

We retain your data as long as your account is active. Upon account deletion, we securely delete all personal information within 30 days, except where required by law to retain for compliance purposes.

5. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request data deletion
• Export your data
• Opt-out of marketing communications
• Withdraw consent for data processing

6. GDPR and CCPA Alignment

For users in the European Union, we are aligned with GDPR and CCPA, with a signed DPA available, including: data minimization, purpose limitation, storage limitation, and the right to be forgotten.

7. Cookies and Tracking Technologies

WAVE's public marketing and legal pages run consent-first, first-party analytics. Those pages set no WAVE cookies, and load no third-party analytics scripts, advertising pixels, or session-replay tools. They are served under a Content-Security-Policy that restricts scripts and outbound network connections to WAVE's own origin, so a third-party tracker cannot run on them.

• Your consent choice: when you choose Accept or Decline on our banner, that choice is stored in your browser's local storage under the key wave-consent. It stays on your device and is never sent to us as an identifier.
• Analytics, only if you accept: if you accept, WAVE records page views and clicks on primary calls-to-action. Nothing is recorded before you accept. The event is sent to WAVE's own domain and forwarded to our product-analytics processor from our servers. It contains the page path, the referring site's hostname, and, for a click, the link target and its visible label, both length-capped. It carries no cookie, no account or device identifier, and no page or message content.
• Do Not Track: if your browser sends a Do Not Track signal, WAVE records nothing, even if you previously accepted.
• Strictly necessary: signed-in WAVE application surfaces set cookies required for authentication and security, and our infrastructure provider may set a strictly necessary cookie to distinguish automated traffic.

You can change or withdraw your choice at any time by clearing site data for wave.online in your browser, which removes the stored consent record and brings the banner back. Our product-analytics processor is named on our subprocessors list.

7A. Web search and grounding

Some WAVE features answer a question by searching the public web and grounding the answer in what they find. When you use one of those features, the text of your query is sent to third-party web-search providers so they can return matching results. Those providers receive the query text and the metadata their API requires. They do not receive your WAVE account identity, your media, or your other content.

Queries that WAVE can answer from its own index are not sent to any external search provider. The web-search providers WAVE uses are named on our subprocessors list.

7B. AI providers, retention, and model training

Delivering WAVE's AI features (transcription, captions, voice, and real-time inference) requires sending the relevant audio, video, or text to an AI provider. For WAVE's real-time and captions surfaces, WAVE operates a zero-data-retention policy layer at its API gateway: those requests are dispatched only to providers WAVE has verified can serve them without retaining the data, the provider must confirm that on every response, and a response that arrives without that confirmation is refused rather than delivered to you. Speech-to-text requests additionally carry the provider's model-improvement opt-out, so the audio is kept only for as long as processing the request takes and is not used to train the provider's models.

That policy layer covers WAVE's real-time and captions surfaces. It does not yet cover every AI provider behind every WAVE feature. If the retention or model-training posture of a specific provider matters to your use of WAVE, ask us at privacy@wave.online before you rely on it, and we will tell you the posture for that provider in writing.

8. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract Performance: Processing necessary to provide our services to you
• Legitimate Interests: Improving services, security, fraud prevention
• Legal Obligations: Compliance with applicable laws and regulations
• Consent: Where you have given explicit consent (e.g., marketing communications)

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. We use appropriate safeguards for international transfers including: Standard Contractual Clauses (SCCs), adequacy decisions, and data processing agreements with all third-party processors. For EU users, we comply with the EU-US Data Privacy Framework.

10. Children's Privacy

WAVE Platform is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@wave.online, and we will promptly delete such information.

11. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of personal information collected about you
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of your personal information
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights

To exercise these rights, contact us at privacy@wave.online or call our toll-free number: +1 888 814 9283.

12. Automated Decision-Making

We may use automated systems to detect fraudulent activity, enforce our terms of service, and provide personalized content recommendations. You have the right to request human review of any automated decision that significantly affects you. We do not use fully automated decision-making for consequential decisions without human oversight.

13. Data Controller Information

For privacy-related questions or to exercise your rights, contact our Data Protection Officer at:

WAVE Online, LLC
Attn: Data Protection Officer
30 N Gould St #10491
Sheridan, WY 82801
United States

Email: privacy@wave.online
Phone: +1 888 814 9283

EU data subjects: may contact eu-privacy@wave.online with any GDPR-related inquiry or request.

14. SMS / Text Message Communications

WAVE Online, LLC may send SMS / text messages to phone numbers that users have voluntarily provided through their WAVE account. This section is required by U.S. carrier regulations (A2P 10DLC) and the Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227.

What SMS data we collect

• The phone number you provide
• The timestamp and IP address of your opt-in
• Carrier metadata (line type, country code) returned by Twilio Lookup
• Delivery status of messages (delivered, failed)
• Your opt-out events (if you reply STOP, UNSUBSCRIBE, etc.)

Why we send SMS messages

We send SMS messages only for the following purposes, and only to phone numbers that have opted in: (1) two-factor authentication codes; (2) account and operational notifications; (3) payment-related notifications; (4) customer-service replies to support requests you initiate; (5) internal incident paging for WAVE employees who have opted in.

How we DO NOT use SMS data

WAVE will never share or sell your phone number for marketing purposes, send unsolicited marketing messages, share SMS message content with third parties (other than Twilio for delivery), or use SMS data for retargeting, profiling, or behavioral advertising. Phone numbers and SMS data are used only by WAVE Online, LLC and our delivery provider Twilio Inc. for the purposes listed above.

Service providers

We use Twilio Inc. as our SMS delivery provider, bound by their privacy policy and a Data Processing Agreement with WAVE.

Message frequency

You may receive up to 50 SMS messages per month per phone number, depending on account activity, security events, and stream activity. Most users receive between 1–15 messages per month.

Carrier and data rates

Message and data rates may apply. Standard message and data rates from your mobile carrier may apply when you receive SMS from WAVE. WAVE does not charge you for SMS, but your carrier may. Contact your carrier for details on your messaging plan.

How to opt in

1. Add your phone number on the Notification Settings page in your WAVE account dashboard and explicitly check the SMS opt-in box.
2. Reply START, YES, or SUBSCRIBE to a verification SMS we send when you initially add your phone number.

Opt-in is granular: you can opt in to specific message types (2FA only, all notifications, etc.) and change preferences at any time.

How to opt out

You can opt out of SMS communications at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message we send, or by disabling SMS notifications on your Notification Settings page. When you opt out, you will receive one final confirmation message acknowledging your opt-out, and we will not send further SMS messages to that phone number except for transactional account-security messages required to protect your account.

How to get help

Reply HELP to any SMS message we send to receive a brief help reply with our support contact information. You can also email support@wave.online with questions about SMS communications.

Data retention

• Phone numbers: retained while your WAVE account is active. Deleted within 30 days of account closure or upon request via DSAR.
• Opt-in / opt-out records: retained for 4 years after opt-out, as required by carrier compliance.
• Message delivery logs: retained for 18 months per Twilio policy.

Children

This SMS program is US-carrier-specific. WAVE does not knowingly collect phone numbers from individuals under 13 years of age in the US (COPPA baseline), or under 16 years of age for EU/UK residents (GDPR Article 8). If we learn we have collected SMS data from a child below the applicable age, we will delete it promptly.

15. Third-Party Meeting Integrations (Zoom)

When you connect WAVE to a Zoom meeting, WAVE receives the meeting's real-time media through Zoom's Real-Time Media Streams (RTMS) in order to provide the live streaming, perception, and analytics features you have enabled.

• What we may receive: depending on the features you enable, WAVE receives real-time meeting audio, video, live transcripts, in-meeting chat, and shared-screen content delivered through Zoom's RTMS, so that WAVE and the applications you build on WAVE can process, analyze, transcribe, stream, and act on that meeting data. We request only the data types needed for the features you turn on.
• How we handle it: meeting data is processed in real time to power the features you enable (streaming, perception, transcription, analytics, and any integrations or applications you connect). It is not retained at rest except where a feature you enable requires it (for example, WAVE room recording, or delivery to a destination or application you have configured).
• If you enable recording: the composed WAVE room recording is stored in Cloudflare R2, encrypted at rest (AES-256), and retained in accordance with your account's retention settings so that it remains available for playback. You can delete recordings at any time, and any remaining recordings are deleted within 30 days of account closure, consistent with the "Data Retention" section above.
• Control metadata: we retain a mapping of the Zoom meeting to your WAVE organization for up to 14 days to route media correctly. This contains no meeting media.
• Security: all Zoom media is received over TLS; incoming Zoom webhooks are cryptographically verified (HMAC) against Zoom's signing secret.
• Authorization & revocation: WAVE accesses Zoom data only through the scopes you authorize during installation, in accordance with Zoom's Marketplace requirements. You can revoke access at any time by removing the WAVE app from your Zoom account, which stops all further media access.
• Subprocessor: Cloudflare, Inc. (media transport and encrypted storage).

16. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on our website and, where required, by email. Continued use of our services after such changes constitutes acceptance of the updated policy.