Privacy Policy.

Waverunner is operated by Rocketlink Technologies Limited, Penthouse Level, 62, Progetta House, Tower Street, Swatar, Birkirkara, Malta BKR4011. We are the controller of the personal data described in this policy, except where section 4 says otherwise.

When you fill in a form, sign up or contact us: your name, email address, phone number, company, role and anything you write to us.

When you use the platform: your account details, the settings and records your business creates, and technical data such as IP address, browser, device and how you use the product.

When you visit the website: technical data such as your IP address and browser, which our hosting provider records briefly to deliver the site and keep it secure.

When you visit a page, our server records which page it was, where you came from (the referring website and campaign tags), how long the page was in view and how far you scrolled, with your country, browser and device type. To count visits without cookies, it uses a temporary identifier derived from your connection and browser that changes every day and is never stored on your device. Your IP address is not passed on. If you start signing up for Waverunner, that day's identifier is linked to your signup, so we can see which pages led to it. If your browser sends Global Privacy Control or Do Not Track, nothing is recorded. We rely on our legitimate interest in understanding how the website is used.

When you submit a form, sign up or book a call on the website: our server records the event for our own statistics. It includes your answers about your business (such as company name, industry and volume) and a pseudonymous identifier derived from your email address. It also includes your country, region and city, taken from our hosting provider's network data (your IP address is not forwarded), and your browser, operating system and device type. The first signup step adds the campaign tags in the link you followed and the website that referred you. Your name, email address and phone number are not included, and no cookies are set. We rely on our legitimate interest in understanding how the website performs.

The signup form keeps your unfinished answers in your browser's session storage until you close the tab, so you do not lose them between steps.

We use your data to run the service, answer you, keep the platform secure, prevent fraud and abuse, improve the product, send you information about Waverunner and meet our legal obligations. We rely on our contract with you, our legitimate interests, your consent for marketing, and the law where it requires us to keep records. We do not sell personal data.

When your business uses Waverunner to bill and manage its own customers, we process their data on your instructions. You are the controller and we are the processor. If you are a customer of a business that uses Waverunner, contact that business about your data. A data processing agreement is available on request.

We share data with the providers that help us run Waverunner. Today these are Vercel for hosting, Sanity for storing form submissions, Resend for email, Cal.com for booking calls, Mixpanel for website and product analytics, and Google Fonts for the website's fonts. Each provider works under a contract that limits what it can do with the data. We also share data when the law requires it or to protect our users and the platform.

Cookies are small files stored on your device.

The Waverunner website sets no analytics or advertising cookies, so it shows no cookie banner. Our website analytics, including page views, run on our own servers, use no cookies and store nothing on your device (see section 2). On the login page your browser remembers the last workspace address you used, so you do not have to type it again. Our pages load their fonts from Google Fonts, so your browser contacts Google, which sees your IP address.

The platform uses essential cookies to keep you signed in and to protect your account. They are always on. The call-booking calendar on the signup page is provided by Cal.com, which may set its own essential cookies when you use it.

Blocking essential cookies will stop parts of the platform from working.

Some of our providers store data outside the European Economic Area. When they do, we rely on standard contractual clauses or another safeguard recognised under EU law.

We keep your data while your account is active and for as long as we need it to provide the service, meet legal and tax obligations, resolve disputes and enforce our agreements. After that we delete or anonymise it. Form submissions and leads that never become accounts are deleted after two years.

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we process it, and receive it in a portable format. You can withdraw consent at any time. Write to hello@waverunner.ai and we will respond within one month. You can also complain to the Information and Data Protection Commissioner in Malta or the authority where you live.

We protect your data with encryption in transit, access controls and monitoring. No system is completely secure, so use a strong password and keep it private.

We may update this policy. When we do, we change the date at the top and, where the change matters to you, let you know.

Questions about your data or this policy? Write to hello@waverunner.ai.