Draft. This document is awaiting a lawyer's approval, and the final wording may change before the service opens to everyone.
Waise Privacy Policy
Last updated: Oct 25, 2026.
This policy explains what the Waise team ("Waise") keeps, why, with whom, and for how long. It covers two kinds of information: information about you, the merchants, for which we are responsible; and information about your store's customers, for which you are responsible and we process it on your behalf, as your service provider.
1. What we keep about you
- Account: email, phone (if you verified it), and your password, stored encrypted in a way that the password itself cannot be recovered.
- Business: store name, field of business, previous platform, and the business details you entered in the setup wizard.
- Payment: the last four digits of the card and the token the payment processor gives us. The full card number is stored only by the payment processor.
- Usage: admin logins, actions in the system and conversations with Pulse, in order to provide the service, fix problems and keep things secure.
- Waitlist: the name, business name and email you entered.
2. Why
To open and run your store, collect the subscription, send messages about your account and subscription, provide support, and keep things secure. Marketing updates about Waise are sent only to those who asked for them, and you can stop them at any time.
3. Your customers' information
The shoppers' details, orders and addresses in your store belong to you, and you are responsible for them (under the CCPA, you are the business and Waise is your service provider). Waise holds and processes them only on your instructions and only to run your store. We do not use them for any other purpose, and we do not sell or transfer them. Waise staff enter a store only to help, and every entry is recorded in a log shown on the "Your Waise subscription" screen.
4. Who holds the information
We use providers that hold some of the information for us, only for the purpose of the service:
- Hetzner: the servers, in Germany (in the European Union).
- Cloudflare: secure routing of traffic to the site and protection of the domains.
- Resend: sending emails.
- Anthropic: the AI behind Pulse and the setup wizard. The information is not used to train models.
- Twilio: sending a verification code by text message.
- The payment processor that bills the subscription for us.
Some providers process information outside the United States, such as our servers in Germany. Transfers to them are made in accordance with the law and under a written commitment from the provider to protect the information.
5. How long
For as long as the account is active. After cancellation or suspension, the store and data are kept as set out in the Terms of Use (section 5) and then deleted. An encrypted off-site backup may remain for up to 30 more days after deletion and is then purged. Records the law requires us to keep, such as billing records and invoices, are kept for the period the law sets.
6. Security
Encryption in transit, encrypted passwords, two-step verification for those who turn it on, role-based permissions, and an encrypted off-server backup. If a serious security incident occurs, we will notify you and the authorities as the law requires.
7. Your rights
You can ask to see the information we hold about you, correct it or delete it. Write to us from your account's email and we will reply within 30 days. To delete a store completely, cancel the subscription and ask for deletion, and it will be carried out right at the end of the paid period.
7a. Your California privacy rights (CCPA)
If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you these rights about the personal information Waise holds about you as a merchant:
- To know: the categories and specific pieces of personal information we collected about you, the sources, the purposes and the categories of providers we disclose it to. In the last 12 months we collected the categories listed in section 1: identifiers (email, phone), commercial information (your subscription and charges), internet activity (admin logins and actions) and the business details you entered. We collect them from you and from your use of the service, for the purposes in section 2, and disclose them only to the providers in section 4, as our service providers.
- To delete and to correct that information, subject to the exceptions the law allows (for example, billing records we must keep).
- To opt out of sale or sharing: Waise does not sell your personal information and does not share it for cross-context behavioral advertising, and has not done so in the last 12 months. We do not knowingly collect information from anyone under 16.
- To limit the use of sensitive personal information: we use it (your password and sign-in data) only to provide the service and keep it secure.
- Non-discrimination: we will not deny you the service, charge you a different price or give you a different level of service for using these rights.
To use a right, write to us from your account's email (section 9). We will confirm the request within 10 business days and answer within 45 days. We verify the request by matching it to your account; an authorized agent may make a request for you with your signed permission. Your store's customers who want to use these rights about their information in your store should contact you, and Waise will help you respond.
8. Cookies
On the Waise website and in the store admin we set only cookies that are necessary to run the service. There are no advertising or third-party tracking cookies. One first-party Waise cookie (wz_src) measures which of our own marketing works, and it is listed in the table. These are the cookies:
| Cookie | Purpose | Lifetime |
|---|---|---|
waise_acc | Keeps you signed in to your account (a random session identifier, not readable by scripts). | 30 days, or until you sign out |
waise_lang | The site language you picked. | One year |
waise_ref | Remembers the link of a partner who referred you, so the account you open is credited to them. Set only from a partner link. | 30 days |
waise_partner | Sign-in to the partners area (partners only). | 30 days, or until sign-out |
wz_src | Remembers where your first visit to the Waise website came from (the campaign, link or website that referred you), so we can tell which of our marketing works. Set only when a visit carries a campaign tag, a referral code or an external referrer, and only if you do not already have it. It holds no name, email or IP address. If you open an account, this information is saved with your account. | 90 days |
waise_hq | Sign-in to the Waise team console (staff only). | 12 hours |
In your own store, you choose whether to connect analytics and advertising tools, and you are responsible for telling your shoppers about them.
9. Contact
Privacy questions and requests: the support screen in your store's admin (Pulse), or the contact page.