Privacy Policy

Privacy Policy

Effective Date: September 24, 2026 | Previous edition: September 16, 2026

This Privacy Policy explains how Adwave Digital Inc. ("Adwave," "Wavemaker," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Wavemaker platform, websites, applications, REST API, and MCP endpoint (collectively, the "Service"). It also describes your privacy rights and how to exercise them. By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

This Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms.

1. Who We Are (Controller)

Adwave Digital Inc. is the controller of personal information processed through the Service, except where we act as a processor/service provider on behalf of an organization customer (see Section 11). You can contact us at [email protected] or Adwave Digital Inc., 8 The Green, Ste A, Dover, DE 19901, United States.

2. Information We Collect

2.1 Information you provide

• Account information — email address, display name, and password (stored only as a salted, hashed value; we never store plaintext passwords). Optional profile details you add.
• Organization information — organization name, billing contact, and the email addresses of members you invite.
• User Inputs — prompts and instructions; uploaded images, video, audio, and documents; URLs and brand/reference materials you direct us to fetch or analyze.
• Support and communications — messages you send us and related metadata.

Sign-in and account records

This release uses existing preserved password logins and verified-contact enrollment. It does not enable Google or Facebook sign-in. Security codes are short-lived; password verifiers, verification state, session records and immutable policy agreement records are stored. A workspace membership does not transfer ownership of another person's account.

2.2 Information generated by your use

• Output and project data — generated videos, images, voiceovers, music, captions, compositions, voice profiles, subject/reference data, and related metadata.
• Content-policy classification — a label our system assigns to a request (for example, standard vs. restricted) to route and moderate generation.
• Usage, billing, and technical data — session and generation history, prompts and tool activity, timestamps, Credits consumed, cost/usage logs, credit purchases and settlement status, device and browser information, and IP address (collected from standard request headers and our infrastructure).

2.3 Information from third parties you direct us to access

When you submit a URL, brand, or reference material, we fetch and process content from that source on your instruction. That content may contain personal information about third parties. You are responsible for ensuring you have the right to have us process it (see Terms Sections 6–7). We do not control those third-party sources.

2.4 Payment information

Payments are processed by Stripe. We do not collect or store full card numbers; we store only identifiers and limited details (such as Stripe customer, Checkout, payment and refund IDs and billing status) needed to manage your account.

3. How We Use Information

We use information to:

• Provide the Service — process your prompts, generate, render, store, and deliver Output, and operate features you use (including sharing, where you enable it);
• Process payments — manage one-time Credit purchases, refunds, payment records and applicable taxes through Stripe;
• Generate content — transmit User Inputs to AI Providers in real time to produce Output (Section 4);
• Maintain and secure — authenticate users, manage access, provide support, maintain logs and backups, and protect the Service;
• Enforce and comply — detect, prevent, and respond to abuse, fraud, security incidents, and violations of our Terms (including content moderation and classification), and comply with legal obligations; and
• Improve the Service — analyze aggregated and de-identified usage to maintain quality and reliability. We do not use the content of your individual prompts or your User Content to train foundation AI models.

4. How We Share Information

We share information only as described below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4.1 AI and processing providers

The production setup uses OpenAI for the native creative agent and speech, and Modal for isolated native execution and self-hosted image/video model compute. Inputs, relevant context and selected files are sent to the provider required for your requested operation. Self-hosted execution includes third-party model weights; it does not imply that the model author receives your prompts. We do not independently train foundation models on your content.

You may connect your own supported provider credentials or direct an agent to an external service. Those selected providers receive the information needed for your request and apply their own terms and privacy practices. The payer and credential owner depend on the chosen route. Installed integrations are not all enabled production processors.

4.2 Infrastructure, payments and security mail

Fly.io hosts the application and PostgreSQL database; the production database is in the Ashburn, Virginia region. Cloudflare provides edge routing and object storage. Modal provides generation and native execution compute. Stripe processes payments. Our existing Resend account sends enrollment and security messages from [email protected]. These providers process information necessary for their functions. Compute and edge/storage processing can occur in other regions; we do not promise that all data stays in one region.

This application release does not install the legacy marketing site's Google Tag Manager or Snitcher tracking. Operational logs and strictly necessary authentication/feature storage remain in use.

4.3 Legal, safety & business transfers

We may disclose information: to comply with law, legal process, or governmental requests; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; to protect the rights, property, or safety of Adwave, our users, or the public (including reporting illegal content as required by law); and in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.

4.4 At your direction / public content

If you make content public, unlisted, or shareable, it (and associated metadata) may be displayed, embedded, indexed, and accessed by others (see Terms Section 11). Anything you choose to share publicly is no longer private.

5. Legal Bases (EU/EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on these bases:

Where we rely on legitimate interests, we balance them against your rights. You may object as described in Section 8.

6. Data Storage & Security

• Passwords are salted and hashed; Wavemaker access tokens are stored as verifiers; connected provider credentials needed for execution are encrypted at rest and made available only to their selected runtime.
• Authentication tokens expire after a limited period.
• Data in transit is encrypted via HTTPS/TLS; data at rest is protected by our infrastructure providers' encryption.
• We restrict internal access and maintain administrative, technical, and organizational safeguards.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you and authorities as required by applicable law.

7. Data Retention

Account, workspace, uploaded and generated content remain while needed to provide the Service and maintain their ownership and dependency records. This release has no universal seven-day upload expiry, two-day reference expiry or automatic thirty-day account deletion promise. You can request access, export or deletion through available account controls or [email protected]. Removal is scoped to your rights; shared resources, other people's acquired copies, running work, payment obligations and legal holds may require separate handling. Removing a public listing cannot recall downloads.

Usage, payment, refund, security, moderation and policy agreement records can be retained to resolve liabilities, prevent abuse, demonstrate consent and comply with law. Closing an account does not erase records that must be retained for these purposes. API credentials may be revoked separately from content deletion.

Encrypted database recovery copies are held separately from the active database. Scheduled recovery copies are configured for a rolling 35-day retention period. Release and incident recovery copies may be retained separately while needed for recovery or legal obligations. Deletion evidence must be applied before a restored copy is returned to service. Backups are not a public source of content. Stripe retains payment information under its own policies and applicable law.

We may retain aggregated or de-identified information that no longer identifies you. Contact [email protected] for information about a particular deletion or retention request.

8. Your Privacy Rights

8.1 All users

You may access, correct, delete, and export your account information and content, and revoke API keys, from your account or by contacting [email protected]. We may need to verify your identity before acting on a request.

8.2 EU/EEA/UK (GDPR)

You have rights to access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects (see Section 12). You may withdraw consent at any time (without affecting prior processing) and lodge a complaint with your supervisory authority. For transfers outside the EEA/UK, see Section 10.

8.3 California (CCPA/CPRA) & other U.S. state laws

If you are a resident of California or another U.S. state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, and others), you may have rights to: know/access the personal information we collect, use, and disclose; correct it; delete it; obtain a portable copy; opt out of "sale" or "sharing" (we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require an opt-out); and not be discriminated against for exercising your rights. Where applicable, you may appeal a decision by replying to our response or contacting [email protected]. You may use an authorized agent where the law permits.

To exercise any right, contact [email protected]. We respond within the timeframes required by applicable law.

9. Cookies & Local Storage

We use necessary authentication cookies/session tokens and feature preferences to keep you signed in, protect requests and operate the features you select. Optional notification preferences are separate from policy acceptance and security email. This release does not use the legacy marketing site's Google Tag Manager or Snitcher tags.

10. International Data Transfers

We operate globally and your information may be transferred to and processed in countries other than your own, including the United States, where data-protection laws may differ. Where required for transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. Contact [email protected] for more information.

11. Organization (B2B) Data

When you use the Service through an organization, the organization administers the account and may access, control, and manage members' activity and content. In that context we may act as a processor/service provider on the organization's behalf, and the organization's own privacy practices apply to its members' data. Direct data-subject requests to the organization first; we will reasonably assist.

12. Automated Processing & Moderation

We use automated systems to classify, route, and moderate content (for example, to detect prohibited content and enforce our Terms and AI Provider policies) and to detect fraud and abuse. These processes may restrict or refuse generation. We do not use these systems to make decisions producing legal or similarly significant effects without a means to contact us; you may reach a human at [email protected] or [email protected].

13. Children's Privacy

The Service is not directed to children under 13 (or under 16 in the EU/EEA/UK), and certain mature-content functionality is restricted to users 18+ (see Terms Section 10). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us information, contact [email protected] and we will take steps to delete it.

14. Third-Party Links & Services

The Service may reference or interoperate with third-party sites and services (including those you direct us to access). Their privacy practices are governed by their own policies, and we are not responsible for them.

15. Changes to This Policy

We may update this Policy from time to time. For material changes, we will provide reasonable notice (for example, by email or an in-Service notice), generally at least 30 days where feasible before the change takes effect. The "Last Updated" date above reflects the latest revision. Continued use after the effective date constitutes acceptance.

16. Contact

Privacy: [email protected] Security: [email protected] Abuse / Trust & Safety: [email protected]

Adwave Digital Inc. 8 The Green, Ste A Dover, DE 19901 United States

EU/EEA and UK residents may also contact their local data protection authority.