Privacy Policy

Privacy Policy

Effective Date: October 21, 2026 | Previous edition: September 24, 2026

This Privacy Policy explains how Adwave Digital Inc. ("Adwave," "Wavemaker," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Wavemaker platform, websites, applications, hosted agent, command-line tool, SDKs, REST API, and MCP endpoint (collectively, the "Service"). It also describes your privacy rights and how to exercise them. By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

This Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms.

1. Who We Are (Controller)

Adwave Digital Inc. is the controller of personal information processed through the Service, except where we act as a processor/service provider on behalf of an organization customer (see Section 11). You can contact us at [email protected] or Adwave Digital Inc., 8 The Green, Ste A, Dover, DE 19901, United States.

2. Information We Collect

2.1 Information you provide

• Account information: email address, display name, and password (stored only as a salted, hashed value; we never store plaintext passwords). Optional profile details you add.
• Organization information: organization or Workspace name, billing contact, and the email addresses of members you invite.
• User Inputs: prompts and instructions; uploaded images, video, audio, and documents; URLs and brand/reference materials you direct us to fetch or analyze.
• Support and communications: messages you send us and related metadata.
• Provider keys you connect: if you save your own key for a third-party provider, we store it encrypted and use it only for requests you or your Workspace direct to that provider.

Sign-in and account records

You sign in with a password or a short-lived code sent to your verified email address. Where we offer Google sign-in and you use it, we receive your Google account identifier, email address, and whether Google has verified that address. We store password verifiers, verification state, session records, API Key records, and immutable policy agreement records. A Workspace membership does not transfer ownership of another person's account.

2.2 Information generated by your use

• Output and project data: generated videos, images, voiceovers, music, captions, compositions, voice profiles, subject/reference data, and related metadata.
• Content ratings and safety checks: a rating (for example, general or 18+) that the Service assigns to media, conversations, and jobs, and the results of automated checks that decide whether a request is allowed.
• Usage, billing, and technical data: session and generation history, prompts and tool activity, timestamps, Credits consumed, cost/usage logs, Credit purchases, plan subscriptions and settlement status, device and browser information, and IP address (collected from standard request headers and our infrastructure).

2.3 Information from third parties you direct us to access

When you submit a URL, brand, or reference material, we fetch and process content from that source on your instruction. That content may contain personal information about third parties. You are responsible for ensuring you have the right to have us process it (see Terms Sections 6–7). We do not control those third-party sources.

2.4 Payment information

Payments are processed by Stripe. We do not collect or store full card numbers; we store only identifiers and limited details (such as Stripe customer, Checkout, subscription, invoice, payment and refund IDs and billing status) needed to manage your account.

3. How We Use Information

We use information to:

• Provide the Service: process your prompts, generate, render, store, and deliver Output, and operate features you use (including sharing, where you enable it);
• Process payments: manage Credit purchases, plan subscriptions and renewals, refunds, disputes, and payment records through Stripe;
• Generate content: transmit User Inputs to AI Providers in real time to produce Output (Section 4);
• Maintain and secure: authenticate users, manage access, provide support, maintain logs and backups, and protect the Service;
• Enforce and comply: detect, prevent, and respond to abuse, fraud, security incidents, and violations of our Terms (including content moderation and classification), and comply with legal obligations; and
• Improve the Service: analyze aggregated and de-identified usage, and visits to public pages (Section 9), to maintain quality and reliability. We do not use the content of your individual prompts or your User Content to train foundation AI models.

4. How We Share Information

We share information only as described below. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4.1 AI and processing providers

Inputs, relevant context, and selected files are sent to the provider needed for the operation you request. In production:

• Hosted creative agent: runs on the AI provider we select for it, currently Anthropic (Claude). Anthropic also runs the automated content-safety checks.
• Modal runs isolated code execution and the image, video, and language models we operate on its compute.
• Media, speech, music, analysis, and web-search partners receive a request when it uses a capability they perform. If the agent's primary provider declines a request, the same request may be sent to another provider on the list so it can be answered.

The full, current list of these providers is at Service providers and subprocessors. We do not train foundation models on your content.

Self-hosted model weights. Some image and video capabilities run open model weights published by third parties, under their licences, on compute we operate. These include weights from Tencent (HunyuanVideo 1.5, and HY-World 2.0 for HY-Pano 2.0 location panoramas) and MiniMax (MiniMax H3). When we run these weights ourselves, their authors do not receive your prompts, files, or Output. A request sent to a model author's own hosted service, such as MiniMax's API, is a partner request under the previous paragraph and is listed at /subprocessors.

Wavemaker is provided by Adwave Digital Inc. Tencent and MiniMax are not affiliated with Wavemaker or Adwave, and they do not sponsor or endorse Wavemaker.

You may connect your own supported provider credentials or direct an agent to an external service. Those providers receive the information needed for your request and apply their own terms and privacy practices. When you use your own provider key, you are that provider's customer for that request. The same applies when you run an agent on your own machine with the Wavemaker CLI: wavemaker chat launches a local Codex, Grok or Claude Code agent on your own account with that provider. Your prompts go to that provider under its terms, and Wavemaker receives only the tool calls that agent makes to the Service.

4.2 Infrastructure, payments, mail and analytics

Fly.io hosts the application and the hosted agent's working environment, and hosts the PostgreSQL database in the Ashburn, Virginia region. Cloudflare provides edge routing and object storage. Stripe processes payments. Resend sends account, enrollment, and security email from [email protected]. Google Analytics measures visits to public pages on app.wavemaker.io, as described in Section 9. These providers process the information needed for their functions. Compute and edge processing can occur in other regions; we do not promise that all data stays in one region.

4.3 Legal, safety & business transfers

We may disclose information: to comply with law, legal process, or governmental requests; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; to protect the rights, property, or safety of Adwave, our users, or the public (including reporting illegal content as required by law); and in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.

4.4 At your direction / public content

If you make content public, unlisted, or shareable, it (and associated metadata) may be displayed, embedded, indexed, and accessed by others (see Terms Section 11). Anything you choose to share publicly is no longer private.

5. Legal Bases (EU/EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on these bases:

Where we rely on legitimate interests, we balance them against your rights. You may object as described in Section 8.

6. Data Storage & Security

• Passwords are salted and hashed. Wavemaker sessions and API Keys are stored only as hashes. Provider keys you connect are encrypted at rest and used only for requests to that provider.
• Authentication tokens expire after a limited period.
• Data in transit is encrypted via HTTPS/TLS; data at rest is protected by our infrastructure providers' encryption.
• We restrict internal access and maintain administrative, technical, and organizational safeguards.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you and authorities as required by applicable law.

7. Data Retention

Account, Workspace, uploaded, and generated content remain while needed to provide the Service and maintain their ownership and dependency records. We do not automatically delete uploads, references, or accounts after a fixed period. You can request access, export, or deletion through the account controls or [email protected]. Removal is scoped to your rights; shared resources, other people's acquired copies, running work, payment obligations and legal holds may require separate handling. Removing a public listing cannot recall downloads.

Usage, payment, refund, security, moderation and policy agreement records can be retained to resolve liabilities, prevent abuse, demonstrate consent and comply with law. Closing an account does not erase records that must be retained for these purposes. API credentials may be revoked separately from content deletion.

Encrypted database recovery copies are held separately from the active database. Scheduled recovery copies are configured for a rolling 35-day retention period. Release and incident recovery copies may be retained separately while needed for recovery or legal obligations. Deletion evidence must be applied before a restored copy is returned to service. Backups are not a public source of content. Stripe retains payment information under its own policies and applicable law.

We may retain aggregated or de-identified information that no longer identifies you. Contact [email protected] for information about a particular deletion or retention request.

8. Your Privacy Rights

8.1 All users

You may access, correct, delete, and export your account information and content, and revoke API Keys, from your account or by contacting [email protected]. If a control is unavailable for your account, email us and we will handle the request. We may need to verify your identity before acting on a request.

8.2 EU/EEA/UK (GDPR)

You have rights to access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects (see Section 12). You may withdraw consent at any time (without affecting prior processing) and lodge a complaint with your supervisory authority. For transfers outside the EEA/UK, see Section 10.

8.3 California (CCPA/CPRA) & other U.S. state laws

If you are a resident of California or another U.S. state with a comprehensive privacy law (e.g., Virginia, Colorado, Connecticut, Utah, and others), you may have rights to: know/access the personal information we collect, use, and disclose; correct it; delete it; obtain a portable copy; opt out of "sale" or "sharing" (we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require an opt-out); and not be discriminated against for exercising your rights. Where applicable, you may appeal a decision by replying to our response or contacting [email protected]. You may use an authorized agent where the law permits.

To exercise any right, contact [email protected]. We respond within the timeframes required by applicable law.

9. Cookies & Local Storage

We use necessary cookies and browser storage to keep you signed in, protect requests from forgery, remember your appearance and layout choices, keep unsent drafts, and operate the features you select. Optional notification preferences are separate from policy acceptance and security email.

On public pages of app.wavemaker.io (the home page, Help, Docs, the blog, examples, and public Discover, creator, and collection pages), we use Google Analytics to measure visits. It sets Google Analytics cookies. Advertising storage, ad personalization, and Google signals are turned off. Analytics does not run on product pages, such as conversations, projects, and settings, or when your browser sends a Global Privacy Control or Do Not Track signal. We do not use advertising cookies. Details are at Cookies.

10. International Data Transfers

We operate globally and your information may be transferred to and processed in countries other than your own, including the United States, where data-protection laws may differ. Where required for transfers from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. Contact [email protected] for more information.

11. Organization (B2B) Data

When you use the Service through an organization, the organization administers the account and may access, control, and manage members' activity and content. In that context we may act as a processor/service provider on the organization's behalf, and the organization's own privacy practices apply to its members' data. Direct data-subject requests to the organization first; we will reasonably assist.

12. Automated Processing & Moderation

We use automated systems, including AI models run by the providers in Section 4.1, to classify, route, and moderate content (for example, to detect prohibited content and enforce our Terms and AI Provider policies) and to detect fraud and abuse. These processes may restrict or refuse generation. We do not use these systems to make decisions producing legal or similarly significant effects without a means to contact us; you may reach a human at [email protected] or [email protected].

13. Children's Privacy

The Service is not directed to children under 13 (or under 16 in the EU/EEA/UK), and certain mature-content functionality is restricted to users 18+ (see Terms Section 10). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us information, contact [email protected] and we will take steps to delete it.

14. Third-Party Links & Services

The Service may reference or interoperate with third-party sites and services (including those you direct us to access). Their privacy practices are governed by their own policies, and we are not responsible for them.

15. Changes to This Policy

We may update this Policy from time to time. For material changes, we will provide reasonable notice (for example, by email or an in-Service notice), generally at least 30 days where feasible before the change takes effect. The "Effective Date" above reflects the latest revision. Continued use after the effective date constitutes acceptance.

16. Contact

Privacy: [email protected] Security: [email protected] Abuse / Trust & Safety: [email protected]

Adwave Digital Inc. 8 The Green, Ste A Dover, DE 19901 United States

EU/EEA and UK residents may also contact their local data protection authority.