Privacy Policy

Waco3 handles personal information in two different roles, and your rights differ depending on which one applies:

• We are the controller of the information described in this policy about you: your account, billing, support messages, and how you use our website and app.
• We are a processor for the information you store in Waco3 about your clients: their names, email addresses, the documents you send them, and how they engage with those documents. For that data, you are the controller: it is processed on your instructions, we use it only to provide the Service to you, and your own privacy practices govern it. If you are one of our users’ clients and have questions about your data, please contact the business you worked with; we will assist them in responding.

Information you provide. When you create an account we collect your name, email address, and password. If you subscribe to a paid plan, your payment is processed by Stripe; we receive limited billing details (such as plan, transaction status, and the last four digits of your card) but we do not store full card numbers. We also collect the documents and other content you create in the Service, any messages you send us for support. If you use voice input, your device sends us a recording, we have it transcribed, and we keep only the resulting text. The audio is held in memory for the transcription and never written to our storage (see section 8).

Information we collect automatically. If you consent to analytics, we collect usage and device information: pages viewed and actions taken; browser, device, and screen characteristics; network connection type; language and timezone; approximate location derived from your IP address; referring pages and campaign parameters; how often you return and when you last visited; and interaction signals such as scrolling, clicks, idle and exit behaviour, form interactions (whether a form was started or abandoned, not what you typed), errors the site encounters, and engagement time. We use this to understand what works, fix what breaks, and improve the Service. Our Cookie Policy lists exactly what we store on your device, and nothing beyond strictly necessary storage runs before you consent. If you also accept advertising, we keep the ad click identifier from the link that brought you (fbclid, gclid) together with the campaign parameters, and we store them with your sign-up so we can tell which ad led to it (section 7).

When your clients view, sign, or respond to something you send through Waco3, we process related information on your behalf, such as their email address, timestamps, and engagement events (opens, views, signatures, survey responses), so we can show you the results. We use this information only to provide the Service to you, never for our own advertising, and we do not contact your clients except to deliver what you send. You are responsible for informing your clients about this processing where required by the laws that apply to you.

We use personal information to: provide, operate, and secure the Service; create and manage your account; process subscriptions and billing; power AI features you choose to use; provide customer support; understand and improve how the Service is used; send you service-related and, where permitted, promotional communications; and comply with legal obligations.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure and improve the Service, in a way that does not override your rights); consent (for analytics and advertising cookies, and any marketing where consent is required); and legal obligation (to meet our legal and tax duties). You can withdraw consent at any time.

On our website (waco3.io). Analytics and advertising are off by default and only activate if you accept them in our consent banner, where you can choose analytics and advertising separately. Until you accept analytics, we send no analytics events at all. We use Google Analytics 4 with Consent Mode and IP anonymization and, if you accept advertising, the Meta Pixel (section 7); before consent, no analytics or advertising cookies are set. You can change or withdraw your choice at any time using the "Cookie settings" button in our footer and at the bottom of this page, and we honor Global Privacy Control (GPC) signals: when your browser sends GPC, advertising signals stay off regardless of any other setting. Our Cookie Policy lists every cookie and storage item the website uses.

Inside the app, once you have signed in, product analytics (PostHog) run as part of the Service. They are how we find errors and understand which features work, and they are not used for advertising. We build in real limits rather than asking you to trust us: everything you type is masked in session recordings, so passwords, client details and contract terms are never captured; the document canvas is blocked entirely, so the contents of your documents are never recorded; and analytics never run on recipient-facing pages: the shared documents, signing pages, surveys and client portals your clients see carry no product analytics at all. The one place advertising technology touches the app is its public sign-in and sign-up pages: if you accepted advertising, the Meta Pixel runs there, and nowhere else in the app (section 7).

We advertise Waco3 on Meta platforms (Facebook and Instagram) and, from time to time, on Google. To know whether an ad led to anything, we use two kinds of tools. Both are off until you accept advertising in our banner, wherever you live.

In your browser: the Meta Pixel and Google advertising signals. If you accept advertising, the Meta Pixel loads on waco3.io and on the sign-in and sign-up pages of the app. It records that you viewed those pages and sets the _fbp and _fbc cookies, which identify your browser and the ad you clicked (the fbclid parameter in the link). Google advertising signals work the same way for Google campaigns. Neither runs inside the signed-in app, and neither runs on the pages your clients see.

From our servers: the Meta Conversions API. When you reach one of the moments below, our server sends Meta one event about it. We send it from the server because the moment of paying happens in our billing system, not in your browser.

What we do not send: your name, phone number or address; anything you create in Waco3; anything about your clients or the people you share pages with; your activity inside the app; renewal payments. Team members who join an existing workspace by invitation are not reported at all. Hashing means Meta receives a fingerprint of your email rather than the address itself; Meta can only match it against an account that already uses the same email, and it reports results to us in aggregate. We do not learn who you are on Meta.

Who is responsible for this data. Meta Platforms, Inc. (Meta Platforms Ireland Limited if you are in the EEA or UK) decides how it uses what it receives, under its own privacy policy, as an independent controller rather than our service provider. For people in California we flag every event with Meta’s "Limited Data Use" setting, which restricts Meta to the measurement purpose.

Your choices. Decline advertising in the banner, or change your mind later with the "Cookie settings" button, and none of this runs for that browser: no Pixel, no Meta cookies, and no server events for an account created from it. If your browser sends a Global Privacy Control signal, advertising stays off automatically. You can also email [email protected] to have future events for an existing account suppressed, and you can review what Meta has received from businesses in your Off-Facebook activity settings. Declining changes nothing about your plan, price or features.

Why we are this specific. Under the California CPRA, sending identifiers to an ad platform for measurement can count as "sharing" even though no money changes hands. We treat it that way (section 14). We would rather tell you exactly what leaves our servers than describe it vaguely. When we stop running ads, we switch this off; the cookies already in your browser simply expire.

When you use an AI feature, the content you provide and the output generated are sent to a third-party AI provider, currently OpenAI, Google (Gemini), or DeepSeek, which generates your result. Requests are routed automatically, and your content is never sent to any AI provider other than those.

Waco3 does not build or train AI models and never uses your content to do so. What each provider may do differs: OpenAI and Google are contractually barred from using your content to train or improve their models, while DeepSeek’s terms permit it to use that content to develop and improve its services, and DeepSeek processes it in the People’s Republic of China. Our AI Policy sets this out provider by provider, with retention periods.

We do not sell your personal information for money. If you consent to advertising, the resulting disclosures to advertising partners may count as "sharing", or, under some laws, a "sale", for cross-context behavioral advertising; that happens only with your consent, and you can opt out at any time as described in sections 7 and 13. Beyond that, we share personal information only with service providers who process it on our behalf to run the Service, and only as needed:

• DigitalOcean: cloud hosting, application database and cache (United States)
• Cloudflare: content delivery, bot protection, and object storage for your files and documents
• Stripe: subscription billing and payment processing
• Resend and Mailtrap: transactional and notification email delivery
• OpenAI: artificial intelligence provider: text generation, embeddings, speech-to-text (United States)
• Google: artificial intelligence provider: text generation, embeddings, speech-to-text; and "Sign in with Google" (United States)
• Groq: artificial intelligence provider: speech-to-text (United States)
• DeepSeek: artificial intelligence provider: text generation (People’s Republic of China)
• Microsoft: "Sign in with Microsoft"
• Zoom: video meetings for scheduler bookings, only if you connect your Zoom account; we receive your Zoom user ID and email and store Zoom’s access tokens encrypted, and you can disconnect at any time (see our Zoom integration guide)
• Google Meet: video meetings for scheduler bookings, only if you connect your Google account for Meet; we receive your Google account email and store Google’s access tokens encrypted, we create one Meet link per booking and never read your other meetings or your calendar, and you can disconnect at any time
• PostHog: product analytics and error monitoring inside the Waco3 application
• Google Analytics: website analytics on waco3.io only, and only if you consent
• Meta Platforms (Facebook, Instagram): advertising measurement, only if you consent to advertising, receiving the events listed in section 7. For that data Meta is an independent controller, not our service provider.
• Unsplash, Pexels, Pixabay: stock-image search; your search terms are sent when you use it
• Brave Search, OpenCorporates: public company research, when you use client research (see section 10)

We may also disclose information where the law requires it, to protect our rights or the safety of others, or in connection with a merger or acquisition. In that case this policy continues to apply to your information.

Government and law-enforcement requests. Our policy is to disclose your information only when we are compelled by valid legal process, to push back on requests that are overbroad or defective, and to notify you before we disclose, unless the law prohibits us from telling you.

We keep this list current alongside the services section of our Third-Party Licenses page.

Google user data. Waco3’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Section 17 explains exactly what Google user data we access, how we use, share, protect and delete it.

If you use client research, we look up a company you name. We search public sources: public web search results (Brave Search), public company registries (OpenCorporates), and the company’s own website, which our servers visit and read. We then run what we find through an AI provider to assemble a summary for you.

That summary can include the names and public professional details of people listed on those sources, who are not our users and have not signed up for anything. We collect only what is already published publicly, we do not attempt to identify private individuals, and we do not build profiles of people beyond the company context you asked about.

Research is deleted automatically: runs older than 12 months are erased (we keep the five most recent per client so your history is not emptied), and anything you delete is purged within 30 days. You can delete any research at any time from the client’s page. If you are named in research one of our users has run and you want it removed, email [email protected] and we will act on it.

We are based in the United States and our providers may process information there and in other countries. Where we transfer personal information from the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses; for transfers from the UK, we use the ICO’s International Data Transfer Addendum to those clauses (the "UK Addendum") alongside them.

One exception you should know about. Content sent to our AI provider DeepSeek is processed in the People’s Republic of China. China is not covered by a European Commission adequacy decision, and DeepSeek does not offer Standard Contractual Clauses. If you are in the EEA or the UK, or you handle client data that must stay within them, take this into account before using AI features, and see our AI Policy for the detail.

We keep personal information only as long as we need it. These are the periods our systems actually enforce:

• Account data and Your Content (as defined in our Terms of Service): for as long as your account is active.
• After you delete your account: you lose access immediately, and we keep the underlying data for 30 days before erasing it permanently, so an accidental deletion can be reversed. Export your data before you delete it.
• Engagement analytics (document, survey and portal view sessions): 24 months.
• Security and audit events: 400 days.
• In-app notifications: 90 days.
• Client research: 12 months, keeping the five most recent per client; deleted research is purged within 30 days.
• Billing records: as long as tax and accounting laws require.
• Signature and envelope audit records: kept with the documents they belong to and not pruned, because an audit trail that expires is not an audit trail.
• Records that you accepted our terms, and your auto-renewal consent: kept permanently as evidence, but detached from your account identifier when you delete your account.
• AI prompts and outputs: held by the AI provider that handled the request under its own retention rules (see section 8); the resulting drafts live in your account like any other content.
• Ad click identifier and campaign tags stored with your sign-up (section 7): for the life of your account, captured once and never updated; deleted with the account.
• Our own log of the events we sent to Meta (event name, time, amount, outcome; no identifiers): 180 days.
• Backups: our managed database keeps a rolling 7 days of backups, so deleted data disappears from them within about a week of leaving production.

You can ask us to delete your account and associated data at any time, and you can do it yourself from Settings.

You may have the right to access, correct, delete, or receive a copy of your personal information; to restrict or object to certain processing; to withdraw consent; and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We honor these requests from all our users, regardless of where you live.

To exercise any of them, email [email protected]. Sending the request from the email address on your account is the simplest way for us to verify it; if you write from another address, we may ask for additional information to confirm you are who you say you are, and an authorized agent acting for you must provide your signed permission. We will respond within the time required by applicable law. If we decline a request, we will tell you why, and you can appeal by replying to our response. We will not discriminate against you for exercising your rights. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

California residents can opt out of the "sharing" of personal information for cross-context behavioral advertising by declining advertising in our consent banner, using the "Cookie settings" button, or enabling Global Privacy Control (GPC) in their browser. We treat a GPC signal as a valid opt-out and keep advertising signals off while it is present. Opting out also stops the server-side events to Meta described in section 7 for any account created from that browser; to stop them for an account you already have, email us. You can also email [email protected] with the subject "Do Not Sell or Share".

Waco3 is small enough that it may not meet the thresholds that make these California rules mandatory. We honor these opt-out rights for everyone anyway, using the methods above.

The Service is intended for people who run a business and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We use commercially reasonable technical and organizational measures to protect personal information. Traffic to and from the Service is encrypted in transit, your data is stored on managed infrastructure that encrypts data at rest, and access is restricted to the systems that need it.

IP addresses. We do not store raw IP addresses for reading or engagement analytics. Those use a one-way salted hash that cannot be turned back into an address, and it is never shown to the document owner. We do record the IP address of anyone who signs a document or submits a survey response, because that is part of the evidence a signature is worth, and of your own login sessions, so you can review and end them.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the relevant authorities as required by applicable law, for example, within the deadlines of the Florida Information Protection Act, or the GDPR’s 72-hour authority notification, where they apply.

This section describes how Waco3 handles information we receive from Google APIs, in addition to the rest of this policy. Waco3’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access. Only what the feature you turn on needs:

• Sign in with Google (scopes openid, email, profile): your name, email address and Google account ID. We do not keep Google tokens for sign-in.
• Google Meet for scheduler bookings, only if you connect it (scopes openid, email and meetings.space.created): your Google account email and ID, the OAuth access and refresh tokens Google issues to us, and, for each booking, the Meet space our app created for it (its ID and join link). The meetings.space.created permission only covers Meet spaces our app created. We do not access your other meetings, participants, recordings, transcripts, chat, calendar, contacts, Gmail or Drive.

How we use it. Only to provide the features you see: to sign you in; to create one Google Meet link when someone books time with you; to put that link in the booking confirmation email and calendar invite; to keep the same link when a booking is rescheduled; to end any live call on that link when a booking is canceled; and to show which Google account is connected in Settings. We do not create aggregated or anonymized data from Google user data, and our product analytics never record Google user data.

Who we share it with. The Meet join link is shared with the people taking part in that booking (you and your guest), by email and calendar invite, because that is what the feature is for. Otherwise Google user data is processed only by the service providers that run Waco3 on our behalf: DigitalOcean (hosting, database and cache) and our email delivery providers Resend and Mailtrap (which deliver the confirmation emails). We do not sell Google user data, and we do not transfer it to advertisers, advertising platforms, data brokers or information resellers, or use it for advertising, credit or lending decisions.

AI and machine learning. Google user data is never sent to our AI providers and is never used to develop, improve or train any artificial intelligence or machine learning model, whether ours or anyone else’s.

Human access. No Waco3 staff read Google user data, except with your explicit permission (for example, a support request you open), when needed for security purposes such as investigating abuse, or to comply with the law.

How we protect it. Google OAuth tokens are encrypted at rest with AES-256-GCM, using a key kept separate from the database. Short-lived access tokens are held in our private cache for at most 50 minutes. All traffic to Google and to the Service uses TLS. Our database and cache are managed services that accept only authenticated, encrypted connections, and access to production is limited to authorized personnel. See section 16 for our general security practices.

Retention and deletion. We keep Google tokens only while Google Meet is connected. When you click Disconnect in Settings, we revoke our access with Google and delete the tokens immediately. If you delete your Waco3 account, or a workspace owner removes you from their team, we revoke and delete your Google Meet connection at that moment, not when the account data is purged later. You can also remove Waco3 at any time from your Google Account at myaccount.google.com/permissions; we then stop using the connection. Meet links created for bookings are part of those bookings and are deleted with them, or with your account as described in section 12. Sign-in details (name, email, Google account ID) are kept for the life of your account. To ask us to delete any Google user data, email [email protected].

This policy is part of our Terms of Service. We may update it from time to time; if we make material changes, we will notify you by email and in the app at least 30 days before they take effect, and update the date at the top of this page.

Questions or requests about your privacy? Email [email protected]. All of our legal documents are listed at waco3.io/legal.