Privacy Policy

Waveform License Manager, web accounts

Effective date: October 21, 2026

1. Who we are and what this policy covers

Waveform Inc ("we", "us") is established in Nevada, USA. Our address is 23438 Toronja Corte, Corona, CA 92883, USA.

This policy covers people who create an account at waveformanager.com, either a Free account or a paid plan bought through Paddle, to use the Waveform License Manager with a WooCommerce or other non-Shopify store. For them, Waveform Inc is the controller of the personal data described below.

For the license, customer and device data you store in the service about your own customers, we act as your processor. We offer a data processing agreement on request. If you use the Shopify app instead, or you are a customer of a merchant who does, the policy for the Shopify app applies: Shopify app privacy policy.

2. What we collect

  • Email address, to create and sign in to your account, send confirmation and sign-in links and the welcome message, and tell you about your account.
  • Store address (website), the address you give for your store, used to identify the account, to stop two accounts claiming the same store, and in your account emails. For a paid plan it is also passed to Paddle at checkout.
  • Terms acceptance, the version of the Terms of Service you accepted and when.
  • Merchant key, of which we store only a one-way (SHA-256) hash, with its identifier and last four characters. When a key is created, an encrypted copy is kept so you can see it once after signing in. It is deleted when you first open your dashboard, and in any case after 7 days.
  • Billing references (paid plans), Paddle's customer and subscription ids and the plan. We do not receive or store card numbers. Paddle is the merchant of record and handles payment, tax and invoices under its own privacy policy. On an upgrade from your dashboard, a signed reference containing your account id and email is passed to Paddle so the purchase attaches to your account.
  • Customer, license and device data you store or send through the service. For WooCommerce this is the billing email, first name and store customer reference the plugin sends with each order, order and line ids, and the device and activation data your customers' software sends. For this data we act as your processor.
  • Technical data, the IP address and request details, which our hosting provider records in its request logs for every request and which appear in our error logs when something goes wrong. The IP address is also used as a short-lived key to limit abuse, for example sign-in requests per address. We keep them for our hosting provider's log retention window.

3. Why we use it

We use this data to provide and secure the service: to run your account, deliver licenses, bill paid plans through Paddle, prevent abuse and answer your requests. Our lawful bases are performance of our contract with you, legitimate interests in operating and securing the service, and legal obligation. We send account emails only, never marketing, and we make no automated decisions with legal or similarly significant effects.

4. Cookies

We set only the cookies the account pages need, none for advertising or tracking. These are a signed-in session cookie (it carries your email address, signed but not encrypted) and a form-protection cookie, each lasting up to 7 days and sent only to the account pages, and, if you have more than one account under one email, a cookie remembering which one you chose.

The product website loads no analytics or advertising scripts. It loads Paddle's checkout script when you press Continue to checkout, and Paddle's own cookies and privacy policy apply from then on.

5. Who we share it with

  • Paddle, for payment, tax and invoices on paid plans. It receives the email and store address you type at checkout.
  • Resend, for delivery of the confirmation, sign-in and welcome emails. It receives your email address, the link or key notice, and the store address.
  • Render, for hosting, the database and logs.
  • Dropbox, which stores encrypted copies of our database backups. We encrypt them before they leave our systems.

We do not sell personal data or share it for others' marketing. We may disclose data where the law requires it.

6. International transfers

Our infrastructure is hosted in the United States. If you are in the EEA or the UK, using the service involves transferring your personal data to the United States. Contact support@waveformanager.com for information about the safeguards that apply.

7. How long we keep it

  • Account data is kept while the account exists. A canceled paid plan moves the account to Free, it does not end it. We do not delete idle Free accounts automatically. Ask us at any time to delete yours.
  • Sign-in and signup link records (your email, and for signups your store address) are deleted 30 days after they are made, including signups that were never confirmed.
  • Backups. Our backup job deletes backups older than 30 days. The backup storage may keep a deleted copy for a further period.
  • Deletion. You can ask us to delete the account and its data at any time by emailing support@waveformanager.com from the address on the account. We will do it within 30 days, except for records we must keep by law. Cancel any paid subscription first, because deleting the account does not cancel it. Paddle keeps its own transaction records under its privacy policy.

8. How we protect it

TLS in transit at the platform edge, encryption at rest of the managed database at our hosting provider, one-way hashing of merchant keys, application-level encryption of signing keys, public-key encryption of database backups, redaction of sensitive values from logs, and restricted access to production systems.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. If you are in California, you may also ask what we collect and have it deleted, and we do not sell personal information. To use any of these rights, email support@waveformanager.com from the address on your account. We will respond within the time the law requires. You may also lodge a complaint with your local data protection authority.

10. Children

The service is a business-to-business tool. It is not directed to children, and we do not knowingly process children's personal data.

11. Changes and contact

We may update this policy. Material changes will be reflected by an updated effective date and, where appropriate, communicated by email or in your dashboard.

Waveform Inc, 23438 Toronja Corte, Corona, CA 92883, USA. Privacy contact: support@waveformanager.com

We have no establishment or representative in the European Union or the United Kingdom.