Legal

Privacy Policy

Last updated: April 18, 2026 · Effective: April 18, 2026

This Privacy Policy explains how Wavecrest Pro ("we," "us," or "our") collects, uses, and protects your personal information when you use our service at wavecrest.pro.

1. Information We Collect

We collect information you provide directly, information generated by your use of the service, and information from third parties:

Category	What we collect	Why
Account info	Email address, name, password (hashed), profile photo (OAuth)	To create and manage your account
Onboarding	Industry focus, competitor URLs analyzed, report preferences	To personalize your competitor intelligence reports
Usage data	API calls made, features accessed, search queries, timestamps	To enforce rate limits and improve the service
Billing	Payment method, subscription plan (via Stripe — we never store raw card details)	To process payments
OAuth providers	Google or GitHub profile ID and email (if you sign in via OAuth)	To authenticate you without a password
Technical data	IP address, browser type, session tokens	Security and session management

We do not collect the content of competitor websites you analyze. We only track which URLs you submit and the reports generated from your account.

2. How We Use Your Information

Providing the service: Running competitor teardowns, enforcing your plan limits, delivering reports
Account management: Sending verification emails, magic links, and billing receipts
Improving Wavecrest Pro: Analyzing which features are used, fixing bugs, improving report accuracy
Communications: Sending important service updates and, if you opt in, product newsletters
Security: Detecting and preventing fraud, abuse, and unauthorized access

We do not sell your personal data to third parties. We do not use your data to train AI models sold to others.

3. Third-Party Services We Use

We share your data with service providers only as necessary to operate the platform:

Stripe — Payments. Stripe processes your payment information and is PCI-DSS compliant. We store only your Stripe customer ID. Stripe Privacy Policy
Resend — Transactional email (verification links, magic links). Resend Privacy Policy
Neon — Database hosting (your account data is stored here). Neon operates on AWS infrastructure. Neon Privacy Policy
Google / GitHub OAuth — Only if you choose to sign in via OAuth. We receive your email and profile name only.
Vercel — Web hosting and serverless infrastructure.

All third-party providers are contractually obligated to protect your data and may not use it for their own purposes.

4. Cookies and Sessions

We use a single session cookie (connect.sid) to keep you logged in. This cookie is:

HttpOnly (inaccessible to JavaScript)
Secure (only sent over HTTPS in production)
Session-scoped — it expires when you log out

We do not use advertising cookies, third-party tracking cookies, or analytics cookies (no Google Analytics, no Meta Pixel).

5. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion.
Usage logs: Retained for up to 90 days for rate limiting and security purposes, then deleted.
Billing records: Retained for 7 years as required by financial regulations (held by Stripe).
Email tokens: Expire within 15 minutes (magic links) or 24 hours (verification links) and are purged after use.

6. Your Rights

You have the right to:

Access: Request a copy of the personal data we hold about you
Correction: Update incorrect information in your account settings
Deletion: Request deletion of your account and associated data
Portability: Request your data in a machine-readable format
Opt out: Unsubscribe from non-essential emails at any time

To exercise these rights, email us at privacy@wavecrest.pro. We will respond within 30 days.

7. GDPR (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR including the right to lodge a complaint with your local data protection authority. Our legal basis for processing your data is:

Contract performance: Processing necessary to deliver the service you signed up for
Legitimate interests: Security, fraud prevention, and service improvement
Consent: Optional communications (you can withdraw consent at any time)

8. Children's Privacy

Wavecrest Pro is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

9. Data Security

We take reasonable technical measures to protect your data, including:

Passwords stored as bcrypt hashes (never in plain text)
All connections encrypted over HTTPS/TLS
Database access restricted to the application server
Session tokens are rotated and HttpOnly

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we will notify you promptly if a data breach affects your account.

10. International Data Transfers

Wavecrest Pro is hosted on infrastructure located primarily in the United States. If you are accessing the service from outside the US, your data may be transferred to and processed in the US, which may have different data protection laws than your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on our website at least 14 days before the change takes effect. We encourage you to review this page periodically.

12. Contact

For privacy-related questions, requests, or concerns:

Email: privacy@wavecrest.pro
General support: support@wavecrest.pro