Privacy Policy

This Privacy Policy explains how we collect, use, share and protect personal information, and the rights and choices you have. This summary is for convenience. The full policy below controls.

1. Who we are

Wave Intelligence, Inc. is a Delaware corporation. We are the controller of the personal information described in this policy, which means we decide how and why it is used. The exception is information we process on behalf of our customers, described in section 2.

You can contact us about privacy at any time at [email protected].

2. What this policy covers

This policy applies to:

• our website at waveone.io and its subdomains (the "Website");
• the Wave platform at app.waveone.io, bulletins and related services (the "Service");
• business contact information we collect from public sources to provide the Service ("Business Contact Data");
• our sales, marketing and support communications.

It does not cover Customer Data: information our customers upload or add to the Service, such as a customer list, businesses and contacts they add themselves or import from a file, notes about leads or contacts imported from a CRM. We process Customer Data on behalf of our customers and under their instructions, so the customer's own privacy notice applies. If you have questions about Customer Data, please contact the customer concerned.

This policy also doesn't cover third-party websites or services you reach through the Website or connect to the Service, such as CRM tools. Their own privacy policies apply.

3. Information you give us

• Free bulletin and demo requests: your work email and, if you add them, your name, company, phone number, website, what your company sells and your target market.
• Waitlist (closed and deleted): until 13 October 2026, waveone.io showed a "coming soon" page where people could leave their email address to hear when Wave launches. The waitlist closed on 13 October 2026 and its records were deleted on 17 October 2026.
• Account information: your name, email address, company, role, the teammates you invite and your settings, such as saved filters and customer profiles.
• Billing information: your billing name and address, tax details, invoices and payment status. Payments are currently made by bank transfer against our invoice; if we add card payments, a payment processor such as Stripe will process card details and we will update this policy.
• Communications: when you email us or talk with our team, we keep the content of those conversations and our replies.

4. Information we collect automatically

• Server and security logs: when you visit the Website or the Service, our hosting and content delivery providers process technical information such as your IP address, browser type, device information, the pages you request and the date and time of each request. This is needed to deliver the Website and protect it against attacks and abuse.
• Campaign information: if you arrive through a link that contains campaign parameters (for example utm_source or an ad click identifier such as gclid), or from another website, the Website keeps that information in your browser for the current visit. It is sent to us only if you submit a form, so we can understand which campaigns bring in requests.
• Browser storage: the Website stores a small amount of information in your browser, as described in our Cookie Policy.
• Visit statistics: we count visits to the Website with Cloudflare Web Analytics. It doesn't set cookies or use browser storage, doesn't identify you or follow you across websites, and gives us only aggregated numbers, such as page views, countries and browser types.
• Platform usage data: when you use the Service, we record actions such as sign-ins, bulletins opened, exports and emails sent, to provide the Service, keep it secure and improve it.

We don't use advertising or social media tracking tools on the Website. If we add them, we will update this policy and our Cookie Policy and ask for your consent where the law requires it.

5. Business contact data from public sources

Wave helps companies that sell to businesses find new businesses. To do that, we use automated systems, including AI models, to find new businesses and collect information about them from public sources.

Where it comes from

• public business websites;
• public online profiles of businesses, such as their social media pages;
• open map data, used to place business addresses on a map.

What we collect

Business name, category and descriptive labels (for example "specialty coffee" or "seats 40+"), business address and location, opening status (for example "opening soon"), business phone, WhatsApp and email contacts, website and social media profiles, technologies visible on the business website (for example an online ordering tool) and, where a business publishes them, the names and roles of its owners or managers. Where we can, we check that contact details are valid, for example that an email address can receive mail.

Personal information in this data

Most of this information is about businesses rather than individuals. Some of it can identify a person: the name of an owner or manager shown on the business's website, or the contact details of a sole trader or a small business, such as an email address that contains a person's name or a mobile phone number. This is personal information, and we handle it as this policy describes. We don't intentionally collect sensitive information, such as information about health, religion or political opinions, and we delete it if we find that we have collected it.

How we use it

We use Business Contact Data only for business-to-business prospecting: to compile bulletins for our customers, to rank businesses by how closely they match a customer's targeting and flag the ones worth contacting first, and to let customers contact businesses and add them to their CRM. These rankings help our customers prioritize sales outreach. They don't produce legal or similarly significant effects for the people concerned.

We don't send marketing messages to the businesses in our bulletins ourselves. Our customers decide whether and how to contact them, and they are responsible for doing so lawfully, as section 12 of our Terms of Use requires.

We may also use Business Contact Data in aggregated form to produce statistics about new openings, such as how many businesses of a type opened in a city. These statistics don't identify any business contact.

6. How we use information

• to provide, operate and maintain the Website and the Service, including bulletins, contact tools, email automation and integrations;
• to respond to free bulletin, demo and trial requests and send you the bulletins you ask for;
• to create and manage accounts, process payments and send service and billing messages;
• to send marketing about Wave to companies that may want to use it (not to the businesses in our bulletins), with an easy way to opt out, a suppression list and consent where the law requires it;
• to understand which campaigns and pages work and to improve the Website and the Service, including our matching models;
• to protect the Website, the Service and our users, prevent fraud and abuse and enforce our Terms of Use;
• to comply with legal obligations and respond to lawful requests.

We may also create aggregated or de-identified information that can't reasonably be used to identify you, and use it for any lawful purpose.

7. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

• Contract: to provide the Service you signed up for and to manage your account and payments.
• Legitimate interests: to run and secure the Website, respond to enquiries, market Wave to businesses, improve the Service and collect and provide publicly available Business Contact Data for business-to-business prospecting, so that companies can offer their products and services to new businesses. We have balanced these interests against the rights of the people concerned: we use only information that businesses or public authorities have made public, we limit it to business information and business contact details, we don't process sensitive information, and anyone can object or ask us to remove it at any time.
• Consent: where the law requires it, for example for certain marketing messages or non-essential cookies. You can withdraw your consent at any time.
• Legal obligation: for example to keep tax and accounting records or to respond to lawful requests from authorities.

If you are in Türkiye, we rely on the legal bases in Article 5(2) of Law No. 6698 on the Protection of Personal Data ("KVKK"): the establishment or performance of a contract, compliance with a legal obligation, data made public by the data subject and our legitimate interests, and on explicit consent where it is required. For Business Contact Data we rely mainly on our legitimate interests (Article 5(2)(f)) and, for information a person has made public themselves, also on Article 5(2)(d). Our KVKK Notice explains this in Turkish.

8. How we share information

• Our customers: we provide Business Contact Data to customers in bulletins and through the Service, as described below under "Who receives a business". Customers agree in our Terms of Use to use it only for their own lawful sales and marketing, not to resell, publish or share it outside their organization, to comply with applicable marketing and privacy laws and to honor opt-out and removal requests, including those we pass on to them.
• Service providers that help us run Wave. They may use personal information only to provide their services to us:
  • hosting of our servers and databases: Contabo (Germany);
  • website hosting, content delivery, DNS, security and visit statistics: Cloudflare;
  • email and productivity tools: Google Workspace;
  • meeting scheduling: Calendly. When you book a call with us, Calendly receives the name, email address, chosen time and any answers you give in its booking form, and sends them to us;
  • AI model providers: OpenAI, and OpenRouter, which passes each request to the AI model provider it selects. They process the text of public web pages and business information to extract and summarize business details and to write bulletin content.
• Geocoding services that turn a business address into a map location: the US Census Bureau Geocoder and OpenStreetMap Nominatim. We send them only the business address, and they handle it under their own terms.
• Integrations you choose: when you connect a third-party service, such as a CRM or your own mailbox for email sequences, we send data to it at your direction.
• Legal and safety reasons: when we believe in good faith that the law requires it, or to protect the rights, property or safety of Wave, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business.
• With your consent or at your direction.

Who receives a business: a business is delivered to the customers whose targeting it matches, that is, what they sell, the types of business they sell to and their countries. Without an Exclusive contract, several customers, including customers selling the same thing, may receive the same business. A customer never receives the same business twice. Exclusive is the yearly plan that locks a sales category in a country for one customer: while it runs, no other customer selling the same thing receives the businesses it covers through Wave. Monthly plans are never exclusive. Customers selling different things, such as a POS provider and a packaging supplier, may always receive the same business, and people trying Wave may see a limited number of businesses to evaluate it.

Providing Business Contact Data to our customers is our service. Some US state privacy laws may treat this as a "sale" or "sharing" of personal information. Anyone can opt out of it ("Do Not Sell or Share My Personal Information") or ask to be removed from Wave by emailing [email protected] (sections 11 and 12). We don't provide information about our website visitors or our customers' accounts to other customers, and we don't use it for cross-context behavioral advertising.

9. How long we keep information

• Free bulletin, demo and trial requests: up to 24 months after our last contact with you, unless you become a customer.
• Waitlist sign-ups: deleted on 17 October 2026.
• Account and usage data: for as long as your account is open, including on the free plan after a trial or paid plan ends, and afterwards for a limited period to resolve disputes and enforce our agreements.
• Customer Data: businesses, contacts and notes a customer adds are kept for as long as the customer keeps them in its account. They are deleted when the customer deletes them or closes its account, and removed from our backups as those are replaced.
• Billing records: as long as tax and accounting laws require, generally up to 7 years.
• Business Contact Data: while the business is relevant to the Service. We regularly refresh records and remove those that are outdated.
• Delivery records: a record of which businesses were delivered to each customer, kept while that customer's account exists, so that we never deliver the same business to them twice.
• Removal requests: if you ask us to remove your information, we keep a minimal record, such as the email address or business website, so that we don't collect or contact it again.
• Server logs: kept by our hosting provider for a short period under its own policies.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it;
• correct information that is inaccurate or incomplete;
• delete your information;
• object to our processing, including at any time to processing for direct marketing;
• restrict our processing in certain circumstances;
• receive your information in a portable format;
• withdraw your consent where we rely on it;
• lodge a complaint with a data protection authority: in the EEA, your local supervisory authority; in the UK, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To exercise these rights, email [email protected]. We respond within 30 days. We may need to verify your identity before acting on a request, and we don't charge a fee unless the law allows it. Every marketing email we send includes an unsubscribe link.

11. Removing a business from Wave

If you own or run a business that appears in Wave, use our removal form. We email you a link to confirm the request. A request from an address on the business's own website domain, or one the business published on its website, applies as soon as you confirm. Our team checks other requests by hand, usually within two business days. Once a business is removed:

• it no longer appears in any new bulletin;
• it is added to our suppression list, so it isn't delivered again and Wave's customers can't email it through Wave;
• we confirm by email.

You can also email [email protected] with the business name and website, or the email address or phone number you want removed. If your contact details appear in our data, we will delete them from our database as well. We answer within a few business days and at the latest within 30 days.

Customers who have already received your information are required by our Terms of Use to honor opt-out requests. You can also ask any company that contacts you to stop.

12. Additional information for US residents

Some US states, including California, Colorado, Connecticut and Virginia, give residents specific rights over their personal information.

• Categories we collect: identifiers (such as name, email address, phone number and IP address); commercial information (such as your plan and billing history); internet activity (such as logs and usage data); professional information (such as company, role and business contact information); and inferences (such as how closely a business matches a customer's targeting).
• Sources: you, your devices, publicly available sources and our service providers.
• Purposes and recipients: as described in sections 6 and 8.

Providing Business Contact Data to our customers is our service, and some state laws may treat it as a "sale" or "sharing" of personal information. You can opt out of this, ask to be removed from Wave, and ask to know, correct or delete your information, by emailing [email protected] with the subject "Do Not Sell or Share" or "Privacy request". You can use an authorized agent to make a request for you. We won't discriminate against you for exercising your rights, and we don't knowingly sell or share the personal information of anyone under 16.

13. International data transfers

Wave is based in the United States. Our servers and databases are hosted by Contabo in Germany. Cloudflare, Google, Calendly, OpenAI, OpenRouter and the geocoding services described in section 8 process information in the United States, the European Union and other countries. When we transfer personal information from the EEA, the UK, Switzerland or Türkiye, we use the safeguards the law requires, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and, for Türkiye, the standard contracts and other mechanisms set out in Article 9 of KVKK.

14. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS), access controls and service providers with established security programs. No method of transmission or storage is completely secure, so we can't guarantee absolute security. To report a security issue, email [email protected].

15. Children

The Website and the Service are intended for businesses and are not directed to children under 16. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top and, if the changes are material, notify customers by email or through the Service before they take effect.

17. Contact us

Wave Intelligence, Inc.
Email: [email protected]