Privacy policy

Waity is a product of BitByte Labs LLC.

BitByte Labs LLC 2465 Arnold Mill Rd NW Lawrenceville, GA 30044, USA Email: [email protected]

This policy applies to:

• Our marketing website at https://waity.me, including the contact page
• The Waity application at https://app.waity.me
• Public booking and waitlist pages we host for businesses that use Waity
• Emails we send in connection with the above, including appointment reminders sent on behalf of businesses

This policy does not cover the websites, apps, or privacy practices of the businesses that use Waity, or third-party services such as Stripe that have their own privacy policies.

We deal with three groups of people:

• Website visitors: people who visit waity.me or contact us through the website.
• Business customers and their users: the businesses that sign up for Waity, and the owners, managers, and staff who use Waity on their behalf ("Account Users").
• End customers: the customers of those businesses, meaning people who book an appointment, join a waitlist, or whose visit a business records in Waity.

How we handle information depends on which group you are in. For end customers, the business you visited is responsible for your information, and we process it on the business's behalf. See "Businesses and their customers" below.

Account and business information

When a business signs up for Waity or an Account User is added, we collect:

• Name and email address
• Business name
• Login credentials
• Phone number (optional)
• Role within the business (such as owner, admin, staff, or viewer)
• Organization and location settings, such as business hours, services, and, on paid plans, branding like a logo and colors

Billing information

Payments for paid plans are handled by Stripe. Stripe collects your payment card details directly, and we do not store them in Waity. Stripe makes limited billing details available to us, such as your name, email address, plan, payment status, and the brand and last four digits of your card, so we can manage your subscription.

Information about how businesses use Waity

We store the records you create while using Waity, such as visits, appointments, waitlist entries, and changes to settings, as needed to operate the service for you.

End-customer information we process for businesses

When a business uses Waity, the business or its end customers may provide:

• Name
• Contact details needed to book or send notifications, such as an email address, and a phone number if provided
• Appointment and visit details, such as the service, location, date and time, status, and wait times
• Notes the business chooses to enter about a visit or service

End customers may submit this information themselves through a business's public booking or waitlist page, or the business may enter it. We process this information on behalf of the business.

Emails you send us

You can contact us by email at [email protected]. If you do, we receive your email address and whatever you include in your message. We use this information to respond to you.

Technical information

When you use our website or app, our servers and service providers automatically record limited technical information needed to deliver and protect the service. This includes IP address, browser and device type, the pages or features requested, the date and time of the request, and error details. Our marketing website is hosted on a server we operate, and its web server keeps standard access logs (such as IP address, browser, and pages requested) to keep the site secure and working. We keep operational logs for a limited time.

If something goes wrong in the Waity app, an error report may be sent to our error-monitoring provider, Sentry. Error reports include technical details about the problem and your browser. Reports about sign-in problems also include the email address and user ID involved, so we can investigate. Sentry deletes error reports after a limited retention period.

We do not use technical information for advertising.

We use personal information to:

• Provide and operate Waity, including accounts, visits boards, walk-ins, appointments, online booking, waitlists, analytics, and data exports
• Send service emails, including appointment reminders and booking-related emails on behalf of businesses, and account, security, and billing notices to Account Users
• Process payments and manage subscriptions through Stripe
• Respond to inquiries and provide customer support
• Protect Waity and its users, including detecting and preventing fraud, abuse, and security incidents, and enforcing our Terms of Service
• Maintain and improve Waity, including troubleshooting, fixing bugs, and understanding how features are used
• Comply with legal obligations
• Send Account Users occasional news about Waity, which you can opt out of at any time

We use end-customer information only to provide Waity to the business that collected it, including support, security, and legal compliance. We do not use end-customer information to market our own products to end customers.

We do not sell, rent, or trade personal information. We do not share personal information with advertising networks or for targeted advertising.

We share personal information only in these situations:

With service providers who help us run Waity. Except as noted below, these providers may use personal information only as needed to provide their services to us.

Stripe processes payment information under its own privacy policy.

Within a business account. Account Users within the same business can see the information the business keeps in Waity. End-customer information is available to the business that collected it.

At your direction. For example, when a business exports its data from Waity.

For legal reasons. When we believe in good faith that disclosure is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of BitByte Labs, our customers, or others.

In a business transfer. If BitByte Labs is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. It will remain subject to the commitments in this policy.

For end-customer information, the business using Waity decides what information to collect and how to use it. The business is responsible for that information (in privacy terms, the "controller"). BitByte Labs processes it on the business's behalf as a service provider (the "processor").

Businesses that use Waity are responsible for:

• Giving their customers any required privacy notices
• Having a lawful basis, and any required consent, to collect their customers' information and send them emails through Waity
• Keeping the information they enter accurate
• Responding to their customers' privacy requests

If you are an end customer, please contact the business you booked with or visited to access, correct, or delete your information. If you contact us instead, we will refer your request to that business and help them respond where we can. We may need the business's authorization before acting on a request about its data.

Sensitive information. Waity is designed for scheduling and waitlist management. It is not designed to store sensitive information such as health or medical details, government identification numbers, or financial account numbers. Businesses should not enter this kind of information into notes or other fields.

Healthcare providers. Waity is not an electronic medical records system and is not designed to meet the requirements of HIPAA. See our Terms of Service for more detail.

On our marketing website, we do not use analytics, advertising, or tracking cookies at this time.

In the Waity app, we use only essential cookies and similar browser storage needed to sign you in, keep you signed in, and keep the app working as expected.

Stripe checkout pages may set their own cookies, which are governed by Stripe's privacy policy.

If we start using analytics or marketing cookies in the future, we will update this policy before we do.

Because we do not track visitors across third-party websites or sell or share personal information for advertising, there is nothing for us to change in response to "Do Not Track" or Global Privacy Control signals.

We use reasonable technical and organizational measures to protect personal information, including:

• Data is encrypted in transit (HTTPS)
• Passwords stored as one-way hashes, never in plain text
• Each staff member signs in with their own account.
• Automated bot protection on selected forms
• We back up our database

You can read more about our day-to-day security practices on our Security page.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Businesses can help by protecting their login credentials, giving staff only the roles they need, and removing access for staff who leave.

If we learn of a security incident that affects personal information, we will notify affected customers as required by applicable law.

We keep personal information for as long as needed to provide Waity and for legitimate business and legal needs.

• Account and business information is kept while your account is open.
• End-customer information is kept as needed to provide Waity to the business that collected it. Businesses can contact us at [email protected] to request deletion of specific records.
• Billing records are kept as needed for tax, accounting, and legal purposes.
• Emails you send us are kept as long as reasonably needed to respond to you and keep a record of our correspondence.
• Logs are kept for a limited time.

Closing your account. Canceling a paid subscription does not by itself delete your data. To close your account and have your organization's data deleted, an owner emails [email protected] and we schedule the organization for deletion. There is a 30-day grace period during which the owner can ask us to cancel the deletion. After that, we delete the organization and its related records from Waity, including Account Users who belong only to that organization. Before closing your account, owners and admins can export their organization's data where the product supports it, or ask us for a copy.

Backups and logs. Deleted information may remain in backups and operational logs for a limited time before it is permanently removed.

Account Users can view and update much of their information in account settings. You can also email [email protected] to request access to, correction of, or deletion of your personal information.

Marketing emails. You can opt out of non-essential marketing emails at any time by using the unsubscribe link in the email or by contacting us. We will still send service emails, such as security, billing, and account notices.

End customers should contact the business they booked with to access, correct, or delete their information, or to stop receiving appointment emails from that business. Appointment reminder emails do not include an unsubscribe link, and each business controls whether Waity sends reminders on its behalf.

US state privacy rights. Depending on where you live, you may have rights under state privacy laws, such as the right to know what personal information we hold about you, to access it, to correct it, to delete it, to receive a copy of it, and not to be treated differently for exercising these rights. We will honor requests as required by applicable law.

To make a request, email [email protected]. We may need to verify your identity before responding. We will respond within the time required by applicable law. If we decline your request, you can reply to ask us to reconsider.

If you are in the European Economic Area or the United Kingdom and EU or UK data protection law applies to our processing of your information, you also have the right to object to or restrict certain processing and to lodge a complaint with your local data protection authority. We process account information to perform our contract with you and for our legitimate interests in operating and securing Waity. For end-customer information, the business that collected it is responsible for having a lawful basis.

Waity is a business tool and is not directed to children. We do not knowingly collect personal information directly from children under 13, or under 16 where local law sets a higher age.

If a business uses Waity to book an appointment for a child, the booking should be made by a parent or guardian, and the business is responsible for handling that information appropriately.

If you believe a child has given us personal information directly, contact [email protected] and we will delete it.

Waity is operated from the United States, and our main servers run on Amazon Web Services (AWS), and our marketing website is hosted on a server we operate. Some of our service providers, including those that send email, monitor errors, and provide bot protection, may process information in other countries. If you use Waity from outside the United States, your information will be transferred to and processed in the United States and other countries where data protection laws may differ from those in your country.

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top. If we make material changes, we will notify Account Users by email or in the app before the changes take effect.

For privacy questions or requests, contact:

BitByte Labs LLC 2465 Arnold Mill Rd NW Lawrenceville, GA 30044, USA Email: [email protected]