Privacy Policy

Waco3 handles personal information in two different roles, and your rights differ depending on which one applies:

• We are the controller of the information described in this policy about you: your account, billing, support messages, and how you use our website and app.
• We are a processor for the information you store in Waco3 about your clients: their names, email addresses, the documents you send them, and how they engage with those documents. For that data, you are the controller: it is processed on your instructions, we use it only to provide the Service to you, and your own privacy practices govern it. If you are one of our users’ clients and have questions about your data, please contact the business you worked with; we will assist them in responding.

Information you provide. When you create an account we collect your name, email address, and password. If you subscribe to a paid plan, your payment is processed by Stripe; we receive limited billing details (such as plan, transaction status, and the last four digits of your card) but we do not store full card numbers. We also collect the documents and other content you create in the Service, any messages you send us for support. If you use voice input, your device sends us a recording, we have it transcribed, and we keep only the resulting text. The audio is held in memory for the transcription and never written to our storage (see section 8).

Information we collect automatically. If you consent to analytics, we collect usage and device information: pages viewed and actions taken; browser, device, and screen characteristics; network connection type; language and timezone; approximate location derived from your IP address; referring pages and campaign parameters; how often you return and when you last visited; and interaction signals such as scrolling, clicks, idle and exit behaviour, form interactions (whether a form was started or abandoned, not what you typed), errors the site encounters, and engagement time. We use this to understand what works, fix what breaks, and improve the Service. Our Cookie Policy lists exactly what we store on your device, and nothing beyond strictly necessary storage runs before you consent.

When your clients view, sign, or respond to something you send through Waco3, we process related information on your behalf, such as their email address, timestamps, and engagement events (opens, views, signatures, survey responses), so we can show you the results. We use this information only to provide the Service to you, never for our own advertising, and we do not contact your clients except to deliver what you send. You are responsible for informing your clients about this processing where required by the laws that apply to you.

We use personal information to: provide, operate, and secure the Service; create and manage your account; process subscriptions and billing; power AI features you choose to use; provide customer support; understand and improve how the Service is used; send you service-related and, where permitted, promotional communications; and comply with legal obligations.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure and improve the Service, in a way that does not override your rights); consent (for analytics and advertising cookies, and any marketing where consent is required); and legal obligation (to meet our legal and tax duties). You can withdraw consent at any time.

On our website (waco3.io). Analytics and advertising are off by default and only activate if you accept them in our consent banner, where you can choose analytics and advertising separately. Until you accept analytics, we send no analytics events at all. We use Google Analytics 4 with Consent Mode and IP anonymization; before consent, no analytics or advertising cookies are set. You can change or withdraw your choice at any time using the "Cookie settings" button in our footer and at the bottom of this page, and we honor Global Privacy Control (GPC) signals: when your browser sends GPC, advertising signals stay off regardless of any other setting. Our Cookie Policy lists every cookie and storage item the website uses.

Inside the app, once you have signed in, product analytics (PostHog) run as part of the Service. They are how we find errors and understand which features work, and they are not used for advertising. We build in real limits rather than asking you to trust us: everything you type is masked in session recordings, so passwords, client details and contract terms are never captured; the document canvas is blocked entirely, so the contents of your documents are never recorded; and analytics never run on recipient-facing pages: the shared documents, signing pages, surveys and client portals your clients see carry no product analytics at all.

We may work with advertising partners (such as Google) that use cookies and similar technologies to measure our marketing and, where you have consented, to show you relevant ads on other sites. Under the California CPRA, this kind of cross-context behavioral advertising can be considered "sharing" of personal information. You can opt out at any time through the "Cookie settings" button, by declining advertising in our banner, or via a GPC signal from your browser. Advertising signals do not run unless you accept them.

When you use an AI feature, the content you provide and the output generated are sent to a third-party AI provider, currently OpenAI, Google (Gemini), or DeepSeek, which generates your result. Requests are routed automatically, and your content is never sent to any AI provider other than those.

Waco3 does not build or train AI models and never uses your content to do so. What each provider may do differs: OpenAI and Google are contractually barred from using your content to train or improve their models, while DeepSeek’s terms permit it to use that content to develop and improve its services, and DeepSeek processes it in the People’s Republic of China. Our AI Policy sets this out provider by provider, with retention periods.

We do not sell your personal information for money. If you consent to advertising, the resulting disclosures to advertising partners may count as "sharing", or, under some laws, a "sale", for cross-context behavioral advertising; that happens only with your consent, and you can opt out at any time as described in sections 7 and 13. Beyond that, we share personal information only with service providers who process it on our behalf to run the Service, and only as needed:

• DigitalOcean: cloud hosting, application database and cache (United States)
• Cloudflare: content delivery, bot protection, and object storage for your files and documents
• Stripe: subscription billing and payment processing
• Resend and Mailtrap: transactional and notification email delivery
• OpenAI: artificial intelligence provider: text generation, embeddings, speech-to-text (United States)
• Google: artificial intelligence provider: text generation, embeddings, speech-to-text; and "Sign in with Google" (United States)
• Groq: artificial intelligence provider: speech-to-text (United States)
• DeepSeek: artificial intelligence provider: text generation (People’s Republic of China)
• Microsoft: "Sign in with Microsoft"
• PostHog: product analytics and error monitoring inside the Waco3 application
• Google Analytics: website analytics on waco3.io only, and only if you consent
• Unsplash, Pexels, Pixabay: stock-image search; your search terms are sent when you use it
• Brave Search, OpenCorporates: public company research, when you use client research (see section 10)

We may also disclose information where the law requires it, to protect our rights or the safety of others, or in connection with a merger or acquisition. In that case this policy continues to apply to your information.

Government and law-enforcement requests. Our policy is to disclose your information only when we are compelled by valid legal process, to push back on requests that are overbroad or defective, and to notify you before we disclose, unless the law prohibits us from telling you.

We keep this list current alongside the services section of our Third-Party Licenses page.

If you use client research, we look up a company you name. We search public sources: public web search results (Brave Search), public company registries (OpenCorporates), and the company’s own website, which our servers visit and read. We then run what we find through an AI provider to assemble a summary for you.

That summary can include the names and public professional details of people listed on those sources, who are not our users and have not signed up for anything. We collect only what is already published publicly, we do not attempt to identify private individuals, and we do not build profiles of people beyond the company context you asked about.

Research is deleted automatically: runs older than 12 months are erased (we keep the five most recent per client so your history is not emptied), and anything you delete is purged within 30 days. You can delete any research at any time from the client’s page. If you are named in research one of our users has run and you want it removed, email [email protected] and we will act on it.

We are based in the United States and our providers may process information there and in other countries. Where we transfer personal information from the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses; for transfers from the UK, we use the ICO’s International Data Transfer Addendum to those clauses (the "UK Addendum") alongside them.

One exception you should know about. Content sent to our AI provider DeepSeek is processed in the People’s Republic of China. China is not covered by a European Commission adequacy decision, and DeepSeek does not offer Standard Contractual Clauses. If you are in the EEA or the UK, or you handle client data that must stay within them, take this into account before using AI features, and see our AI Policy for the detail.

We keep personal information only as long as we need it. These are the periods our systems actually enforce:

• Account data and Your Content (as defined in our Terms of Service): for as long as your account is active.
• After you delete your account: you lose access immediately, and we keep the underlying data for 30 days before erasing it permanently, so an accidental deletion can be reversed. Export your data before you delete it.
• Engagement analytics (document, survey and portal view sessions): 24 months.
• Security and audit events: 400 days.
• In-app notifications: 90 days.
• Client research: 12 months, keeping the five most recent per client; deleted research is purged within 30 days.
• Billing records: as long as tax and accounting laws require.
• Signature and envelope audit records: kept with the documents they belong to and not pruned, because an audit trail that expires is not an audit trail.
• Records that you accepted our terms, and your auto-renewal consent: kept permanently as evidence, but detached from your account identifier when you delete your account.
• AI prompts and outputs: held by the AI provider that handled the request under its own retention rules (see section 8); the resulting drafts live in your account like any other content.
• Backups: our managed database keeps a rolling 7 days of backups, so deleted data disappears from them within about a week of leaving production.

You can ask us to delete your account and associated data at any time, and you can do it yourself from Settings.

You may have the right to access, correct, delete, or receive a copy of your personal information; to restrict or object to certain processing; to withdraw consent; and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We honor these requests from all our users, regardless of where you live.

To exercise any of them, email [email protected]. Sending the request from the email address on your account is the simplest way for us to verify it; if you write from another address, we may ask for additional information to confirm you are who you say you are, and an authorized agent acting for you must provide your signed permission. We will respond within the time required by applicable law. If we decline a request, we will tell you why, and you can appeal by replying to our response. We will not discriminate against you for exercising your rights. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

California residents can opt out of the "sharing" of personal information for cross-context behavioral advertising by declining advertising in our consent banner, using the "Cookie settings" button, or enabling Global Privacy Control (GPC) in their browser. We treat a GPC signal as a valid opt-out and keep advertising signals off while it is present. You can also email [email protected] with the subject "Do Not Sell or Share".

Waco3 is small enough that it may not meet the thresholds that make these California rules mandatory. We honor these opt-out rights for everyone anyway, using the methods above.

The Service is intended for people who run a business and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We use commercially reasonable technical and organizational measures to protect personal information. Traffic to and from the Service is encrypted in transit, your data is stored on managed infrastructure that encrypts data at rest, and access is restricted to the systems that need it.

IP addresses. We do not store raw IP addresses for reading or engagement analytics. Those use a one-way salted hash that cannot be turned back into an address, and it is never shown to the document owner. We do record the IP address of anyone who signs a document or submits a survey response, because that is part of the evidence a signature is worth, and of your own login sessions, so you can review and end them.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the relevant authorities as required by applicable law, for example, within the deadlines of the Florida Information Protection Act, or the GDPR’s 72-hour authority notification, where they apply.

This policy is part of our Terms of Service. We may update it from time to time; if we make material changes, we will notify you by email and in the app at least 30 days before they take effect, and update the date at the top of this page.

Questions or requests about your privacy? Email [email protected]. All of our legal documents are listed at waco3.io/legal.