Privacy Policy

Last updated: [Date]

Template text. The business that operates this website must replace the bracketed placeholders and have a lawyer review this page before relying on it.

This policy explains how [Company legal name] ("we") handles personal data in WaiverTap. It covers two groups of people: our Customers (businesses and their team members who use WaiverTap) and Signers (people who sign a Customer's waiver or form).

1. Signers

When you sign a form, the business that asked you to sign is responsible for your data (the "controller"). We store and process it on the business's behalf (as a "processor"). We collect what the form asks for, such as your name, contact details, date of birth, answers, and signature, plus an audit trail: the time of signing, your IP address, your device's browser information (user agent), and your consent statements. The audit trail helps prove that you signed. For questions or requests about your data, contact the business first. We will help them answer.

2. Customers

We collect your name, email, login details (passwords are stored only as secure hashes), workspace settings, and billing status. Payment card details are handled by Stripe; we do not store full card numbers.

3. How we use data

To provide the Service: store records, generate PDFs, send emails you or the business request.
To keep the Service secure: rate limits, abuse prevention, and audit logs.
To bill paid plans and send service messages.
We do not sell personal data, and we do not use Signer data for advertising.

4. Service providers

We use these providers to run the Service: hosting ([Vercel/Render]), database ([Neon]), email delivery ([Resend]), payments (Stripe), and, only if a Customer uses the AI drafting assistant, Anthropic (the text the Customer enters about their business is sent to generate a draft; Signer data is never sent). Each provider processes data under its own data protection terms.

5. Retention

Signed records are kept until the Customer deletes them or their workspace. Account data is kept while the account is active. Server logs are kept for a short period by our hosting provider.

6. Security

Data is encrypted in transit (HTTPS). Access is limited by role. Each signed record carries a SHA-256 document hash so changes can be detected.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to object to some processing. Signers should contact the business they signed for. Customers can contact us.

8. International transfers

Data may be stored in [region, for example the United States]. Where required, we use appropriate safeguards for transfers.

9. Children

Parents or legal guardians may sign forms for children. The Service is not directed at children, and children may not create accounts.

10. Changes and contact

We will post updates on this page and notify Customers of material changes. Contact: support@waivertap.com, [Company legal name], [address].