Wavelike Privacy Policy

Last updated: November 12, 2026

This Privacy Policy explains how Velos Mobile LLC ("Velos", "we", "us" or "our") collects, uses and shares personal information in connection with Wavelike, including our website at wavelike.ai, the Wavelike dashboard, API, command-line tool and SDKs (together, the "Services"). Capitalized terms that this policy doesn't define have the meanings given in our Terms of Service.

This policy applies during private beta and approved production pilots as well as after launch. Beta participation does not waive privacy rights or change our no-training commitment. Terms section 3.5 describes testing and pilot eligibility; sections 6 and 7 below describe monitoring choices and retention.

1. Scope: our customers' data

Wavelike is used by businesses and developers ("customers") to add AI features to their own applications. This policy covers two kinds of information differently:

• Information about our customers and website visitors, such as the people who sign up for an Account, use the dashboard or join our waitlist. We decide how this information is used, and this policy describes our practices for it.
• Customer Data, which is the content and data that customers and their End Users send through the Services, such as prompts, model responses, request logs and End User records. We process Customer Data on behalf of the customer that controls it, under our agreement with that customer. If you use an application built with Wavelike, the privacy policy of that application's developer governs how your data is handled, and you should direct requests about it to the developer. Section 3 summarizes how we process Customer Data.

Operational information, such as request counts, costs and error rates, may also be personal information when linked to an identifiable person. Calling it "Usage Data" in our Terms does not remove its protection under privacy law. We determine the purposes of processing account-level usage information for our own billing, service administration and security. We process End User identifiers and customer-specific request logs on the customer's behalf under the DPA. Where a customer itself acts as a processor, we act as its subprocessor.

2. Information we collect

2.1 Information you provide

• Account information: your name, email address and password when you create an Account. We store passwords only as salted hashes.
• Organization information: organization names, member lists and roles, and the email addresses of people you invite.
• Waitlist information: the email address and any details you submit when you request access.
• Billing information: when you buy credits, we share your name, email address and organization identifiers with our payment processor, Stripe, which collects your payment card details directly. We receive payment status, amounts and limited payment-method details, but not your full card number. To handle refunds and billing disputes, we also process purchase and refund identifiers, amounts, payment and request timestamps, applicable rate versions, price-notice delivery records, recharge settings, relevant credit-usage records, and related support messages.
• Communications and participation records: support requests, feedback, pilot approvals and related correspondence, including contacts, scope, duration and acceptance or withdrawal records. Feedback containing personal information or Customer Data remains subject to this policy and applicable processing agreements.
• Publicity permissions: contacts, correspondence, approved uses and dates needed to document or withdraw permission to use a customer's name or logo.

2.2 Information collected automatically

• Session and security information: IP address, browser user agent and timestamps when you sign in, and records of security-relevant actions in your Account, which we keep to protect Accounts and investigate misuse.
• Usage analytics: PostHog records page views and selected product events, such as signing up, signing in and creating an app. We do not use PostHog automatic click capture or session recording, and we do not attach names or email addresses to its events. PostHog also records the address of the page an event came from, which can contain an email address when you follow an invitation link. Retention is described in section 7.
• Error and performance monitoring: Sentry receives technical information to diagnose dashboard and API problems, such as browser information, page details, IP addresses, error reports and performance measurements. We configure error reporting on our API not to collect request bodies, cookies or credentials. An error message can still quote part of the request that caused it, for example when a model provider's error repeats it. Sentry Session Replay, described in section 6, is separate from ordinary error reporting. It runs only on our own website and dashboard, never in customers' Apps.
• Cookies and similar technologies: see section 6.
• CLI and SDK metadata: the name and version of the Wavelike command-line tool or SDK, and for the SDK the operating system and platform it runs on, when they connect to the Services.
• Account-level operational information: request and token counts, model and provider identifiers, costs, timing and error rates used for billing, service administration and security, as distinguished from Customer Data in section 1.

2.3 Information from third parties

• Enterprise identity providers: if your organization signs in through single sign-on or provisions users with SCIM, we receive the details your identity provider is set up to send, such as your name, email address, a directory identifier and group memberships.
• Payment processor: Stripe tells us whether a payment succeeded and provides related transaction details.

3. Customer Data we process for customers

To provide the Services, we process Customer Data on our customers' instructions. Depending on how a customer configures Wavelike, this can include:

• Requests and responses: prompts, messages, files, images, audio, tool results and model outputs that pass through the Services.
• Request logs: metadata for the requests the Services process, such as identifiers, the model and provider used, token usage, cost, timing and errors, and, if the customer enables content capture, the content of requests and responses. Dashboard test runs capture content even when ordinary content capture is disabled, unless a zero-retention policy applies. Captured payloads are stored encrypted with a key specific to the customer's organization. So that customers can search their logs, we also keep a searchable text extract of captured content in our database for the same retention period. The retention periods and deletion process are described in section 7.
• Response caches: the Services may temporarily cache responses to serve repeated requests. A zero-retention policy disables both content capture and response caching, including for dashboard test runs. Zero retention does not eliminate transient processing needed to answer a request, or the retention of request metadata, End User records and billing or security records that do not contain request or response content.
• End User records: identifiers the customer assigns to its End Users, and names, email addresses and other profile details provided through the customer's sign-in method, including Wavelike Connect.
• Device information from the SDK: a device or user identifier, and the SDK, operating system and platform versions. By default the identifier is one the operating system limits to the App developer's own apps; the customer can supply its own instead.

Restricted sensitive data. Terms section 4.3 restricts intentional submission of HIPAA-regulated health information, PCI-covered payment-card data, government identification numbers, financial-account credentials and other specified sensitive data. Exceptions require a separate signed agreement and our written confirmation of legal and technical readiness for Wavelike and the relevant providers, with required agreements and safeguards in place before processing. Ordinary beta or production-pilot approval does not authorize an exception. Payment through the designated billing processor's intended payment flow is separate from submitting card details in customer content or support messages. These restrictions do not remove our obligations under this policy, applicable law or the DPA for information we actually receive.

We use Customer Data only to provide, secure and support the Services for the customer, and as the law requires. We send Inputs to the model providers the customer selects. For some providers, which use it to detect abuse, we also send a pseudonymous identifier for the End User rather than the customer's own identifier. We do not use Customer Data to train or fine-tune machine-learning models. A pseudonymous identifier is not anonymous data, and Inputs themselves may contain identifying information supplied by the customer or End User.

Personnel access. Our personnel may view Customer Data, including prompts and responses, only as reasonably necessary to follow the customer's authorized instructions, resolve a support issue the customer raises, protect security or service integrity, investigate suspected abuse, or comply with legal obligations. A support request from the customer or its authorized representative authorizes access reasonably necessary for that issue without separate approval for each investigative step. Unrelated access requires separate authorization unless one of those security, service-integrity, abuse or legal exceptions applies. Access is limited to authorized personnel with a need to know, subject to confidentiality obligations, restricted permissions and access records. We do not routinely review customer prompts or responses for product research. These permissions remain subject to the DPA and applicable law; they do not expand retention, override zero-retention settings, permit ordinary support access to isolated backups or authorize model training. Dashboard replay remains subject to section 6.

Model-provider retention and training practices depend on the provider, account, feature and applicable contractual terms. Wavelike's own no-training commitment applies regardless of the provider selected. Our routing policies and reliance on customer attestations for customer-supplied credentials are described in section 7.4 of the Terms. The DPA governs our obligations when we engage a subprocessor.

4. How we use information

We use the information described in section 2 to:

• create and secure Accounts, authenticate you and keep you signed in;
• provide, operate and maintain the Services, including your organization's apps, settings and request logs;
• process payments and refunds, resolve billing disputes, maintain your credit balance and send billing alerts;
• send service communications, such as verification emails, invitations, access approvals, price-change notices and notices about the Services or these policies;
• respond to your requests and provide support;
• administer publicity permissions and withdrawals, and publish customer names or logos only within the permission described below;
• understand how the Services are used, fix errors and improve the Services, including producing anonymous aggregate statistics for internal product improvement and business reporting under section 7;
• detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms; and
• comply with legal obligations and enforce our rights.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to make decisions that have legal or similarly significant effects on you.

We use customer names and logos in publicity only with prior written permission. Terms section 18.5 describes withdrawal, removal and treatment of printed materials. Beta participation does not grant publicity permission. Where publicity involves an individual's personal information, applicable privacy rights also apply; company logo approval alone does not authorize publication of employee information.

For processing subject to the GDPR or UK GDPR where we act as controller, our legal bases depend on the purpose and your relationship with us:

Where we rely on legitimate interests, we assess those interests against your rights and interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Consent and objection choices for cookies and similar technologies are described in section 6.

You do not have to provide personal information, but we may be unable to create an Account, process a purchase or provide requested support without the information needed for that purpose.

5. How we share information

We share personal information only as follows:

• Service providers that host and operate the Services for us under contracts that limit their use of the information: Cloudflare (hosting, storage and email delivery), Neon (database hosting), PostHog (product analytics) and Sentry (error and performance monitoring and session replay).
• Payment processing: Stripe receives information needed to process payments. To the extent Stripe acts independently for purposes such as its own legal compliance, its privacy notice governs that processing.
• Model providers and connected tools selected or authorized by the customer, which receive Customer Data as needed to process requests, as described in section 3. Where we engage a provider as a subprocessor, our DPA and the applicable subprocessor agreement govern that processing. Where a customer connects its own provider account or tool, its agreement with that provider also applies. Provider terms do not reduce our obligations under the DPA or applicable law.
• Your organization: other members of your organization can see your name, email address, role and activity in the organization's Account.
• Legal and safety: when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of Velos, our customers or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy's protections.
• With your direction or consent.

Subprocessor register. The table below identifies providers used for processing on our customers' behalf. Terms Schedule A is the DPA; it applies automatically to that processing. Providers acting only for our own controller purposes are disclosed above and are not automatically customer subprocessors.

These providers process data in the United States and in the other countries where they or their own providers operate. Cloudflare handles requests on its global network, at locations near the person making the request.

Subprocessor changes. For personal data we process on a customer's behalf, the DPA and Terms section 8.4 provide general authorization for listed subprocessors for their listed purposes. We maintain the register and email affected customers at least 30 days before an added or replacement subprocessor begins processing their personal data. Customers may object in writing during that period on reasonable data-protection grounds. We work to resolve objections, including seeking a reasonable alternative; if unresolved, either party may terminate affected Services under section 8.4, with the customer's unused-prepayment refund rights described there. We do not begin the objected-to processing while a timely objection remains unresolved. This process does not override customer routing selections or data policies. A customer may specifically authorize an earlier start for a disclosed subprocessor; an emergency alone does not waive authorization requirements. These contractual customer rights are separate from individuals' rights under section 10.

6. Cookies and similar technologies

We use cookies and browser storage for:

• sign-in and security: a session cookie, which the Services need in order to keep you signed in;
• preferences: your appearance setting and the last App you opened;
• waitlist status: a cookie that holds the email address you submitted, kept for 90 days; and
• analytics and monitoring: PostHog storage that lasts up to a year, and Sentry storage that lasts for a visit.

Session replay. During the private beta, Sentry Session Replay runs on wavelike.ai, including the dashboard. It records a sample of visits, and visits in which an error occurs, so that we can reproduce problems. Text, form inputs and media are masked in your browser before a recording is sent. A replay shows the layout of each page, the addresses of the pages you visited and of the requests they made, and how the pointer moved, but not the text on the page or what you typed.

Your choices. We do not yet offer an in-product control for analytics or session replay. You can block cookies and site storage in your browser, although blocking the sign-in cookie prevents sign-in. To object to analytics or session replay, or to ask us to delete data they hold about you, email privacy@wavelike.ai. Accepting the Terms does not replace any consent that the law requires. We do not respond to Do Not Track or Global Privacy Control signals; as section 4 explains, we do not sell personal information or share it for cross-context behavioral advertising.

7. Retention

We retain personal information for the purposes below and delete it, or anonymize it where appropriate, when it is no longer needed. We determine retention using the information's purpose and sensitivity, customer instructions and settings, applicable legal requirements, and the operational criteria in this table. Beta status does not authorize indefinite retention or override deletion rights.

Anonymous aggregate statistics. We may retain aggregate statistics, such as monthly signup totals, feature-adoption percentages and service-wide latency trends, after deleting the underlying records, only after verifying that they cannot reasonably identify an individual or customer organization, including through combination with other reasonably available information. We use them only for internal product improvement and business reporting, retain them while useful for those purposes, and periodically review their continued need and anonymity. The retained statistics exclude prompts, responses, session replays, credentials and identifiable activity histories. Replacing or hashing identifiers alone does not make records anonymous. Creating statistics does not extend the retention of underlying records or override deletion requirements or the DPA. This permission does not authorize model training, sale of the statistics or public customer benchmarking.

Backups. Our infrastructure providers keep backups so that the Services can be recovered. Backups expire on a limited cycle. We use them only for recovery or legally required preservation, not for ordinary support, debugging, analytics or model training. If we restore from a backup, we reapply required deletions before ordinary use resumes. Copying or restoring a backup does not restart its expiry or revive expired retention periods. Active exports cannot be kept longer merely by calling them backups. These rules also apply to replay backups and do not authorize backing up zero-retention content.

Earlier deletion requirements under applicable law or the DPA take precedence. Where law requires preservation of particular information, we limit retention to that information and purpose and delete it when the requirement ends.

After termination, section 12.4 of the Terms and the DPA govern return and deletion of Customer Data. An export opportunity does not extend shorter retention settings or recreate deleted data. Continued distribution of an already-integrated SDK does not extend data retention or API access. Model providers' own retention is governed by the arrangements described in sections 3 and 5.

8. Security

We use administrative, technical and physical safeguards designed to protect personal information. They include encryption in transit, encryption of captured request payloads with a key specific to each organization, hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach affecting personal data we process on a customer's behalf, we notify that customer without undue delay. We provide available information initially, without waiting for a completed investigation, and further relevant information without undue further delay as it becomes available. We provide cooperation required by the DPA and applicable law. Stricter notification requirements under applicable law, the DPA or a separately agreed contract take precedence. We also notify affected individuals and regulators where required by applicable law, including for information we process as a controller.

9. International transfers

We are based in the United States. We and our providers process information in the United States and in the other countries where our providers operate, as section 5 describes. Those countries may have different data-protection laws from your country. If you use the Services from outside the United States, your information is sent to us there.

During the private beta, we have not yet put in place the transfer mechanisms, such as standard contractual clauses, that EEA, UK and Swiss law require when a customer sends us personal data that those laws protect. Schedule A.10 of the Terms asks customers not to submit that data until we have agreed a mechanism with them in writing. Customers can ask for one at legal@wavelike.ai. To ask what safeguards apply to your own information, contact us under section 13.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and receive a copy of it in a portable format;
• correct inaccurate personal information;
• delete your personal information;
• object to or restrict certain processing, or withdraw consent where we rely on it;
• opt out of sale, sharing, targeted advertising or certain profiling, or limit certain uses of sensitive personal information, where applicable;
• appeal a refusal to act on a request, where applicable; and
• lodge a complaint with your local data protection authority.

As described in section 4, we do not sell personal information, share it for cross-context behavioral advertising, or use it to make decisions that have legal or similarly significant effects on you.

To exercise your rights, use the privacy email or request method in section 13. Where verification is needed, we use measures proportionate to the request and the information involved, such as confirming access to an existing Account or email address. If you do not have an Account or cannot access it, contact us so we can use an appropriate alternative. We request only information reasonably necessary for verification and do not require you to create an Account to make a request.

We respond within the time required by applicable law and explain any permitted extension or refusal. Where you have a right to appeal a refusal, contact us through section 13, state that you are appealing and identify the request. We will explain our appeal decision and any available route to the relevant regulator within the applicable deadline. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights.

The customer dispute process in section 17 of the Terms does not delay privacy requests or complaints to a regulator, or restrict judicial remedies that applicable law does not allow to be waived. You do not have to complete that informal process before exercising those rights. End Users do not become parties to the Terms merely by using a customer's App.

If your information is part of Customer Data, such as information about you as an End User of an application built with Wavelike, please contact the developer of that application, which controls that data. We will help our customers respond to such requests.

California residents. In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above: identifiers (such as name, email address and IP address); commercial information (such as purchases of credits); internet or other electronic network activity (such as usage events and error reports); professional information (such as your organization and role); and account log-in credentials, which we use only to authenticate you and secure your Account. We disclose these categories to the service providers listed in section 5 for business purposes. We have not sold or shared personal information, as those terms are defined in California law.

11. Children

Our website and dashboard are intended for business customers and their personnel, not directed to children. Individuals who accept the Terms or use the Services as customer personnel must be at least 18. This account eligibility requirement is separate from the audience of a customer's application.

Customers determine the audiences of their applications. When we process personal information about their End Users on their behalf, we do so under the DPA and their lawful instructions. Customers are responsible for complying with applicable children's privacy and safety requirements, providing required notices and obtaining required consents and authorizations, including verifiable parental consent where required. They must also comply with the applicable Model Provider restrictions. Section 4.4 of the Terms addresses these responsibilities. This allocation does not relieve us of our own obligations under applicable law or the DPA.

If you believe a child has provided personal information directly through our website or dashboard, or that children's information is being processed through a customer's application unlawfully, contact us under section 13. We will investigate and take appropriate steps, including coordinating with the customer and deleting information where required. For information processed on behalf of a customer's application, you may also contact that application's developer under section 10.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy at wavelike.ai/privacy and change the "Last updated" date. If we make material changes, we will notify you by email or in the dashboard before they take effect. We will identify the effective date of a revised policy. Where law requires consent or another step before a new use of information, we will complete that step; posting a revised policy alone does not authorize the new use. If a change also amends the Terms, their notice and acceptance requirements apply.

13. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

• Privacy email: privacy@wavelike.ai.
• Postal address:

Velos Mobile LLC
Attn: Privacy
3130 20th Street, Suite 100
San Francisco, CA 94110

For billing, refunds or price-change questions, use billing@wavelike.ai. For contractual notices, use legal@wavelike.ai. Privacy requests and appeals may be submitted by email without creating an Account or using a separate form.