Privacy Policy

TheWavly (“we”, “us”, “our”) operates the TheWavly Agentic Revenue Operating System at thewavly.com. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our service, websites, and related APIs.

• Account & billing contacts — TheWavly is typically the controller for your login identity, subscription records, and support correspondence.
• Workspace Revenue Graph data — For CRM sync, product events, agent drafts, and attributed outcomes you instruct us to process, TheWavly acts as a processor on your documented instructions (see DPA).
• This policy covers thewavly.com, the authenticated app, conversion webhooks, and transactional email. It does not cover third-party sites you connect via OAuth.

• Account information — name, email, authentication credentials via Supabase Auth; workspace membership and roles.
• Revenue Graph data — accounts, opportunities, product/usage events, integration metadata, agent handoffs, and attributed outcomes you create or sync.
• Configuration — ICP definitions, governance tiers, brand voice, playbooks, and Customer Revenue DNA™ cluster settings.
• Usage data — feature usage, operator actions, performance metrics needed to run and improve the OS.
• Payment information — processed by Stripe and/or Razorpay. We do not store card numbers on TheWavly servers.
• Device & log data — IP address, user agent, timestamps, security events (signature failures, rate limits) for abuse prevention and audit.

• Provide, operate, secure, and maintain the Agentic Revenue Operating System.
• Run Scout · Closer · Keeper · Grower with governed autonomy — drafts, elevations, and plays with provenance.
• Call model APIs (currently OpenAI) to generate drafts and analysis. Campaign / Graph context may be sent for processing; it is not used to train their foundation models under our provider terms.
• Process payments and manage subscriptions via Stripe / Razorpay.
• Send transactional email, digests, and operational alerts (opt-out for non-essential marketing).
• Detect abuse, debug incidents, and improve reliability and UX.
• Comply with law and enforce our Terms.

Revenue Memory stores attributed outcomes so agents improve within your workspace. Customer Revenue DNA™ profiles are learned from your top customers and used to score new visitors/accounts — with match rationale shown to operators.

Memory and DNA are not sold, not used to train cross-tenant models for other customers, and remain subject to workspace isolation (RLS). Aggregated, anonymized product analytics may be used to improve the platform without identifying your accounts.

We share data with subprocessors necessary to operate the service, including:

• Supabase — authentication and Postgres (RLS).
• Vercel — application hosting.
• OpenAI — model API for drafts and analysis.
• Stripe / Razorpay — payment processing.
• Resend — transactional email.

CRM / product connectors you authorize (e.g. HubSpot, Salesforce, Zoho, Slack, PostHog) receive or provide data under your OAuth instructions — they are your processors or controllers for that path, not TheWavly marketing partners.

We do not sell personal data. We may disclose information if required by law or to protect rights, safety, and security.

See Security for architecture detail and DPA for processor terms.

When a workspace administrator connects Google Calendar, TheWavly requests the https://www.googleapis.com/auth/calendar.events scope. We use this permission only to create confirmed scheduling events with attendees and Google Meet links, validate the connection with a minimal event-list request, and record scheduling execution evidence in that workspace. TheWavly does not request permission to manage calendars, sharing settings, or unrelated Google services.

• Storage and security — OAuth refresh tokens are encrypted at rest, isolated by workspace, masked in the product interface, and used only by the scheduling integration.
• Sharing and advertising — We do not sell Google user data, use it for advertising, or transfer it except to subprocessors needed to provide and secure this user-facing feature, when required by law, or with the user's explicit consent.
• AI and model training — Google Calendar API user data is not used to train generalized or non-personalized artificial-intelligence or machine-learning models.
• Human access — TheWavly personnel do not read Google user data unless the user gives explicit permission for support, access is necessary to investigate security or abuse, or access is required by law.
• Control and deletion — A workspace administrator can disconnect Google Calendar in TheWavly to delete the stored integration credential, and can separately revoke TheWavly in their Google Account. Requests to delete related account data may be sent to privacy@thewavly.com.

TheWavly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use essential cookies to maintain authenticated sessions. We may use first-party attribution links to measure click-through on Closer-attributed pages. We do not run third-party advertising trackers on the app.

You can review or change your optional analytics and attribution choices on this device. Essential storage remains on for sign-in and security.

We implement industry-standard measures including TLS, database row-level security, encrypted secrets, HMAC webhook verification, and governance audit trails. No system is 100% secure; we take reasonable precautions and improve continuously. Full detail: Security page.

• Account and Graph data retained while your workspace is active.
• Workspace deletion: in-app workflow with approximately 30 days grace before hard delete of Graph rows (backups may persist for a limited recovery window per infrastructure provider).
• Security logs retained for abuse prevention and audit as reasonably necessary (typically up to 12 months unless law requires longer).
• Billing records retained as required for tax and accounting.

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete personal data.
• Opt out of non-essential marketing email.
• Request a portable copy of your data.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with a supervisory authority.

Exercise rights via privacy@thewavly.com. We may need to verify identity before fulfilling requests.

For individuals in the EEA / UK, we process personal data under contractual necessity, legitimate interests (securing and improving the service), and consent where required. Enterprise Graph processing is typically on documented controller instructions under a DPA.

For individuals in India, we comply with the Digital Personal Data Protection (DPDP) Act, 2023. You may exercise rights under applicable law by contacting privacy@thewavly.com.

TheWavly and its subprocessors may process data in regions where those providers operate (default Graph/Auth primary: United States). Dedicated EU residency is sales-led infrastructure when provisioned — not a self-serve toggle. Where required, we use appropriate safeguards (such as contractual clauses with processors). Operators can view the current deployment disclosure in Settings → Team → Security.

The service is directed to business users 18+. We do not knowingly collect personal data from children. Contact us if you believe we have — we will delete promptly.

We may update this policy from time to time. Material changes will be communicated via email or in-app notice. Continued use after the effective date constitutes acceptance where permitted by law.

Privacy and data-rights: privacy@thewavly.com

Security questionnaires / DPA: hello@thewavly.com · /security/dpa

Legal: legal@thewavly.com