Privacy Policy

WaitPing, operated by Pinotech LLC ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our waitlist management service.

By using WaitPing, you agree to the collection and use of information in accordance with this policy. This Privacy Policy is part of our Terms of Service.

Information You Provide

• Account Information: Name, email address, phone number, company name, and password
• Waitlist Data: Guest names, phone numbers, email addresses, party sizes, and custom field data you choose to collect
• Payment Information: Billing information processed securely through Stripe (we do not store credit card details)
• Communications: Messages you send to us, including support requests and bug reports

Information Automatically Collected

• Usage Data: Pages visited, features used, time spent, and actions taken within the application
• Device Information: Browser type, operating system, IP address, and device identifiers
• Cookies: We use cookies and similar technologies to maintain your session and improve your experience
• Activity Logs: Account activity, login times, and data modifications for security and audit purposes

We use the collected information for the following purposes:

• Service Delivery: To provide, operate, and maintain our waitlist management service
• Account Management: To create and manage your account, process transactions, and provide customer support
• Communication: To send you service updates, security alerts, and administrative messages
• Improvements: To understand how you use our service and improve features and functionality
• Security: To detect, prevent, and address technical issues, fraud, and security threats
• Legal Compliance: To comply with legal obligations and enforce our terms of service

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide the Service you signed up for (account management, waitlist operations, billing)
• Legitimate Interest: Processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security, where those interests are not overridden by your rights
• Consent: Processing based on your explicit consent, such as sending optional marketing communications or setting analytics cookies. You may withdraw consent at any time
• Legal Obligation: Processing necessary to comply with applicable laws and regulations

We may share your information in the following circumstances:

• Service Providers: We share data with trusted third-party providers who help us operate our service (e.g., hosting, email delivery, payment processing). These providers are contractually obligated to protect your data.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• Consent: We may share information with your explicit consent for specific purposes.

We do not share your personal information with third parties for their marketing purposes.

Data Processing Roles

WaitPing acts in two capacities depending on the type of data:

• Data Controller: For your account information (name, email, billing details), WaitPing is the data controller and determines the purposes and means of processing
• Data Processor: For guest and customer data you collect through the Service ("Customer Data"), WaitPing acts as a data processor on your behalf. We process Customer Data only as necessary to provide the Service and as instructed by you

For customers subject to GDPR or similar data protection regulations, our Data Processing Agreement (DPA) governs the terms under which we process Customer Data. To request a copy of our DPA, contact us at [email protected].

General Rights

• Access: You can access your personal data at any time through your account settings
• Correction: You can update or correct your information in your account settings
• Export: You can request a complete copy of your data in CSV format by contacting us at [email protected]
• Deletion: Account owners can permanently delete their account and all associated data at any time. Team members can request deletion through their account owner or by contacting us

GDPR Rights (European Union)

If you are in the European Union, you have additional rights under GDPR:

• Right to Data Portability: Export your data in a machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Restriction: Request restriction of processing in certain circumstances
• Right to be Forgotten: Request deletion of your personal data

Right to Lodge a Complaint

If you are in the EEA, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates applicable law.

CCPA Rights (California)

If you are a California resident, you have rights under CCPA:

• Right to Know: Request disclosure of data we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise any of these rights, contact us at [email protected]. Account owners can also manage certain rights directly from account settings.

We retain your personal information for as long as your account is active or as needed to provide you services. You can configure custom data retention policies in your account settings.

• Free Plan: Data retained for 30 days by default
• Starter & Business Plans: Unlimited data retention with customizable policies
• Deleted Accounts: Data permanently deleted immediately upon account deletion
• Legal Requirements: Some data may be retained longer if required by law

We implement industry-standard security measures to protect your information:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Secure password hashing using bcrypt
• Role-based access control (RBAC)
• Comprehensive activity logging and monitoring
• Regular automated backups in multiple geographic locations
• 24/7 security monitoring

While we strive to protect your information, no method of transmission over the internet is 100% secure. Learn more on our security page.

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for authentication and basic functionality
• Functional Cookies: Remember your preferences (theme, language)
• Analytics Cookies: Help us understand how you use our service (you can opt out)

You can control cookie preferences through your browser settings or our cookie consent banner. To withdraw consent for non-essential cookies after initially accepting them, clear your cookies via your browser settings or contact us at [email protected]. Disabling essential cookies may limit functionality.

We use third-party sub-processors for payment processing, cloud hosting, email delivery, and SMS messaging. Each sub-processor is bound by data processing agreements that require them to protect your data in accordance with this policy.

For a current list of sub-processors, contact us at [email protected]. We will notify account owners of material changes to our sub-processors.

WaitPing is not intended for children under 16 years of age (or under 13 in jurisdictions where COPPA applies). We do not knowingly collect personal information from children under these ages. If you become aware that a child has provided us with personal information, please contact us and we will promptly delete it.

Your information may be transferred to and processed in countries other than your country of residence, including the United States. When we transfer personal data outside the EEA, we rely on:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms that require the receiving party to protect your data to EEA standards
• Adequacy Decisions: Transfers to countries the European Commission has determined provide adequate data protection

You may request a copy of the safeguards we use for international transfers by contacting us at [email protected].

We do not sell, rent, or share your personal information with third parties for monetary or other valuable consideration. California residents can learn more about their CCPA rights in the "Your Data Rights" section above.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy with a new "Last updated" date
• Sending you an email notification (for significant changes)
• Displaying a notice in the application

Your continued use of WaitPing after changes become effective constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Security Concerns: [email protected]