Privacy Policy

This policy is published by Waves Web Studio, a sole proprietorship registered in India (GSTIN 36BYQPT2686E1ZR), which operates the Waves AI Pilot service ("Waves AI Pilot," "we," "us").

It applies to (1) businesses that create a Waves AI Pilot account ("customers") and their team members, and (2) prospects who chat with a customer's AI sales widget on the customer's own website or messaging channel ("visitors").

Our registered address, phone number, and the contact details of the officer who handles privacy questions and grievances are set out under "Grievance Officer" below and on our Contact page.

This distinction matters for who you should contact about your data, so we state it plainly rather than leaving it implied.

• For customer account data — the name, email, and organization membership of the people who sign in to Waves AI Pilot — we decide the purposes of processing. Under India's DPDP Act we are the Data Fiduciary for this data (the equivalent of a "controller").
• For visitor conversation data — the messages a prospect exchanges with a business's AI employee, and any contact details they share — the customer business decides why that data is collected and what happens to it afterwards. That business is the Data Fiduciary; we act as its Data Processor, processing the data on its instructions in order to operate the service.

In practice this means: if you are a prospect who chatted with a business's AI employee and you want your data accessed, corrected, or deleted, that request is properly addressed to that business. You may also write to us at the address below and we will either action it or pass it to the business responsible and tell you we have done so.

• Account data: name, email address, and organization membership, collected and managed through our authentication provider, Clerk.
• Business content you provide: your business profile, products, services, FAQs, business hours, and any knowledge documents, files, or website addresses you supply for your AI employee to draw on.
• Conversation data: messages exchanged between a visitor and your AI employee or your staff, and any contact details — name, email address, phone number — that a visitor chooses to share during a conversation, together with the page or channel the conversation started from.
• Operational and diagnostic data: AI response timing and token counts (used to monitor cost, performance, and usage quotas), rate-limiting counters, an audit record of sensitive staff actions, and error reports captured by our error-tracking provider, Sentry, with authentication cookies and similar sensitive headers stripped before the report is sent.

We do not operate advertising networks, we do not sell personal data, and we do not use your business content or your visitors' conversations to train or fine-tune any general-purpose AI model.

We do not ask for, and the service is not designed to collect, sensitive personal data or information as defined under the SPDI Rules — such as passwords in plain form, financial account details, health or medical records, biometric information, or data about sexual orientation. Passwords are handled entirely by Clerk and are never visible to us.

Because a visitor types freely into a chat window, a visitor could volunteer such information unprompted. We ask customers not to configure their AI employee to solicit it, and a visitor should not share it in a chat. If you believe sensitive information was captured in a conversation, contact the Grievance Officer below and we will have it removed.

Business content and knowledge documents are used only to ground that business's own AI employee's answers — never shared with, or used to answer, another business's prospects. Conversation data is used to operate the chat, qualify leads for the customer, and let the customer's staff take over a conversation when a human is needed. Operational data is used to monitor reliability and cost, enforce usage quotas, and detect and prevent abuse.

For account data, we process on the basis of performing the contract you entered into when you created an account, and to meet our own legal and tax obligations. For visitor contact details, our customer is responsible for obtaining consent. On the website chat widget only, our widget presents a standalone consent notice before contact details are stored, and a visitor who does not consent can still use the chat without their contact details being saved.

That notice does not apply to Instagram or WhatsApp. On those channels the person chose to message the business first, and no widget notice is shown. The customer business is the Data Fiduciary for those conversations and is responsible for its own privacy notice to the people who message it.

We use the following service providers. Each processes data only to deliver the function described, under its own terms and security commitments.

• Clerk — authentication and organization membership.
• Supabase — database storage for all application and conversation data, isolated per business at the database level.
• Google (Gemini) — the only AI provider we use. It generates AI responses and embeddings from the conversation and the business's approved knowledge. Message content, including messages received over Instagram, is sent to Gemini in order to produce a response.
• Sentry — error and performance tracking, with sensitive headers stripped before events are sent.
• Resend — delivery of transactional and notification email to customers.
• Vercel — application hosting and request logging.
• Meta Platforms — only where a customer connects WhatsApp or Instagram, in order to receive and send messages on those channels.

A customer can connect its Instagram professional account to Waves AI Pilot by logging in with Facebook ("Instagram API with Facebook Login") and choosing the Facebook Page that is linked to its Instagram account. This section describes exactly what we receive and do through that connection.

What we access, and which permission gives it.

• instagram_basic — the connected account's Instagram ID and username, so we can show the customer which account is connected and match incoming messages to the right business.
• instagram_manage_messages — the text of direct messages people send to the connected account, each sender's Instagram-scoped ID and each message's ID, and the ability to send replies from that account. We do not receive the sender's name or profile details. We do not store attachments: for a non-text message we keep only a note that one arrived.
• pages_show_list — the list of Facebook Pages the person manages, so they can choose the Page linked to their Instagram account.
• pages_manage_metadata — lets us subscribe the chosen Page to our app so Meta delivers that Instagram account's messages to us, and unsubscribe it when the customer disconnects.
• pages_read_engagement — the chosen Page's name and ID and the Instagram account linked to it, which Meta requires to read the Page.
• business_management — lets the login reach Pages and Instagram accounts that the customer manages through a Meta business portfolio. We use it for nothing else.
• Access token — the Facebook Page access token Meta issues for the chosen Page, plus the IDs that identify the connection (the Facebook Page ID and name and the app-scoped Facebook user ID of the person who connected). The token is stored encrypted in a restricted database table that no customer or visitor can read, used only to receive and send Instagram messages for that account, and never written to our logs. It is kept until the customer disconnects Instagram, removes our app, or deletes the business.

We do not access the account's or the Page's posts, media, comments, followers, or insights, and we never post anything.

Why. Only to receive direct messages sent to the connected business account, generate AI replies grounded in that business's own approved knowledge, and let its staff take over a conversation.

What we never do. Data we receive from Meta is never sold, never used for advertising or profiling, never used to train or fine-tune any AI model, and never shared with another business. Message text is sent to our AI provider, Google (Gemini), solely to produce the reply, and to no one else except the service providers listed above that host the data.

How long we keep it. Instagram messages are kept like any other conversation: permanently deleted after 24 months of inactivity, or sooner if the customer deletes them or its account. The access token is kept only while the account is connected, and is deleted when the customer disconnects Instagram, when the customer removes our app in Facebook, Instagram or Meta Business Suite, or when the business is deleted. Disconnecting stops all use of the account at once but does not by itself delete earlier conversations. If Meta sends us a data deletion request, we also delete every conversation received through that account, the connection record, and the account ID, username, Page ID and name, and user IDs.

How to revoke access. In Facebook, go to Settings → Business integrations and remove Waves AI Pilot; or in Meta Business Suite, go to Settings → Integrations → Connected apps and remove Waves AI Pilot; or in Instagram, go to Settings → Apps and websites and remove Waves AI Pilot; or have the customer disconnect Instagram in its dashboard. Step-by-step instructions, and how to ask for your data to be deleted, are on our Data Deletion Instructions page.

We comply with the Meta Platform Terms and Developer Policies.

Our service providers listed above operate globally, so personal data may be stored or processed on infrastructure located outside India, including in the European Union and the United States. Where that happens, we rely on the provider's own contractual data protection commitments. India's DPDP Act permits transfer outside India except to territories the Central Government restricts by notification; we will stop using a provider in a restricted territory if one is notified.

We maintain reasonable security practices and procedures proportionate to the data we hold, as required by Section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011. In concrete terms: all traffic is encrypted in transit over HTTPS; data is encrypted at rest by our database provider; each business's data is isolated at the database level by row-level security policies, and that isolation is verified by an automated test suite on every change we ship; access to production systems is restricted to the proprietor; secrets are held in environment configuration and never committed to source control; the public chat endpoint is rate limited per key, per address, and per conversation; and error reports are scrubbed of authentication cookies and similar sensitive headers before being sent to our error tracker.

No system is perfectly secure. We do not claim that ours is.

A visitor's conversation — its messages and any contact details captured from it — is automatically and permanently deleted after 24 months of inactivity, by a scheduled process rather than a manual one.

Business account data (business profile, products, services, FAQs, knowledge documents) is retained for as long as the customer's account is active, plus a short period after account closure to allow recovery from accidental deletion. Records we are required to keep for tax and accounting purposes — invoices and payment records — are retained for the period Indian law requires, which is longer than the periods above and applies even after an account is closed.

A customer or visitor may request earlier deletion at any time. See "Your rights" below.

Subject to applicable law, you may ask us to give you access to the personal data we hold about you, correct or complete it if it is inaccurate, export it in a portable form, or erase it. You may withdraw a consent you previously gave, and you may nominate another person to exercise these rights on your behalf in the event of your death or incapacity. Withdrawing consent does not undo processing that already lawfully happened.

A customer can export and permanently delete their entire account's data from the dashboard without contacting us. For anything else, write to the Grievance Officer below. We will verify that the request genuinely comes from you before acting on it — this protects you, not us.

We will acknowledge your request within 48 hours and complete it within 30 days. Where a request is complex and genuinely needs longer, we will tell you why before the 30 days are up. India's DPDP Rules permit up to 90 days; we are committing to the shorter period.

In accordance with Rule 5(9) of the SPDI Rules, 2011 and the grievance-redressal requirements of the Consumer Protection (E-Commerce) Rules, 2020, the following officer handles privacy questions, data rights requests, and complaints about this service:

Complaints are acknowledged within 48 hours and redressed within one month of receipt. If you are not satisfied with how we handled your complaint, you may escalate it to the Data Protection Board of India once that forum is operational, or to the consumer forum with jurisdiction over your matter.

Waves AI Pilot is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18, and customers should not configure an AI employee to collect personal data from children. If we learn that we hold a child's personal data without the verifiable consent of a parent or lawful guardian, we will delete it.

If a personal data breach affects you, we will inform you in plain language — what happened, what it may mean for you, what we have done about it, and what you can do — and we will notify the Data Protection Board of India where the law requires it.

We use cookies strictly necessary to keep a signed-in customer authenticated; these are set by Clerk and we do not use them to track you across other websites. The chat widget stores a small identifier in your browser's local storage so that you can return to your own recent conversations on that site. We do not use advertising or analytics cookies.

This policy is governed by the laws of India. The courts at Hyderabad, Telangana have exclusive jurisdiction over any dispute arising out of it.

We will update the "Last updated" date above when this policy changes and, for material changes, take reasonable steps to notify customers by email before the change takes effect.