Privacy Policy

1.1.The controller of the personal data described in this policy is WaveCom AS (business registration code 10756058, located at Endla 16, Tallinn, Estonia). For any privacy question or to exercise the rights in section 7, contact us at wavecom@wavecom.ee, or through the Contact link in the site footer.

2.1.Account data: your name, email address, postal address, country, company name and VAT number where supplied. We need this to create your account, issue invoices and apply the correct VAT treatment.

2.2.Contact-form submissions: your name, email address and message when you write to us through the Contact link in the site footer, so we can reply.

2.3.Order and billing data: the services you order, invoices, and payment status. Card details are handled by Stripe and never reach our servers.

2.4.Service data: the servers assigned to you and the actions you take on them through the dashboard.

2.5.Session technical data: each time you sign in, we record the raw IP address and browser user agent of that session, to secure your account and identify suspicious sign-ins. This is separate from, and not the same as, the hashed IP address described in clause 2.7 below.

2.6.Analytics and advertising data: cookies and advertising identifiers are used only if you consent. Before you make a choice, and if you decline, a limited signal about your visit still reaches our analytics provider — clause 5.3 sets out exactly what that contains. See also section 5 and our Cookie Policy.

2.7.Consent records: when you accept or decline cookies we store your choice, the time, the policy version, your browser's user agent, a salted one-way hash of your IP address, and a random identifier stored in your browser's local storage as "wc_consent_id" (see our Cookie Policy) that links this record to any later change of the same choice. We keep this to prove that consent was given, as required of us. The hash cannot be reversed to an address, and is distinct from the raw IP address recorded per session under clause 2.5.

3.1.To perform our contract with you: creating your account, provisioning servers, billing and support.

3.2.To meet legal obligations: retaining invoices and tax records, and retaining proof of cookie consent.

3.3.With your consent: analytics and advertising cookies. You may withdraw consent at any time without affecting processing carried out before withdrawal.

4.1.HostBill, our billing platform, which stores your account and invoice data.

4.2.Stripe, our payment processor, which handles card payments.

4.3.Tenantos, our server management platform, which provisions and controls the servers assigned to you.

4.4.Amazon Web Services, which delivers our transactional email through Amazon SES.

4.5.Google, Meta, LinkedIn and X, for analytics and advertising. Cookies, advertising identifiers and any recognition of you across visits happen only where you have consented. The limited signal described in clause 5.3 reaches Google whether or not you consent. See our Cookie Policy for the specific cookies involved.

4.6.PostHog, hosted in the European Union (Frankfurt), to understand how our pages are used and where visitors leave. Where you have consented, PostHog sets a cookie that recognises your visits and records your sessions on our site — pages viewed, mouse movement, clicks and scrolling — with everything you type hidden. If you are signed in, your visits are linked to your account by an internal number only, never your name or email address. If you decline, the limited signal described in clause 5.4 still reaches PostHog.

4.7.We do not sell your personal data.

5.1.Strictly necessary cookies are always set because the site cannot work without them. All other cookies are set only after you agree.

5.2.Our Cookie Policy lists every cookie, its provider, purpose and duration. You can change your choices at any time through the Cookie settings link in the footer.

5.3.What still reaches Google if you decline. Our analytics provider receives a limited signal for the pages you view and for some automatic interactions with them, such as scrolling through a page or beginning to fill in a form. That signal contains the address and title of the page, your IP address, your browser and device characteristics, and a temporary identifier generated for that visit. Google sets no cookie and stores nothing on your device for this. Declining does still store your choice itself on your device, so that we can honour it and prove it was made — the strictly necessary items described in clause 2.7 and in our Cookie Policy. Where you have not consented, we instruct Google not to use this data to personalise advertising. If you do consent, cookies are additionally set and your activity can be recognised across visits and devices.

5.4.What still reaches PostHog if you decline. PostHog receives the pages you view and the interactions you make with them, together with an identifier that PostHog calculates on its own servers from your IP address and browser characteristics, used only to count visits. PostHog sets no cookie and stores nothing on your device for this, makes no recording of your session, and does not link the data to your account.

6.1.Account and order data: for the life of your account and then as long as tax and accounting law requires.

6.2.Consent records: for as long as the consent is relied on, plus a further period sufficient to answer a regulatory query about it.

6.3.Session technical data: for the life of the sign-in session — up to seven days of inactivity, renewed for as long as you stay active. Signing out deletes the session record immediately; otherwise it is deleted the next time an expired session is presented to us, for example by returning after seven days of inactivity.

6.4.Analytics data held in Google Analytics: 14 months.

6.5.Analytics data held in PostHog: session recordings for 30 days; other usage data for the period PostHog retains it under our plan, which is currently at least 12 months. You can ask us to delete it at any time using the rights in section 7.

7.1.You have the right to access, correct, erase, restrict and object to the processing of your personal data, and the right to receive it in a portable form. To exercise any of these, email wavecom@wavecom.ee.

7.2.You may withdraw cookie consent at any time via the Cookie settings link in the footer.

7.3.You have the right to lodge a complaint with your national data protection authority.

8.1.If we change this policy materially we will update the effective date above and, where the change concerns cookies, ask for your consent again.