How Waya Handles Your Data
Last updated: October 22, 2026
This page describes what Waya stores from your sessions, where it is stored, who can access it, how it is protected, and how to get a copy or have it deleted. The Privacy Policy is the governing document, and this page is consistent with it.
What we store
| Category | What it is |
|---|---|
| Account | Your email address and an identifier from our sign-in provider. |
| Session content | The notes you provide at each methodology step, stored verbatim: from business methodologies (problem statements, root causes, gap lists, business cases) and from personal methodologies like Ikigai (your reflections about yourself). Also the confirmations you approve at checkpoints and the close-out record of each session. |
| Operational data | Timestamps, which step was called, response times, which AI app you connected with and its declared capabilities, session tokens, and security flags from abuse detection. |
| Request logs | Standard server logs at our hosting providers (IP address, request path, status). |
We store session content verbatim so you can resume a session and carry prior work into later ones.
What we don't do
- We never train AI models on your content. The AI assistant you use is your own client, under your agreement with its provider; we don't operate it.
- We don't sell your data, share it for advertising, or show ads.
- We don't move your content anywhere except the systems listed below.
Where it is stored and who can access it
Your account, session content, and operational data are stored in two production databases, one for each of our two servers, run by our database hosting provider in the United States. Request logs stay with our hosting providers. Access to the databases is limited:
- Access is locked down. Only the server, and the Waya team through the database console, can reach the databases. Row-level security is enabled, and the anonymous and authenticated database roles hold no grants, so no public API key or client role can read your content.
- The servers run at our application hosting provider, and sign-in goes through our sign-in provider. When our team reviews session records, it sometimes uses AI tools, only under business terms that bar the provider from training on our data. The website runs separately. The Privacy Policy lists the kinds of providers we use to run the services and the website.
People on the Waya team can read session records, including your notes, when they review how a session went, sometimes with the help of AI tools, to improve the methodology. This review is internal and limited to our team, and the Privacy Policy describes it.
How it is protected
- Encryption in transit (TLS) and at rest (database-level encryption).
- Separate environments: staging and production are distinct deployments with distinct databases, and we do not test against production data.
- Change management: changes ship through pull requests with automated tests, and the full history is version-controlled.
- Audit trail: every methodology call is logged with its timestamp and outcome.
- Abuse detection: automated flagging of scraping patterns.
We model these controls on SOC 2. We do not hold a SOC 2 certification or any other third-party attestation; if that changes, we will update this page.
Getting a copy of your data, or deleting it
Email info@wayaframes.com and, within 30 days of receiving the request, we will:
- Export: send you a machine-readable copy of everything keyed to your account, including your account record, sessions, notes, and close-out records.
- Delete: erase your account and everything keyed to it, including your identity at our sign-in provider. Residual copies in encrypted backups expire on a rolling schedule within a further 30 days.
We keep your content for the life of your account and delete it when you ask.