Waya Privacy Policy

Waya is operated by Waterbear LLC, a Delaware limited liability company ("Waya," "we," "us"). We provide facilitated business methodologies through our services: the methodology servers at pro-mcp.wayaframes.com and pre-mcp.wayaframes.com, including when they come as part of a program. We also run the website at wayaframes.com.

This policy explains what we collect, why, and what your rights are. The services, the website, and our calls with you collect different information, so each has its own section. Questions or requests: info@wayaframes.com.

The services

You use Waya through an AI assistant of your choice that connects to our servers. We receive three kinds of information:

Your account. When you sign in, our sign-in provider gives us your email address and an account identifier. That is the only account information we hold about you.

Your session content. Waya takes you through a methodology step by step, and we store the notes you provide at each step verbatim. They come from business methodologies (problem statements, root causes, gap lists, business cases) and from personal methodologies like Ikigai (your reflections about yourself). We also store the confirmations you approve at checkpoints and the close-out record of each session. How Waya Handles Your Data explains where this content is stored and who can access it.

Your notes may mention other people, such as customers you interview or your team. Share only what the methodology needs and only what you have the right to share. We treat that information like the rest of your session content, and it is deleted with it.

Operational data. Timestamps, which methodology step was called, response times, which AI app you connected with and its declared capabilities, session tokens, security flags from our abuse detection, and standard server request logs.

Where the AI fits

The AI assistant you use is your client, operating under your agreement with its provider; we don't operate it. It sends your notes to our servers on your behalf, and our servers send the methodology back. We never use your content to train AI models.

If you work with us as a consulting client

We ask consulting clients to connect Waya under their own account, so this policy applies to them directly. When that isn't possible, our team runs the sessions under a Waya account on your behalf, and the same commitments apply to that content: it is stored and protected as described here, only our team reviews it, and we delete it when you ask.

How we use your information

• To provide the service: serving the methodology, letting you resume sessions, and carrying your prior work into later sessions. (Legal basis: our contract with you.)
• To improve the service: our team reviews session records, including the notes you provided, to find where a session went off track and improve the methodology. This review is internal to our team. Our people sometimes use AI tools to help, only under business terms that bar the provider from training on our data, so your content never becomes AI training data. (Legal basis: legitimate interest.)
• To keep the service safe: automated detection of scraping and abuse. (Legal basis: legitimate interest.)
• To respond to you when you contact us. (Legal basis: legitimate interest.)

We do not sell your personal information, we do not share it for advertising, and we show no ads.

The website

wayaframes.com is a static website. It collects three kinds of information:

• What you send us. If you fill out a form, book a call, or buy a program, what you submit (typically your name and email) goes into our CRM, and payments are handled by our payment processor. We use it to respond to you, to deliver what you bought, and to send you email about Waya. Every email includes an unsubscribe link, and you can unsubscribe at any time. (Legal basis: our contract with you for what you buy; otherwise our legitimate interest in responding to you and telling you about Waya.)
• Analytics, only with your consent. The site asks before it turns on analytics. If you click Accept, our website analytics tool records how you use the site: pages viewed, clicks, scrolling, and mouse movement (heatmaps). It may also record your visit as a session replay, a reconstruction of what happened on the page with anything you type masked. If you click Decline, no analytics run. (Legal basis: your consent.)
• Request logs. Our website host keeps standard request logs. (Legal basis: our legitimate interest in keeping the site secure and running.)

Before you choose, the site stores two things in your browser: your cookie choice, and the link or site that brought you to wayaframes.com. When you book a call, that second item is added to the booking link, so it reaches our CRM with your booking.

Some pages embed videos from a video platform in its privacy-enhanced mode. The video platform receives the standard information your browser sends when it loads them, such as your IP address. Our CRM's forms and booking pages may set their own cookies.

Browsers can send a "Do Not Track" signal. Because there is no common standard for honoring it, the site does not change its behavior when it receives one; analytics run only if you click Accept.

The services and the website are separate. Browsing the site does not create a service account, and using the services does not add you to our CRM. Buying a program does: your contact and purchase details are kept there.

Calls with us

If you book a call with us, we may record and transcribe it with meeting tools, and we keep the recording, the transcript, and our notes in our workspace tools and our CRM. We use them to follow up with you and to prepare our work together. If you would rather not be recorded, tell us at the start of the call. (Legal basis: our legitimate interest in following up and preparing our work together.)

Business outreach

We may contact you about Waya using business contact details from public professional sources or from business data providers. If you would rather not hear from us, reply or unsubscribe and we stop. (Legal basis: our legitimate interest in telling businesses that may benefit from Waya about it.)

Who we share information with

We use a small number of service providers to run Waya. They process your information on our behalf and under contract. These are the kinds of providers we use:

Beyond these providers, we disclose personal information only if the law requires it, or as part of a corporate transaction (in which case this policy's obligations follow the data).

Where your information is processed

We are a US company and process your information in the United States. If you use Waya from the EU, the UK, or elsewhere, your information is transferred to the US. Our providers maintain recognized transfer safeguards (Data Privacy Framework certification and/or Standard Contractual Clauses); details on request.

How long we keep it

We keep session content for the life of your account, so you can return to past sessions. When you ask us to delete your account, we erase everything keyed to you within 30 days of receiving your request; residual copies in encrypted backups expire on a rolling schedule within a further 30 days. We keep call recordings and transcripts for up to 2 years after the call, then delete them. We keep website form submissions, purchase records, and call notes until you ask us to remove them, except where the law requires us to keep purchase records longer.

Your rights

You can ask us, at any time, to:

• Access the personal information we hold about you;
• Export it (a machine-readable copy of everything keyed to your account);
• Correct it;
• Delete it: your account and all session content;
• Object to a use of it, including the service-improvement review described above.

Email info@wayaframes.com. We will verify that the request comes from the account holder, acknowledge it, and fulfill it within 30 days of receiving it.

If you are in the EU or UK, these are your GDPR rights and you also have the right to complain to your supervisory authority. If you are a California resident: we do not sell or share personal information as those terms are defined in the CCPA, and the rights above match those the CCPA provides.

Security

We encrypt data in transit and at rest. Access to our databases is locked down: no public key or database role can read your content, and only our server, and our team through the database console, can. Staging and production environments are separate, and changes ship through pull requests with automated tests. How Waya Handles Your Data describes what we store and who can access it.

If a breach affecting your personal information occurs, we will notify affected users without undue delay, and within whatever deadline the law sets.

Children

Waya is for business use by adults. The services are not directed to anyone under 18, and we do not knowingly collect information from anyone under 18.

Changes to this policy

When we change this policy, we update the date at the top and, for material changes, notify account holders by email before the change takes effect.

Contact

Waterbear LLC, operating as Waya
5013 S. Louise Ave, Unit 646, Sioux Falls, SD 57108, United States
info@wayaframes.com