Privacy Policy

This Privacy Policy explains how WaveBump ("we", "us") processes personal data when you use our websites, applications, and related services (the "Service"). It is written with GDPR principles in mind and is intended to remain adaptable across jurisdictions.

This Policy should be read with our Terms of Service and Cookie Policy.

WaveBump is the controller of personal data processed to operate Accounts, secure the platform, provide billing, and improve the Service.

When you upload contact databases, recipient lists, or other personal data about third parties into promo, CRM, or email features, you typically act as the controller of that data, and WaveBump processes it on your instructions as a processor to provide the Service — except where WaveBump must process such data for its own compliance, security, or abuse prevention purposes.

Depending on how you use the Service, we may process:

• Account data — email address, password hash, name and profile fields you provide, account type, Workspace membership, and verification status.
• Authentication & security data — login events, approximate IP-derived location signals, user agent, session identifiers, multi-factor authentication configuration, and trusted-device tokens.
• Billing data — plan selection, invoices, payment status, and limited billing identifiers. Full payment card details are handled by payment providers when used.
• User Content — music files, artwork, metadata, promotional materials, comments, feedback, and files you upload or generate in the Service.
• Contact & recipient data — information you import or enter about contacts and campaign recipients (for example names, emails, roles, and notes).
• Usage & product analytics — feature usage, campaign and link engagement metrics, and diagnostic events needed to operate and improve the Service.
• Support communications — messages and attachments you send to support or through in-product assistance channels.
• Legal acceptance records — accepted Terms version, Privacy Policy version, and acceptance timestamps associated with your Account.

We do not invent or claim processing of technologies we do not operate. If future features (such as expanded API access or AI-assisted tools) introduce new processing, we will update this Policy or provide supplemental notices before those activities begin.

We use personal data to:

• provide, maintain, and improve the Service
• authenticate users, protect Accounts, and prevent abuse
• operate promo campaigns, smart links, shared links, Discovery, analytics, downloads, and email distribution features you use
• manage Workspaces, roles, and collaboration
• process subscriptions, payments, and plan entitlements
• send service notices (security, billing, product-critical updates)
• provide optional product updates where permitted
• comply with legal obligations and respond to lawful requests
• enforce our Terms, Acceptable Use Policy, Community Guidelines, and Copyright Policy

Where GDPR or similar frameworks apply, we rely on one or more of the following bases:

• Contract — to provide the Service you request and administer your Account.
• Legitimate interests — to secure the platform, prevent fraud and abuse, understand product usage in an aggregated or operational way, and improve features, balanced against your rights.
• Consent — where required (for example certain non-essential cookies or optional communications).
• Legal obligation — where processing is required by applicable law.

You decide what User Content and contact data to upload. You must ensure you have a lawful basis to provide that data to WaveBump and to use it for music promotion, email distribution, or other configured purposes.

WaveBump processes this data to deliver the features you enable (hosting files, sending messages you authorize, showing analytics, enabling comments/feedback, and similar operations). We do not sell your contact databases.

We may share personal data with:

• service providers that help us host infrastructure, send email, process payments, store files, monitor reliability, or provide customer support, under confidentiality and data-processing terms
• Workspace members according to roles you configure
• recipients and collaborators when you intentionally share content, campaigns, or links
• professional advisors under confidentiality obligations
• authorities or complainants when required by law or necessary to protect rights, safety, or the Service

If WaveBump is involved in a reorganization, asset transfer, or similar corporate transaction, personal data may be transferred as part of that transaction subject to appropriate protections.

WaveBump may process data in countries other than your own, depending on hosting and service provider locations. Where required, we use appropriate transfer safeguards (such as standard contractual clauses or equivalent mechanisms available under applicable law).

We retain personal data for as long as needed to provide the Service, maintain Account and security records, meet legal and accounting requirements, resolve disputes, and enforce agreements. Retention periods vary by category. When data is no longer required, we delete or anonymize it in the ordinary course, subject to backup cycles.

We implement technical and organizational measures designed to protect personal data, including access controls, encrypted transport where appropriate, credential hashing, and optional multi-factor authentication. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Depending on applicable law, you may have rights to access, rectify, erase, restrict, or port personal data, and to object to certain processing. Where processing is based on consent, you may withdraw consent without affecting prior lawful processing.

You may also have the right to lodge a complaint with a supervisory authority. To exercise rights related to your Account data, contact us using the details below. We may need to verify your identity before responding.

If you are a recipient whose data was uploaded by a WaveBump customer, please contact that customer first, as they typically control that data. We can help route requests where appropriate.

WaveBump uses cookies and similar technologies as described in the Cookie Policy.

The Service is not directed to children under 16 (or the higher age of digital consent in your region). We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so we can take appropriate steps.

WaveBump may use automated signals to help detect abuse, spam, fraud, or security threats and to enforce plan limits. These processes are used to operate and protect the Service. We do not use automated decision-making that produces legal or similarly significant effects about you solely by automated means without appropriate human involvement where required by law.

We may update this Privacy Policy from time to time. The Effective Date, Last Updated date, and version number appear at the top of this document. Material changes may be communicated through the Service or by email. When you accept updated Terms or Privacy terms at registration or during a required re-acceptance flow, we record the relevant version and timestamp on your Account.

For privacy questions or requests, contact contact@wavebump.com.