How Waytale handles personal data

1. Who operates Waytale and how to contact us

Wop Ltd Co operates and publishes Waytale, and can be contacted at hello@waytale.co. T. Cuppy is the publication director and data protection delegate/contact.

For privacy questions, rights requests or concerns, contact hello@waytale.co. Please include enough information for us to understand and respond to your request; do not send unnecessary sensitive information.

2. Scope

This policy applies to the public Waytale website, public visitor stories, organisation workspaces and related support interactions. It covers information collected directly from you, generated through use of the service, or provided by an organisation customer for a visitor experience.

Organisation customers may be controllers for visitor data that they decide to publish. Depending on the service configuration and the customer's instructions, Waytale may act as a processor or service provider for that visitor data. A data processing agreement may apply where required by law or contract.

3. Categories of personal data

• Account and contact data: name, email address, authentication details and account preferences.
• Organisation and Space data: organisation name, Space settings, team or collaborator information, roles, permissions and configuration supplied by the customer.
• Visitor story and content data: stories, translations, images, video, audio, locations, QR-code destinations and other material an organisation chooses to publish. This may contain personal data if the customer includes it.
• Support communications: messages, questions, attachments, feedback and the context needed to answer or resolve a request.
• Technical, device and usage data: IP address, browser and device characteristics, language, page or route visited, referrer, approximate diagnostic information and optional analytics events when consent has been granted.

We do not ask for sensitive personal data through ordinary public forms. If an organisation includes sensitive information in content, it remains responsible for having a lawful basis and appropriate permissions.

4. Sources

We receive data from you, your organisation or team administrator, the device and browser used to access the service, and service providers that support hosting, authentication, security or communications. Visitor content is generally supplied by the organisation that publishes the experience.

5. Purposes and GDPR legal bases

• Provide, secure and maintain the website and service, create accounts, authenticate users and deliver requested Space features: performance of a contract and our legitimate interests in operating a secure service.
• Publish and display organisation-approved stories, media, translations, QR-code experiences and routes: performance of the customer relationship, the customer's instructions, and where relevant the customer's own legal basis for visitor-facing content.
• Respond to support, service messages and account requests: performance of a contract, steps at your request before a contract, or legitimate interests in supporting users.
• Protect the service, investigate abuse, prevent fraud and keep technical records: legitimate interests and, where applicable, legal obligations.
• Measure optional product or public-site usage only after a visitor accepts analytics: consent. Declining does not affect access to Waytale.
• Meet legal, regulatory, accounting or dispute-resolution obligations: legal obligation or legitimate interests, as applicable.

Where we rely on legitimate interests, we balance those interests against your rights and expectations. Where consent is required, refusing or withdrawing it does not affect strictly necessary authentication or core service operation.

6. Processors, recipients and hosting

Personal data may be accessed by Waytale personnel and carefully selected providers that host, secure, authenticate, maintain or support the service. They may process information only for the relevant service purpose and under contractual or equivalent safeguards.

The site is hosted on Vercel, with the hosting configuration stated by the operator as Paris, France. Hosting configuration does not change the need to assess any service provider's own processing, logs, security practices or transfer mechanisms.

We may disclose information when necessary to comply with law, protect rights and safety, enforce terms, or support a corporate transaction. We do not sell personal data and do not share it for cross-context behavioural advertising.

7. International transfers and safeguards

Some providers or support operations may process data outside the European Economic Area, the United Kingdom or your state. When a restricted transfer applies, we seek an appropriate legal mechanism, such as an adequacy decision, standard contractual clauses, an applicable UK addendum, or another lawful safeguard. We also consider supplementary technical, organisational and contractual measures where appropriate.

The operator should complete the provider list and transfer assessment before final publication so this section can identify the actual service locations and mechanisms used by the live service.

8. Retention principles

We keep personal data only for as long as it is needed for the stated purpose, the customer relationship, security and service continuity, legal obligations, dispute handling, or the exercise or defence of legal claims. The exact period depends on the data category, account status, customer instructions and applicable law.

No fixed retention periods have been supplied for this version. The operator should complete a documented retention schedule before final publication and apply deletion or anonymisation when the relevant period ends.

9. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure. Measures may include access controls, authentication, least-privilege administration, encrypted transport, monitoring and provider security controls.

No online service can guarantee absolute security. Please use strong credentials, keep access details confidential and tell us promptly if you suspect unauthorised access.

10. Your rights and how to exercise them

Depending on where you live and the role Waytale has for the relevant data, you may ask us to access, correct, delete, restrict or object to processing, receive a portable copy, or withdraw consent. Contact hello@waytale.co with the right you want to exercise and the account or organisation context needed to locate the data.

We may verify your identity and authority before responding. Verification is limited to information reasonably needed to protect the account and other people; we do not require you to disclose more than necessary. We generally respond within the period required by applicable law and explain any extension or refusal.

If an organisation is the controller of visitor content, contact that organisation first for requests about content it supplied or published. Waytale will assist the customer as required by the applicable arrangement and law.

11. GDPR supervisory authority

If you are in the European Economic Area, you may complain to the supervisory authority in the country where you live, work or believe an infringement occurred. The operator should complete its establishment and lead-authority details, if applicable, before final publication. You may contact us first, but this does not limit your right to complain directly to a supervisory authority.

12. California privacy rights

If the California Consumer Privacy Act, as amended by the CPRA, applies to our processing, California residents may have the right to know or access categories and specific pieces of personal information, request deletion, request correction, and receive information about disclosures. You may also opt out of the sale or sharing of personal information, including sharing for cross-context behavioural advertising, where those concepts apply.

Waytale does not sell personal data and does not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics unless legally permitted and needed to provide the service. Where applicable, you may limit the use or disclosure of sensitive personal information, request non-discrimination, and ask for verification of an authorised agent or request.

Submit a California request to hello@waytale.co. We may verify the request using account, contact or other reasonable information and will not discriminate against you for exercising a privacy right. The operator should complete any category-specific California disclosures required for the live business before final publication.

13. Virginia privacy rights and appeal

If the Virginia Consumer Data Protection Act applies, Virginia residents may have rights to confirm processing, access, correct, delete, obtain a portable copy and opt out of targeted advertising, the sale of personal data or profiling in furtherance of decisions that produce legal or similarly significant effects. Waytale does not sell personal data or use it for cross-context behavioural advertising.

Contact hello@waytale.co to make a request. If we decline, you may appeal the decision by replying to our response or writing to the same address with the reason you believe the decision should be reconsidered. We will review the appeal and provide a response within the period required by applicable law.

14. Connecticut privacy rights and appeal

If the Connecticut Data Privacy Act applies, Connecticut residents may have rights to access, correct, delete and obtain a copy of personal data, and to opt out of targeted advertising, the sale of personal data or certain profiling. Waytale does not sell personal data or share it for cross-context behavioural advertising.

Contact hello@waytale.co to make a request or appeal. If we deny a request, you may ask us to review the decision and we will provide an appeal response within the period required by applicable law. You may also contact the Connecticut Attorney General where permitted.

15. Children

Waytale is intended for organisations, teams and visitors with the capacity to use the service. We do not knowingly collect personal data directly from children in violation of applicable law. Organisation customers must design visitor experiences appropriately, obtain required permissions and avoid publishing children's personal data unless they have a lawful basis and suitable safeguards.

16. Changes and contact

We may update this policy when the service, law or processing changes. We will publish the revised version with a new effective or last-updated date. Questions, rights requests and privacy concerns should be sent to hello@waytale.co.