Waivbar

Privacy Policy

Waivbar · Operated by SaaS Solutions LLC

Effective date: Effective upon live launch

This policy explains what personal information Waivbar Moments collects, why, who can access it and the choices you have. It applies to organizers and guests. See also our Terms of Service and Refund Policy.

1. Information we collect

Organizers. Email address; password (stored by our authentication provider in hashed form) or your Google sign-in identity; optional display name and business name; the events you create (title, type, date, settings); and records of account requests such as email changes or deletion requests. If you sign in with Google, we receive your name, email address and profile photo from Google, as available, to create, identify and secure your Waivbar account.

Guests. Guests do not create accounts. When you upload, we collect the photos and videos themselves; the name and description you optionally enter; the time you ticked the consent box; and file details including the original file name, file type, size and, for videos, length. Any information inside your files (for example location or camera data your phone adds) is stored as part of the original file, which we keep unchanged.

Guest PIN and upload protection. If an event uses a Guest PIN, we store a random identifier for your browser, the result and number of PIN attempts and a temporary authorization (valid for up to 12 hours). We also record upload sessions per event to enforce storage and rate limits. We do not store the PIN itself, only a secure hash.

Payments. Card details are entered on Stripe and never reach our servers. We receive and keep the purchase record: which event and organizer it is for, amount, currency, status (paid, refunded, failed or cancelled), Stripe reference numbers and dates.

Technical information. Our hosting and service providers process standard technical data such as IP address, browser type and request logs to deliver the service and keep it secure. Our own operational logs record counts and outcomes, not the contents of your files.

2. How we use information

  • To provide the service: sign-in, events, QR links, uploads and private galleries;
  • To process Event Activation payments and refunds;
  • To enforce storage, file-size, rate and PIN limits and prevent abuse;
  • To make videos play reliably in browsers, where video processing is used;
  • To respond to support, privacy and content-removal requests;
  • To meet legal, tax and accounting obligations.
  • Waivbar does not sell customer personal information.
  • Guest photos and videos are not used in advertising without separate permission.
  • Guest media is not used to train AI models without separate, explicit authorization.

Waivbar does not use AI to generate or alter guest photos or videos. Video processing is used to prepare uploaded videos for compatible browser playback.

3. Who can access uploaded media

  • The event organizer can view, download, rename and delete the photos and videos uploaded to their own event, after signing in.
  • Guests cannot browse other guests' uploads or the gallery.
  • Waivbar administrators see account, event, storage and payment information (such as counts and file sizes) to run the service. The admin dashboard does not display private guest photos or videos. Sensitive admin actions are recorded in an audit log. We may access specific content only where necessary for support you request, to investigate a report or abuse, or where legally required.
  • Service providers listed below process data on our behalf.

Galleries are never public. Viewing and download links are signed and expire after a short time.

4. Service providers

  • Lovable Cloud (built on Supabase): database, authentication and private file storage.
  • Cloudflare: hosting and delivery of the website and server functions.
  • Google: sign-in, if you choose "Continue with Google".
  • Stripe: payment processing, tax calculation and refunds. Stripe handles card data under its own privacy policy.
  • Mux: video processing for browser-compatible playback. This is currently limited and is not applied to every video. Where it is used, a copy of the video is sent to Mux and played back through private, signed links; the original file is kept unchanged.

5. How long we keep information

Gallery access for an event ends exactly 90 days after the event was created. This date is fixed at creation and is never changed by later edits to the event date. After that, the gallery is locked and guest uploads stop, and files are kept for a further 14-day recovery window during which the organizer can ask us to recover them. Organizers can delete individual files or a whole event at any time; deleting an event removes its stored files.

Automatic permanent deletion of galleries is not currently enabled. Files may therefore remain stored after the recovery window until they are deleted by the organizer or by us. If we enable automatic deletion, we will update this policy first. Incomplete or abandoned uploads that never finished are cleaned up periodically. Payment records are kept as long as needed for accounting, tax and legal purposes.

6. Security

Media is stored in private storage that can only be read by the event's owner. Access rules are enforced on our servers, not just in the app. Viewing links expire, Guest PINs are stored only as hashes, and payments are handled by Stripe. No system is completely secure, and we cannot guarantee absolute security. Please keep your login safe and share event links only with invited guests.

7. Your choices and rights

Organizers can update their display and business name in Account Settings. You can ask us to access, correct or delete your personal information, or ask questions about this policy, by emailing crmunlocked@gmail.com. Account deletion can be requested in Account Settings or by email; requests are reviewed and handled manually by our team, not instantly. We may need to verify your identity, and we may keep certain records where required by law (for example, payment records).

Guests who want something they shared removed can ask the event organizer, who can delete it directly, or email crmunlocked@gmail.com with the event name and a description of the content.

Depending on where you live, you may have additional rights under local privacy laws, such as rights to know, access, correct or delete information. We will respond to requests as required by applicable law and will not discriminate against you for making one.

8. Children

Organizers must be at least 18 years old. Waivbar Moments is not directed at children, and we do not knowingly collect personal information from children under 13. Event photos and videos may include children when shared by guests; parents or guardians can ask for removal at crmunlocked@gmail.com.

9. International users

Waivbar Moments is operated from the United States. Information may be processed in the United States and other countries where our providers operate.

10. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, is always posted on this page. We may also communicate updates through the website, in-app notices or email where available.

11. Contact

Waivbar
Operated by SaaS Solutions LLC
Privacy and support: crmunlocked@gmail.com

Mailing address:
SaaS Solutions LLC
8 The Green, Suite A
Dover, DE 19901
United States