Privacy Policy

1. Scope and updates to this Privacy Policy

Waystation AI, Inc. collects and processes personal information through our websites, mobile applications, and other offerings (collectively, "Services"). This Privacy Policy does not apply to any of the personal information that we process on behalf of our customers and their suppliers through their use of our Services. Waystation processes customer and supplier data as a processor, governed by customer contracts rather than this policy.

Supplier Discovery note. We may share Non-Confidential Supplier & Business Information across customers for supplier discovery features. This includes publicly available information about suppliers' existence, business names, websites, general locations, public certifications, and public contact information — but excludes confidential commercial terms, pricing, volumes, or private communications.

We reserve the right to revise these terms with appropriate notice.

2. Personal information collected

A. Information you provide directly

• Account information — name, email, phone, address.
• Purchase and billing — transaction details (payment processing is handled by third parties).
• Transactional information — order numbers and history.
• Supplier information — supplier names, emails, phone numbers, tax information.
• Supplier Discovery information — customer-provided supplier data that may be shared as non-confidential information.
• User-generated content — comments, messages, documents, uploaded materials.
• Communications — information from support requests, newsletters, and surveys.
• Interactive features — content submitted through forums, chat, or social media.
• Events — information collected at conferences and trade shows.
• Business development — information for partnership assessment.
• Job applications — resumes, cover letters, application materials.

B. Information collected automatically

• IP addresses, browser information, device identifiers, location data.
• Usage patterns: pages visited, links clicked, content interactions, activity duration.
• Crash reports with diagnostic information.

We use cookies, pixel tags, and web beacons for:

• Operationally necessary — authentication and security.
• Performance-related — analytics and service improvement.
• Functionality-related — remembering preferences.
• Advertising-related — delivering targeted content.

Analytics providers include Google Analytics and LinkedIn Analytics. Social media buttons may collect IP addresses and set cookies.

C. Information from other sources

• Third-party applications and login services.
• Public websites and business directories.
• Data providers and third-party sources for supplier information.

3. How personal information is used

A. Providing Services (contract performance)

• Account management and access.
• Customer support.
• Processing payments.
• Job application processing.
• Event registration.
• Providing Supplier Discovery features.

B. Administrative purposes (legitimate interests)

• Direct marketing and research.
• Network security and fraud prevention.
• Security incident detection and illegal activity prosecution.
• Service engagement measurement.
• Service improvement and development.
• Supplier Discovery network improvements.
• Identity verification.
• Debugging and error correction.
• Compliance audits.
• Agreement enforcement.

C. Marketing and advertising

We use personal information for email campaigns, custom audience advertising, and personalized/targeted advertising — including cross-device tracking. Individuals may opt out by contacting privacy@waystationai.com. Use of Google and Microsoft API data is governed by separate sections below and excludes marketing uses.

D. With consent

Personal information may be used for purposes disclosed when collected.

E. De-identified and aggregated information

We may create and use de-identified or aggregated demographic and usage data without attempting to re-identify it.

4. How personal information is disclosed

A. Disclosures to provide Services

• Service providers — IT support, hosting, payment processing, customer service.
• Business partners — for requested products or services.
• Affiliates — corporate affiliates.
• Other users — through interactive features and sharing functionality.
• Supplier Discovery — Non-Confidential Supplier & Business Information to other customers.
• Advertising partners — for interest-based advertising.
• APIs / SDKs — third-party integrations.

We do not disclose Customer and Supplier Data between customers, and we do not disclose a customer's confidential information to other customers.

B. Disclosures to protect rights

We may disclose information to comply with law enforcement, court orders, or subpoenas, or to protect rights, property, safety, and enforce policies.

C. Merger, sale, or asset transfer

Information may be transferred in connection with mergers, acquisitions, bankruptcy, or asset sales.

5. Privacy choices and rights

• Email communications — unsubscribe links are available; transactional emails continue.
• Mobile devices — push notification and location tracking opt-out through device settings.
• Phone calls — follow call instructions or contact us to opt out.
• Do Not Track — we do not currently honor DNT signals.
• Cookies and personalized advertising — browser/device adjustments; industry opt-outs through the Network Advertising Initiative, Digital Advertising Alliance, European Digital Advertising Alliance, or Digital Advertising Alliance of Canada.

Depending on your jurisdiction, you may have the right to confirm processing; access or request portability; correct inaccuracies; request deletion; restrict or object to processing; withdraw consent; and lodge supervisory authority complaints (EEA, Switzerland, UK residents). Send requests to privacy@waystationai.com.

6. International transfers

Personal information may be transferred, processed, and stored globally. For transfers from the European Economic Area, Switzerland, or United Kingdom, we use EU Standard Contractual Clauses as a safeguard.

7. Retention of personal information

We retain personal information for the duration of service use or as necessary to fulfill collection purposes, provide services, resolve disputes, conduct audits, pursue legitimate business purposes, enforce agreements, and comply with laws.

8. Data security

• Encryption — TLS 1.2+ in transit; AES-256 at rest.
• Access controls — role-based, with multi-factor authentication.
• Infrastructure — SOC 2 Type II certified cloud hosting.
• Monitoring — audit logs and unauthorized access detection.
• Vendor management — contractual security obligations for service providers.
• Incident response — established procedures for security incidents.

No method of transmission over the Internet or electronic storage is completely secure.

9. Supplemental notice for Nevada residents

Nevada residents may opt out of personal information sales by contacting privacy@waystationai.com with subject line "Nevada Do Not Sell Request" and providing name and email. We do not currently sell personal information as defined by Nevada law.

10. Children's information

Our Services are not directed to children under 18. We do not knowingly collect children's information. Parents and guardians who believe their child has uploaded information may contact us for deletion.

11. Other provisions

Third-party websites and applications are not controlled by Waystation. Users should review their privacy policies independently. Waystation is not responsible for third-party privacy practices.

12. Google API Services user data

Under the Google API Services User Data Policy, Waystation:

• Uses Google data solely for email connectivity and calendar integration features.
• Does not use data for advertising, retargeting, or personalized advertising.
• Does not use data for marketing or cross-device tracking.
• Does not sell Google data.
• Does not build advertising profiles with Google data.
• Limits human access to necessary purposes: service provision, improvement, security investigation, or legal compliance.

13. Microsoft API Services user data

Under the Microsoft APIs Terms of Use, Waystation:

• Uses Microsoft data solely for email connectivity and calendar integration.
• Obtains necessary consents before processing.
• Does not use data for advertising, marketing, or cross-device tracking.
• Does not sell Microsoft data.
• Implements retention and deletion policies aligned with Microsoft APIs.
• Limits human access to necessary purposes: service provision, improvement, security investigation, or legal compliance.

Users can review and revoke access at myapps.microsoft.com or account.live.com/consent/Manage.

14. Contact information

Waystation AI, Inc.
Attn: Legal
2221 Broadway, 2nd Floor
Redwood City, CA
privacy@waystationai.com