Privacy Policy

Welcome to WaiverBox. We operate waiverbox.app and provide digital waiver creation and management software for activity businesses. This Privacy Policy explains what information we collect, how we use it, and the rights you have regarding your data. If you have questions, contact us at support@waiverbox.app.

1. Information We Collect

Account information

When you create a WaiverBox account, we collect:

• Email address — used to log in and receive service communications
• Business name — displayed on your waiver templates and signing pages
• Password — stored as a one-way bcrypt hash; we never store your plaintext password

Waiver signature data

When your customers sign waivers through WaiverBox, we collect on your behalf:

• Signer's full name
• Email address (if collected on your form)
• Drawn or typed signature image
• IP address at time of signing
• Timestamp and device/browser information

This data belongs to you as the account holder. We act as a data processor on your behalf for waiver signature data.

Usage and analytics data

We use Umami Analytics (a privacy-respecting, cookie-free analytics tool) to understand how visitors use our website. Umami does not use cookies and does not track individuals across sites. The data collected is aggregated and anonymized (page views, referrers, browser types).

Payment information

Payments are processed by Stripe. We do not store your credit card number, CVV, or full card details on our servers. Stripe returns a token that we use to manage your subscription.

2. How We Use Your Data

• To provide the service — creating accounts, storing waivers, generating QR codes, and serving signing pages
• To communicate with you — service updates, billing notices, and support responses
• To improve WaiverBox — understanding usage patterns to prioritize features
• To comply with legal obligations — responding to lawful requests from authorities

We do not sell, rent, or trade your personal data to third parties. Ever.

3. Data Storage and Security

Your data is stored on encrypted servers hosted in the European Union. We use industry-standard security practices:

• All data in transit is encrypted via HTTPS/TLS
• Passwords are hashed with bcrypt (never stored in plaintext)
• Database backups are encrypted
• Access to production systems is restricted to authorized personnel

No system is 100% secure. In the event of a data breach that affects your rights, we will notify you within 72 hours as required by GDPR.

4. Cookies and Local Storage

WaiverBox uses minimal storage:

• Authentication token — stored in your browser's localStorage to keep you logged in. This is not a tracking cookie and is not shared with third parties.
• No advertising cookies — we do not use Facebook Pixel, Google Analytics cookies, or any behavioral advertising trackers.

Our Umami analytics script is cookie-free and does not create any cookies in your browser.

5. Third-Party Services

WaiverBox integrates with the following third-party services. Data is sent to them only as needed to provide the service:

• Stripe — payment processing. Your billing data is governed by Stripe's Privacy Policy.
• OpenRouter — AI waiver text generation. When you use the AI generation feature, your waiver category and prompt are sent to OpenRouter's API. No personal data about your customers is sent. Governed by OpenRouter's Privacy Policy.
• Umami Analytics — cookie-free, privacy-respecting website analytics. No personal data is shared. Self-hosted on our infrastructure.
• Google Fonts — font files loaded from Google's CDN. Google may log the request IP. You can block this via a browser extension if preferred.

6. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your account and all associated data
• Right to data portability — export your waiver signature data as CSV from your dashboard at any time
• Right to object — object to processing of your data for marketing purposes
• Right to restrict processing — request that we limit how we use your data

To exercise any of these rights, email us at support@waiverbox.app. We will respond within 30 days. For deletion requests, your account and all associated data will be permanently removed within 7 business days.

7. Data Retention

We retain your account data for as long as your account is active. Waiver signature records are retained indefinitely on active accounts (since they may be needed for legal purposes). When you delete your account, all data is permanently deleted within 7 business days.

If you cancel your Pro subscription but keep your account on the Free plan, your data is retained. If you close your account entirely, all data is deleted.

8. Children's Privacy

WaiverBox is intended for business use by adults (18+). We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Note: some waivers may be signed on behalf of minors by their parents or guardians. Businesses using WaiverBox are responsible for ensuring appropriate parental consent is obtained in their waiver templates.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (at the address on your account) and update the "last updated" date at the top of this page. Continued use of WaiverBox after changes constitutes acceptance of the revised policy.

10. Contact Us

For privacy questions, data requests, or concerns:

• Email: support@waiverbox.app
• Response time: within 2 business days for general inquiries, within 30 days for formal GDPR requests