Privacy Policy

What we collect

When you sign up and use wait who?, we collect:

• Account info: your name and email address, provided via Firebase Authentication (email or Google) when you sign in.
• LinkedIn data — when you connect your LinkedIn account, we access your connections, posts, and engagement data (who liked and commented on your posts) through Unipile's authorized API integration. We use this to score your network and surface reconnection opportunities.
• Payment info — your subscription and billing details are processed by Stripe. We never see or store your full card number. Stripe handles all payment data securely.
• Usage data — basic logs of actions you take in the app (e.g., viewing a connection profile, drafting a message) to help us improve the product.

How we use it

We use your data to provide the service — nothing else. Specifically:

• Score and rank your LinkedIn connections based on relationship signals
• Surface connections you may want to reconnect with
• Draft personalized outreach messages using AI
• Track engagement (who interacts with your posts)
• Process your subscription payment
• Send you product updates and account notifications

We do not use your data for advertising. We do not sell your data. Ever.

LinkedIn data

We access your LinkedIn data through authorized third-party APIs. Here is exactly what we do and do not do:

• We read your connections list, post history, and post engagement data
• We only post to LinkedIn what you write and schedule yourself, and we never comment, react, invite or message anyone without your click
• We never access your private LinkedIn messages
• We never store your LinkedIn credentials — authentication happens through Unipile's secure OAuth flow

Your LinkedIn data is used only to power the features you see in the app. It is not shared with other users, sold, or used for any purpose outside the service.

AI processing

When you draft a message, we send relevant context (such as your connection's name, role, how you're connected, and any private notes you wrote about them) to Anthropic's Claude AI to generate a draft. Your notes and tags about people are visible only to you, are never sent to LinkedIn, and are deleted with your account. This data is sent to Anthropic solely for processing your request. Anthropic does not store this data beyond the duration of the API request, and it is not used to train their models. You can read Anthropic's privacy policy at anthropic.com/privacy.

AI assistants (Claude and others)

You can connect wait who? to an AI assistant such as Claude. Our Claude connector page explains how. Here is what happens with your data:

• What the assistant can access: your wait who? network data, your posts, comments, reach, and planned posts. Only after you connect it and approve access.
• What we receive from the assistant: only the tool requests it makes, for example a search term or the text of a draft you ask it to save. We do not receive or store your conversations with the assistant.
• Sign-in: WorkOS handles the sign-in when you connect, as listed under third parties below.
• What we log: the tool name, the time, and whether the request succeeded. Never the content of the request.
• How long we keep it: the same as the rest of your account. You can disconnect at any time in the assistant's settings. To delete your data, email hello@waitwho.ai and we will delete it within 30 days.
• The assistant provider: what you share in the assistant, including the answers our tools return to it, is processed by the assistant's provider (for Claude, that is Anthropic) under its own terms and privacy policy.

Where your data is stored

Your account data is stored in a PostgreSQL database hosted on Google Cloud Platform in Europe (region: europe-west). All data is encrypted at rest and in transit. Google Cloud's infrastructure is ISO 27001, SOC 2, and GDPR compliant.

Third parties we work with

We share data with the following third parties only as necessary to provide the service:

• Firebase Authentication (Google): handles sign-in. Stores your email and login credentials securely.
• Datadog: product analytics and masked session recordings of the sign-up flow, only with your consent. Stored on Datadog's EU servers.
• WorkOS: handles sign-in when you connect wait who? to an AI assistant such as Claude. Receives your email address and name, and issues the access the assistant uses to read your wait who? data. Stored in the US under the EU Standard Contractual Clauses.
• Stripe — processes payments. Receives your billing info; we receive only a token and subscription status.
• Unipile — provides the API integration for accessing LinkedIn data through your connected account.
• Anthropic — powers AI message drafting. Data is not retained beyond the request.
• Google Cloud — hosts our database and backend infrastructure in Europe.

We do not share your data with advertisers, data brokers, or any other third parties.

Cookies and local storage

Essential. Firebase keeps a sign-in token in your browser's storage so you stay logged in, and our server sets a session cookie. These are needed to run the service and do not need consent. We do not use advertising pixels.

Analytics, only with your consent. We use Datadog (EU servers) to measure how the sign-up and onboarding flow performs: which steps people reach, where they drop off, and short session recordings of those steps with all text, inputs and images masked. Datadog runs only after you click "Yes, that's fine" in the cookie banner. We do not send your name, email address or IP address to Datadog. After you sign up, events carry an internal account number so we can count one person once. Datadog keeps this data for up to 15 months. You can change your choice at any time with the button below. If you turn analytics off we stop collecting immediately.

How long we keep your data

We keep your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Some anonymized or aggregated data may be retained longer for product improvement purposes, but it cannot be linked back to you.

Your GDPR rights

If you are in the European Union or European Economic Area, you have the following rights under GDPR:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your personal data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing of your data in certain circumstances
• Restriction — ask us to restrict processing while a dispute is resolved

To exercise any of these rights, email us at hello@waitwho.ai. We will respond within 30 days.

Children

wait who? is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@waitwho.ai and we will delete it promptly.

Changes to this policy

If we make material changes to this privacy policy, we will notify you by email before the changes take effect. Minor clarifications may be made without notice. The "last updated" date at the top of this page reflects the most recent revision.

Contact

Questions about this policy or your data? Email us at hello@waitwho.ai. We're a small team and we read every email.

wait who? B.V.
Amsterdam, Netherlands