Privacy Policy

Waivepad is operated by Waylum Inc., Ontario, Canada. This policy covers two groups: businesses that use Waivepad (“you”), and the people who sign their waivers (“signers”).

Signers

When you sign a waiver, the business that sent it decides what is collected and why. We store it on the business’s behalf and only use it to provide the service to them. For questions about your record, or to ask for a copy or deletion, contact the business. If you cannot reach them, email us and we will pass your request on.

A signed waiver can include:

• Your name, and the email, phone, date of birth, address and emergency contact the business asks for.
• Names and dates of birth of children you sign for, and your answers to the business’s questions, which may include health information.
• Your drawn signature, the time, your time zone, IP address and browser, kept as an audit trail that shows the waiver was signed by you.

If you give your email, we send you a copy of the signed waiver through our email provider, Resend.

Businesses often need to keep waivers for several years in case of a claim. The business decides how long to keep your record and can delete it. We do not use signer information for marketing, never sell it, and never share it with other businesses.

Businesses

• Account. Your email and sign-in details, handled by Clerk. Your business name and logo.
• Payments. Handled by Polar, our merchant of record. We never see your card number.
• Usage. Anonymous counts, such as how many posters were downloaded, and privacy-friendly page analytics from Cloudflare Web Analytics, which does not use cookies.

You are responsible for having a lawful basis to collect signers’ information, for telling signers how you use it, and for answering their requests. OurData Processing Addendum sets out how we process it for you.

Where data is kept and who can see it

• Data is stored with Cloudflare, encrypted in transit and at rest. Our service providers are Cloudflare (hosting and database), Clerk (sign-in), Polar (payments) and Resend (signed copy emails). Some of them process data outside your country, including in the United States, under safeguards such as the EU Standard Contractual Clauses.
• Only the business that owns a waiver can see its signatures, after signing in. Our staff access records only to keep the service running, to investigate abuse, or when the law requires it. If we receive a legal request for a record, we tell the business first unless the law forbids it.
• Each signature is sealed when it is signed, so any later change can be detected.

Keeping and deleting

Signatures stay until the business deletes them or closes its account. When an account is closed we delete its waivers and signatures within 30 days, apart from backups, which expire within a further 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, and to complain to a data protection authority. Businesses can do most of this from their account. For anything else, email hello@waivepad.com.

Changes

If we make significant changes, we will email account holders at least 30 days before they take effect.