Privacy Policy
This notice explains how WaverSec, a project operated by Latent Labs OÜ, handles personal data across waversec.com, WaverSec Protect, the admin dashboard, the API, the Outlook add-in, documentation, and related support, sales, and billing interactions.
Covers both GDPR-style disclosures and U.S. state privacy notices for the current service design.
Message content is dropped
As designed today, WaverSec Protect does not retain email bodies, recipient lists, or attachment files in its application databases as part of normal service operation.
Operational data is retained
We still retain limited account, configuration, usage, and billing data needed to authenticate users, manage customer environments, secure the service, and run the business.
Roles depend on context
WaverSec acts as controller for website, support, account, and billing data. For customer message data analyzed on behalf of an organization, WaverSec generally acts as processor or service provider.
EU and U.S. rights
People in the EEA, UK, Switzerland, and many U.S. states can request access, deletion, correction, portability, and other rights, subject to the applicable legal regime.
Search section titles and document text.
Categories
Categories of personal data we process
The exact dataset depends on how you interact with WaverSec. The categories below cover the current website and product design, including customer-administered deployments of WaverSec Protect.
Identity and account data
Data used to authenticate admins and operate customer accounts.
- Name, email address, username, and avatar supplied through Clerk
- Internal user, account, and organization identifiers
- Role or access information such as super-admin status
Organization and configuration data
Customer-administered settings used to configure WaverSec Protect.
- Organization names and internal domains
- Policy settings, allow lists, deny lists, segments, exemptions, and related admin-provided entries
- Environment settings, manifest identifiers, tokens, and API key lifecycle metadata
Service operation and usage data
Data needed to secure, meter, and operate the product.
- Requester or sender email used for seat tracking and quota enforcement
- Request IDs, client IDs, timestamps, and rate-limit hashes
- API usage records, token usage, scanner usage, and error diagnostics
Billing and subscription data
Data used to manage paid subscriptions, customer entitlements, and manual billing workflows.
- Plan tier, seat count, subscription status, and billing period dates
- Manual invoice, payment request, settlement reference, and finance correspondence data
- Billing contacts, purchase records, and other commercial information reflected in order forms or invoices
Website, support, and sales data
Data created when you visit the site, contact us, or book time with us.
- Page views, device and browser information, CTA interactions, and consent status
- Emails or other details you send to us through contact or scheduling workflows
- Support correspondence and issue-handling records
Customer message data processed on behalf of a customer
Data used to perform the requested scan or interpretation when a customer enables WaverSec Protect in their environment.
- Email body text, subject lines, recipient fields, and attachment data received for scanning
- Derived warnings, severity assessments, and remediation suggestions generated at compose time
- Optional AI/LLM context sent only when the customer enables those features
Who we are and how to contact us
For the website, sales, support, account administration, and billing relationship, the controller is Latent Labs OÜ, the company operating WaverSec.
If you have privacy questions or want to exercise a right under this notice, contact us at info@latent-labs.io. Existing customers can also reach support@waversec.com for operational help.
What this policy covers
This policy applies to the public website, the WaverSec Protect admin product, the API and related endpoints, the Outlook add-in, the documentation site, and our support, onboarding, and billing workflows.
It does not replace a separate data processing agreement or customer contract. If a signed customer agreement says something more specific about customer data, that agreement controls to the extent of any conflict.
Controller and processor roles
WaverSec is the controller for data we use to run our business and customer relationship, including website analytics, contact requests, account creation, support, subscription management, and product administration.
When WaverSec Protect processes customer email content or related message data on behalf of a customer organization, that customer organization is typically the controller or business, and WaverSec acts as a processor or service provider.
If you use WaverSec Protect through your employer or another organization, you should usually direct privacy requests about message data to that organization first. They decide how the product is configured and whether warnings or blocking rules are enabled.
What happens to email content, recipients, and attachments
WaverSec Protect may receive message data when a customer uses the product to scan an email or attachment. That processing happens to deliver the requested protection result.
As designed today, WaverSec Protect does not retain email bodies, recipient lists, or attachment files in its application databases as part of normal service operation. Core service records are centered on account, configuration, usage, and billing data instead.
That does not mean no personal data is processed at all. Some personal data still exists in account records, customer-configured lists, sender identifiers used for seat tracking, support messages, and similar operational records.
- No inbox replication is required for the current product flow.
- No mail-routing or mail-flow interception is required for the current Outlook deployment model.
- Optional AI features are customer-controlled and are separate from the core on-device and local processing layers.
Why we process personal data and GDPR legal bases
We process personal data to provide and secure WaverSec Protect, manage customer accounts and subscriptions, answer support requests, improve the service, and comply with legal obligations.
Where GDPR applies, we generally rely on one or more of the following legal bases depending on context.
- Contract: to create accounts, authenticate users, provision environments, process scans, manage subscriptions, and provide support.
- Legitimate interests: to secure the service, prevent abuse, measure product reliability, investigate incidents, maintain auditability, and improve the product using limited analytics and operational telemetry.
- Consent: for optional website analytics and, where enabled by an organization administrator, optional product analytics and masked session replay in the admin dashboard and Outlook add-in.
- Legal obligation: to keep records required for tax, accounting, fraud-prevention, security, or other compliance purposes.
Who we disclose data to
We disclose personal data only when needed to run the service or comply with law. Depending on the workflow, data may be handled by service providers that support our product operations.
- Identity and authentication provider Clerk.
- Application hosting and edge infrastructure provider Vercel.
- Managed database provider Neon.
- Analytics provider PostHog.
- Finance institutions or payment counterparties identified in an invoice, payment request, or other manual billing workflow where applicable.
- AI providers such as OpenAI and Anthropic when a customer enables optional intelligence features.
- Professional advisers, auditors, regulators, law enforcement, or courts when disclosure is legally required or necessary to protect rights and security.
International data transfers
Some of our providers may process personal data in the United States or other countries outside the EEA, UK, or Switzerland. When those transfers are covered by GDPR or similar rules, we use the transfer mechanism that fits the specific provider and destination.
Depending on the situation, that may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another recognized safeguard.
How long we keep data
We keep personal data only for as long as we need it for the purpose described in this notice, unless a longer retention period is required by law or justified by a documented security or dispute-handling need.
Retention depends on the dataset. We use the following criteria today.
- Account, organization, environment, and configuration data are kept while the customer relationship is active and for a limited period afterward for backup integrity, dispute handling, and recovery needs.
- Billing and tax-related records are kept for the period required by applicable accounting, tax, and payment obligations.
- Analytics and operational telemetry are kept only as long as reasonably needed for product, site, and security improvement, subject to provider settings and your consent or preferences where applicable.
- Email bodies, recipient lists, and attachment files are not kept in our application databases as normal service records.
How we protect personal data
We use technical and organizational measures designed to reduce risk and limit unnecessary data exposure. No system can guarantee perfect security, but we apply layered controls that reflect the current product architecture.
- TLS is used for supported API communications.
- API keys can rotate and the current environment design supports short-lived operational control patterns.
- Access to operational systems is limited to people and providers who need it.
- Rate limiting, validation, and abuse protection are used to protect exposed endpoints.
- We design the product to minimize retained message data.
Automated analysis, warnings, and customer-configured enforcement
WaverSec Protect automatically analyzes message data to generate detections, warnings, and, where the customer chooses, blocking decisions before an email is sent. The exact behavior depends on the policies, DLP rules, scanners, and optional AI features configured by the customer organization.
For many deployments, the service is used to warn users and let them fix issues before sending. Some organizations may configure stricter enforcement. If you are an end user and believe a customer-configured decision should be reviewed, contact your organization’s administrator first.
Rights for people in the EEA, UK, and Switzerland
If GDPR or a similar regime applies, you may have the right to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where we rely on consent.
You may also have the right to lodge a complaint with your local supervisory authority. We may need to verify your identity or your authority to act before we complete a request.
- Access to the personal data we hold about you.
- Rectification of inaccurate or incomplete personal data.
- Erasure in appropriate circumstances.
- Restriction or objection in appropriate circumstances.
- Portability for data processed on a contract or consent basis where the law provides that right.
U.S. state privacy notices
If you live in a U.S. state with an applicable privacy law, you may have rights that include access, deletion, correction, portability, and appeal, and in some states the right to opt out of certain sales, targeted advertising, or profiling uses.
WaverSec does not sell personal data. We do not share personal data for cross-context behavioral advertising. If you submit a privacy request and disagree with our response, you can appeal by emailing info@latent-labs.io with the subject line “Privacy Appeal”.
- Right to know or access the categories and specific pieces of personal data we process, where required by law.
- Right to request deletion, subject to statutory exceptions.
- Right to request correction of inaccurate personal data, where applicable.
- Right to obtain a portable copy where the law provides that right.
- Right not to receive discriminatory treatment for exercising a privacy right.
Do Not Track and similar browser signals
Some browsers offer a Do Not Track setting. Because there is not a uniform industry standard for interpreting that signal, WaverSec does not currently change the public website’s behavior in response to browser Do Not Track signals.
We do not use the public website for cross-context behavioral advertising, and we do not knowingly allow third parties to collect personal data through the public website for their own cross-site advertising purposes.
Children’s data
WaverSec Protect is designed for business use and is not directed to children. We do not knowingly collect personal data from children for consumer use of the service.
If you believe a child has provided personal data to us in a way that should not have happened, contact us so we can investigate and take appropriate action.
Changes to this policy
We may update this notice as the product, providers, or legal requirements evolve. When we do, we will update the effective date at the top of the page and, where appropriate, provide additional notice.
How to exercise your rights
Send privacy requests to info@latent-labs.io. If you are writing about a customer-managed deployment, include the organization name, the environment involved if you know it, and the nature of your request so we can route it correctly.
For support matters related to an active deployment, you can also use support@waversec.com. We may ask for information needed to verify identity, authority, or account ownership before acting on a request.