Privacy Policy

Effective Date: 09 July 2026 Last Updated: 09 July 2026

This Privacy Policy explains how Thomas Webb (operating easywaitlist.dev, the "service"), collects, uses, and protects personal data.

We act in two distinct roles, and this policy explains both:

Data Controller - for account and billing information of businesses and individuals who sign up to use EasyWaitlist ("Customers").
Data Processor - for personal data submitted by individuals who join a waitlist hosted through the Service ("End Users"), which we process on behalf of, and under the instructions of, the Customer who created that waitlist.

If you are an End User, the Customer whose waitlist you joined is the controller of your data and the primary point of contact for exercising your rights. We encourage you to review that Customer's own privacy notice as well. If you're unsure who that is, contact us at https://easywaitlist.dev/support and we will direct you appropriately.

Definitions

Service – EasyWaitlist, available at easywaitlist.dev.
Customer – Any individual or organization that creates and manages waitlists using the Service.
End User – An individual who joins a Customer's waitlist through the Service.

1. Information We Collect

a) Information from Customers (account holders)

Account details: name, email address, password (hashed).
Billing information: billing name/address and payment details, processed by our payment processor, Stripe (we do not store full card numbers).
Usage data: how you interact with the Service, feature usage, log data, device and browser information, IP address.
Communications: support requests and correspondence with us.

b) Information from End Users (waitlist sign-ups)

On behalf of our Customers, we collect the information an End User submits when joining a waitlist, which may include:

Email address.
Technical data such as your IP address (temporarily processed for rate limiting and fraud prevention) and approximate location (country-level), collected automatically.

We process this data solely per the Customer's instructions and do not use it for our own independent marketing purposes.

c) Automatically Collected Data (Analytics)

We automatically collect certain technical information when you use the Service, including IP address, browser type, operating system, device information, pages visited, referring URLs, timestamps, and feature usage.

We use Google Analytics to help us understand how the Service is used and improve its performance. Google Analytics may use cookies or similar technologies to collect information about your interactions with the Service. We do not use analytics data for advertising or personalized marketing.

2. How We Use Personal Data

We use personal data to:

Provide, operate, and maintain the Service.
Process payments and manage subscriptions via Stripe.
Communicate with Customers about their account, updates, or support requests.
Monitor, analyze, and improve the performance and security of the Service.
Detect, prevent, and address fraud, abuse, or security issues.
Comply with legal obligations.

We do not sell personal data, and we do not use End User data collected on behalf of Customers for our own advertising purposes.

Where UK GDPR or EU GDPR applies, our legal bases include:

Contract - to provide the Service to Customers and process waitlist sign-ups per their instructions.
Legitimate interests - to secure and improve the Service, prevent fraud, and analyze usage, provided these interests are not overridden by your rights.
Consent - where required, such as for certain cookies or where a Customer's waitlist form requests explicit consent from End Users.
Legal obligation - where processing is necessary to comply with law (e.g., tax and accounting records).

Service providers: We use trusted third-party service providers to operate the Service, including:

Oracle Cloud Infrastructure for application hosting and infrastructure.
Cloudflare for content delivery, DNS, security, and performance.
Stripe for payment processing and subscription management.
Google Analytics for website and product usage analytics.

These providers process personal data only as necessary to provide their services and are subject to appropriate confidentiality and data protection obligations.

We do not sell or rent personal data to third parties.

5. International Data Transfers

We are based in the UK. If personal data is transferred outside the UK or EEA (for example, to a service provider in another country), we rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or transfers to jurisdictions recognized as providing adequate protection.

6. Data Retention

Customer account data is retained for as long as the account is active, and for a reasonable period afterward to comply with legal, accounting, or security requirements, after which it is deleted or anonymized.
End User waitlist data is retained for as long as instructed by the relevant Customer, or until the Customer deletes it, deletes their waitlist, or closes their account, subject to standard backup retention cycles.

7. Your Rights

Depending on your location, you may have rights including the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Object to or restrict certain processing.
Request data portability.
Withdraw consent where processing is based on consent.
Lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office (ICO)).

End Users: because we process your data as a processor on behalf of the Customer whose waitlist you joined, please direct rights requests to that Customer first. If you're unable to identify or reach them, contact us at https://easywaitlist.dev/support and we will assist.

Customers: to exercise these rights over your account data, contact us at https://easywaitlist.dev/support.

If you are a resident of a US state with its own privacy law (e.g., California, Colorado, Virginia), you may have additional rights under that law, including the right to know, delete, or opt out of certain data sales (note: we do not sell personal data).

8. Cookies

We use essential cookies required for the Service to function, including maintaining secure sessions and protecting against fraud. We also use analytics cookies through Google Analytics to understand how visitors use the Service and improve its performance.

Where required by applicable law, we will request your consent before placing non-essential analytics cookies. You can also manage or disable cookies through your browser settings, although disabling essential cookies may affect the functionality of the Service.

9. Data Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, or misuse, including encryption in transit, access controls, and regular security reviews. No system is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at https://easywaitlist.dev/support and we will take steps to delete it.

11. Data Processing Agreement (For Business Customers)

Customers who require a formal Data Processing Agreement (DPA) reflecting our role as processor of End User data - including Standard Contractual Clauses or the International Data Transfer Addendum where applicable - can request one at https://easywaitlist.dev/support.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where appropriate, we will notify Customers of material changes via the Service or by email. The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised.

13. Contact Us

For any questions about this Privacy Policy or to exercise your data protection rights, please contact:

Thomas Webb
easywaitlist.dev
Support: https://easywaitlist.dev/support