This policy covers two groups: customers, who use the Waitrooms dashboard and API, and visitors, who wait in a customer's waiting room. For visitors, the customer running the room decides why their data is processed, and we process it on their behalf (see our data processing addendum).
Visitors in a waiting room
- Your place in line is held in a signed token stored in your browser. It contains a ticket number and timestamps, not your identity.
- Your IP address is used in the moment to prevent abuse (rate limiting) and to apply the room's rules. We record which country requests come from, as an aggregate count; we don't store IP addresses alongside your place in line.
- Your email, only if you ask to be notified. It's used for that one message and deleted after it's sent, or within 7 days at most.
- Turn alerts (sound and browser notifications) run entirely in your browser. We don't receive anything when you turn them on.
- A cookie on the customer's own site holds your pass after you're let in. It expires at the end of the room's session length.
Customers
- Account data: name, email, a salted hash of your password (or your Google or GitHub account ID), and your workspace and team.
- Room configuration and usage: settings, designs, uploaded images, and per-minute aggregate statistics.
- Billing: handled by Stripe. We store your Stripe customer and subscription IDs, never your card details.
- Security logs: API requests made with your keys and dashboard changes, kept for 14 days.
Subprocessors
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, edge network, file storage, bot checks |
| Neon | Database for accounts, settings and statistics |
| Upstash | Live queue state |
| Resend | Transactional and notify-me email |
| Stripe | Payments |
Retention
Per-minute statistics are kept for 90 days, request logs and webhook delivery logs for 14 days, and expired sessions and tokens are deleted daily. To close your account, email us and we'll delete your workspace data within 30 days, except billing records we must keep by law.
Your rights
You can access, correct, export or delete your data. Customers can do most of this in the dashboard; for anything else, or if you were a visitor in a customer's waiting room, email hello@waitrooms.dev. We'll pass visitor requests to the customer who ran the room where they're the controller.
Cookies
The dashboard uses one essential session cookie. Waiting pages use browser storage for your place in line and language. We don't use advertising or third-party tracking cookies.