Privacy Policy

Waveplan is a booking platform for activity providers. We take the privacy of the people who use our platform seriously: both the businesses that run on Waveplan and the customers who book with them. This page explains what data we collect, why we collect it, and what choices you have.

If you only have time for the short version: we collect what we need to run the booking platform, we don't sell your data, and we apply the General Data Protection Regulation (GDPR / AVG) because we're based in the Netherlands.

Who we are

Waveplan is operated from the Netherlands and is the controller for the data you share with us directly through our marketing website (waveplan.co), the operator dashboard, and the customer portal.

When a business uses Waveplan to take bookings from its own customers, that business is the controller of those customers' data and Waveplan acts as its processor. The business sets its own privacy notice for its customers; this page covers Waveplan's role.

What we collect

We collect three categories of data.

Account data. When an operator signs up for the dashboard we store name, email, password (hashed), and the organization details entered during onboarding. We also store anything you upload to your organization profile (logo, photos, descriptions).

Booking data. When a customer books a lesson or activity through a Waveplan-powered page we store the customer's name, email, phone number (when provided), the booking itself, and any add-ons selected. Payment is handled by our payment partners. We store the resulting status and reference, not the card number.

Usage data. We log technical information needed to run the service: IP address, browser type, pages visited, error reports, and timestamps. We use this to keep the platform fast, secure, and free of bugs.

Why we collect it

We process your data on the legal bases set out in Article 6 of the GDPR:

• Contract. To deliver the booking platform you signed up for and to send transactional emails (booking confirmations, reminders, receipts).
• Legal obligation. To meet tax, accounting, and consumer protection requirements.
• Legitimate interest. To keep the service secure, prevent fraud, debug issues, and improve the product. We weigh our interest against your privacy in each case.
• Consent. For optional analytics and marketing cookies. You can withdraw consent at any time.

Cookies and tracking

We use a small number of cookies. Strictly necessary cookies keep you logged in and remember your booking step. These run without consent because the platform doesn't work without them.

Product analytics. We use Mixpanel to understand how people use Waveplan so we can improve it: which pages are visited, how far people get through signup and onboarding (and where they drop off), and which steps of a booking are completed. To do this we record events such as a page view, a completed signup step, an activity being published, or a booking being completed, together with a randomly generated visitor identifier, the organization the activity belongs to, and basic technical context (device and approximate location derived from your IP). For logged-in operators the identifier is your account ID. We do not use this data for advertising and we do not sell it. We never send payment card details or full home addresses to Mixpanel.

Marketing tags. Where an operator has configured them, Google Tag Manager and Meta Pixel may also run on that operator's public pages.

Logged-in operators. When you're signed in to the dashboard, we run this product analytics on your in-app usage under our legitimate interest to operate, secure and improve the service you're under contract for, so we don't show you a cookie banner for it. You can object at any time via the contact details below.

Everyone else (anonymous visitors). On the marketing site and the public booking pages, Mixpanel analytics and any marketing tags only run after you accept analytics cookies through our cookie banner. If you decline, none of them load. You can change your mind at any time by clearing the cookie/site data for Waveplan in your browser settings, which brings the banner back.

Who we share data with

We don't sell your data, and we don't share it with advertisers. We do rely on a small set of vetted subprocessors to run the platform:

• Supabase: database and authentication (data hosted in the EU)
• Resend: transactional email delivery
• Stripe and Mollie: payment processing (each operator chooses one)
• Cloudflare R2: image and file storage
• Google: Maps and Places API for address search
• Vercel and Fly.io: application hosting
• Vercel Analytics: anonymous traffic measurement
• Mixpanel: product analytics (only with your consent)

Each subprocessor has signed a data processing agreement with us. If a list update changes who has access to your data in a meaningful way we will publish the change here.

International transfers

We try to keep data inside the European Economic Area. Some of our subprocessors (for example Stripe, Cloudflare, and Google) operate globally; when data leaves the EEA it does so under the European Commission's Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

We keep your data only as long as we need it.

• Active operator accounts: as long as the account exists.
• Closed operator accounts: 30 days, then deleted (financial records retained for 7 years to meet Dutch tax law).
• Customer bookings: kept for the booking business for 2 years after the activity date, then anonymized.
• Server logs: 30 days.

Your rights under the GDPR

You have the right to:

• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl)

To exercise any of these rights, contact us at the email below. We respond within one month.

If your data was collected by a business using Waveplan to take your booking, please contact that business first. They decide what happens with your data. We will help them honor your request.

Security

We use industry-standard measures to protect your data: encryption in transit (HTTPS), encryption at rest for our database, hashed passwords, role-based access controls, and regular backups. No system is perfect, so if we ever detect a breach affecting your data we will notify the Dutch Data Protection Authority within 72 hours and contact you directly if your data is at significant risk.

Children

Waveplan is not intended for children under 16. We do not knowingly collect data from anyone under 16. If a booking is made on behalf of a minor it should be made by their parent or guardian.

Changes to this policy

We may update this policy as the platform evolves. The "Last updated" date at the top of this page reflects the latest revision. For material changes we will notify operators by email and customers through the booking pages.

Contact us

Privacy questions, data requests, and concerns:

Email: privacy@waveplan.co Address: Waveplan, the Netherlands

The full company details (KvK number, address, VAT) are listed in the operator agreement signed at sign-up.