# Privacy Policy

Effective October 31, 2026

Waity is about places. It keeps as little about people as it can. This policy explains what Waity ("Waity", "we", "us") collects when you use waity.ai, account.waity.ai, the Waity API, the Waity MCP server and our emails; why we collect it; who else handles it; and the choices you have. Our [Terms of Service](https://waity.ai/terms) cover your use of Waity.

**In short** (This summary helps you read the policy. It doesn't replace it.)

- Wait times describe places, not people. We don't receive information about the patients, travelers or visitors at the places we track.
- A location you send is used to answer that request. We don't store it precisely. If the request uses a key that belongs to an account, that account's request history keeps only an area about 2 km across, for up to 30 days.
- Waity's own systems don't store IP addresses. API keys are stored only as hashes, and a free key is tied to a coded form of your email address, not the address.
- An account holds your email address, name, plan and keys. Our payment processor handles card details; we never see them.
- We don't sell personal information, show ads or use advertising trackers. In the EU, EEA, UK and Switzerland, analytics cookies stay off unless you turn them on; elsewhere they're on until you turn them off in Cookie settings.

## 1. Who we are

Waity runs Waity and decides how the personal information in this policy is used. Under EU and UK law, it is the "controller". Contact: [ops@waity.ai](mailto:ops@waity.ai).

This policy doesn't cover the websites of the places and sources we link to, or the AI assistants and apps that use Waity; their own policies apply. Apps that use Waity shouldn't send us personal information about their users. Waity needs only places and locations.

## 2. What we collect

**Accounts.** When you create an account, we keep:

- your email address and name, from our sign-in provider or as you give them to us (if you sign in with Google or GitHub, we get the name and email address on that account);
- what you told us you are building: an agent, an app, research or something else;
- your plan, its status and its renewal or end date, and the IDs our payment processor uses for your customer record and subscription;
- your API keys, stored only as a hash, with each key's label, its first 7 characters (so you can tell keys apart), when it was created and, to the hour, when it was last used; and
- the number of successful API calls per day, for the account and for each of its keys, for the usage charts in your dashboard; for each of your keys' requests, the number of calls per hour and per day by endpoint or MCP tool, response status, error code and response time; per day, the number of calls by the category asked for, the coverage of the answer, how the location was given (for example `near` or a place name, never the location itself) and the name the MCP client reports about itself; and how often each of your keys looked up each place, all for the charts in your dashboard; and a request history (see Account request history, below).

Your account email is the only email address we store in plain text. We use it for sign-in, billing and messages about your account.

**Free keys without an account.** When you ask for a key with `POST /v1/keys`, we store a keyed hash (an HMAC) of your email address together with the hash of your key. We don't store the address itself. This stops one address collecting many keys. We also count requests per address per day, under the same hash, to stop abuse. If the address already has a key, we may use the address once to email you a link that replaces the key. If you lose a key, write to [ops@waity.ai](mailto:ops@waity.ai) from the address you used.

**Requests to the API and the MCP server.** When you, your app or an AI agent call Waity:

- **What you ask.** We use the request, for example a place name, a category, a location, or words such as a symptom or who a visit is for ("chest pain", "pediatric ER"), only to work out which places to return. We don't store the text of a request, and we don't link it to you. If the request uses an account's key, that account's request history notes how Waity read it (for example the category, the places it matched, or a city or the first three digits of a ZIP it named) and its length, never the words themselves, and never symptoms.
- **Location.** A location sent in `near` or in the `X-Waity-Location` header is used to answer that request only. We don't store it. Our request log keeps only an area about a kilometre across, worked out from a rounded location, with no caller identifier. If the request uses a key that belongs to an account, that account's request history keeps the location only as an area about 2 km across. If a request asks for places near you without sending a location, Waity may use the approximate city your network address points to, for that request only; the answer says so, and that city isn't stored or logged, there or anywhere.
- **Network (IP) address.** We use it in the moment, to apply short-term rate limits and the daily limit for calls without a key. For the daily limit, we compute a code from the address and a random value that changes every day. The random value is deleted the next day, so codes can't be linked across days or traced back to an address. Waity's own systems don't store IP addresses.
- **Usage counts.** We count successful calls per day for each key, account or daily code. We also record which kind of client called (a key, an MCP client or no key) and the name an MCP client reports about itself, for example the name of the assistant. Separately, we count how often each place is looked up, per hour, with no caller and no location. Calls made with an account's key are also counted for that account's own dashboard, as described under Accounts above.
- **Request logs.** One line per request: the route without its query, the response status and time, the data center that served it, whether the answer came from cache, the kind of caller, and the approximate area described above. Logs contain no IP address, key, email address or query text.
- **Account request history.** For calls made with an account's key: the time, key, endpoint or MCP tool, response status and error code, response time, how many places were returned and the coverage, warnings as short codes, the request's options (such as category, limit or place IDs), and the coarse area and query reading described above. Only that account can see it. It contains no IP address, query text or precise location.

**If an AI assistant asks Waity for you.** The assistant's operator decides what it sends us, usually a place name or a location, and we handle it as described above. We don't know who you are unless the app uses a key tied to an account. Your conversation with the assistant is covered by its operator's privacy policy.

**The website.**

- **Essential cookies** remember your cookie choice and your language and, on account pages, keep you signed in ([section 6](https://waity.ai/privacy#cookies)).
- **Analytics** (in the EU, EEA, UK and Switzerland only if you agree; elsewhere on until you turn it off): the pages you view, what you click, your browser and device type, an approximate location worked out from your IP address, and a random identifier kept in a cookie. We don't record what you type into forms, and we don't record sessions. Analytics never records API keys or the email address shown in your dashboard.
- **Page counts.** We may count visits with our hosting provider's web analytics, which works without cookies and doesn't identify you.
- **Bot checks.** Signing up may include a check, run for our sign-in provider by a security service, that uses your IP address and browser details to tell people from bots.

**Emails you send us:** your address, your message and anything you include. We use them to answer you.

**From other services.**

- Our **sign-in provider** gives us your name, email address and how you sign in.
- Our **payment processor** tells us whether a payment went through, and your subscription's status and dates. It never sends us your card number.

## 3. How we use it

We use personal information to:

- run Waity: answer requests, run accounts, issue and check keys, and show your usage;
- bill you and manage your subscription;
- apply limits, prevent abuse and keep Waity secure;
- answer your messages, and tell you about your account, billing, security, or changes to our terms and this policy;
- understand how Waity is used, from counts and analytics ([section 6](https://waity.ai/privacy#cookies)), so we can improve it and decide which places to add; and
- meet legal obligations and enforce our terms.

We don't sell personal information, use it for advertising or use it to train models. Waity's usual waits and forecasts learn from wait times at places, not from people. We don't send marketing email.

Limits apply to keys and networks automatically. We don't otherwise make decisions about people by automated means. If you think a limit was applied to you in error, write to us.

## 4. Legal bases (EEA and UK)

| Purpose | Legal basis |
| --- | --- |
| Answering requests; accounts and keys | Performing our contract with you. For requests without a key, our legitimate interest in providing a public service |
| Billing and subscriptions | Contract; legal obligation for tax and accounting records |
| Limits, abuse prevention, security and request logs | Legitimate interests: keeping Waity available and secure |
| Usage and demand counts | Legitimate interests: understanding demand and planning coverage |
| Analytics cookies | Consent, which you can withdraw at any time |
| Cookie-choice, language and sign-in cookies | Strictly necessary for the service you ask for |
| Cookieless page counts and sign-up bot checks | Legitimate interests: understanding site traffic and keeping out bots |
| Answering your emails | Contract or legitimate interests |
| Responding to legal requests | Legal obligation |

## 5. Who we share it with

**Service providers.** These companies handle personal information for us, under contracts that limit their use of it to the service they provide:

| Role | What they handle |
| --- | --- |
| Hosting, network, database, logs and cookieless page counts | Everything sent to Waity, including IP addresses, and the data we store |
| Sign-in | Your email address, name, sign-in method and sessions, and the IP address and browser you sign in from, including bot checks at sign-up |
| Payments | Your payment details, billing address, email address and subscription |
| Product analytics: with your consent in the EU, EEA, UK and Switzerland; elsewhere until you turn it off | Pages viewed, clicks, browser and device, your IP address (used to work out an approximate location) and a random identifier |
| Email delivery for key-replacement links | Your email address and the message |

Our sign-in provider and payment processor also use some information for their own purposes, such as preventing fraud, under their own privacy policies.

**Legal reasons.** We share information when the law, a court order or a valid request from authorities requires it, or to protect the rights, safety or property of Waity, our users or others.

**Advisers.** We share information with our lawyers, accountants and auditors when we need their advice, under duties of confidentiality.

**Business changes.** If Waity is part of a merger, acquisition or sale of assets, information may move to the new owner. This policy, or one that protects you at least as well, will keep applying, and we'll tell you before that happens.

**With your consent**, or when you ask us to.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

## 6. Cookies

The API sets no cookies, and the website runs no advertising scripts. The website uses these cookies:

| Cookie | What it does | Kind | Lasts |
| --- | --- | --- | --- |
| `waity_consent` | Remembers your cookie choice, on waity.ai and its subdomains | Essential | About 6 months |
| `waity_lang` | Remembers the language you picked | Essential | 1 year |
| `waity_cr` | Says whether the country your connection comes from is in the EU, EEA, UK and Switzerland, so the page knows to ask before any analytics. It holds no identifier | Essential | Until you close your browser |
| Sign-in cookies on account.waity.ai and auth.waity.ai | Keep you signed in to your account. Set by our sign-in provider | Essential | Until you sign out or they expire |
| `ph_…` and `__ph_opt_in_out_…`, plus matching entries in your browser's storage | Analytics: a random identifier and your session, sent through waity.ai/ingest to our analytics provider. If you turn analytics off, one entry remembers that so it stays off | Analytics: with your consent in the EU, EEA, UK and Switzerland; on by default elsewhere | 1 year |
| Security cookies our hosting provider may set (for example `__cf_bm`) | Help tell people from bots and block attacks | Essential | Up to 30 minutes, or as the provider sets |

In the EU, EEA, UK and Switzerland we ask before any analytics runs. Elsewhere analytics is on by default. Wherever you are, you can turn it on or off at any time in Cookie settings, at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a no to analytics. Our analytics also stops if your browser sends a Do Not Track signal. If you block essential cookies, sign-in may not work.

## 7. How long we keep it

| Information | Kept for |
| --- | --- |
| Account details (email address, name, use case, plan, payment processor IDs) | While your account is open. Deleting your account in Settings removes it at once; a request by email is handled within 30 days |
| API keys (hash, label, first characters, dates) | While the account exists. Revoked keys are kept, marked revoked, until the account is deleted |
| Free-key record (a hash of your email address and of the key) | While the key exists. Deleted on request |
| Daily call counts for free keys and daily codes, and key requests per email hash | 7 days |
| Daily call counts for the quota, per account and per account key | 31 days |
| Hourly account statistics (calls, status, response time) | 8 days |
| Daily account statistics (calls, status, response time, category, coverage, how the location was given, MCP client name, place lookups) and quota history | 31 days on Free, 400 days on paid plans |
| Account request history | Up to 7 days on Free, 14 days on Plus, 30 days on Pro and 30 days on Team. When you delete your account, it can't be read from that moment and is erased within a day |
| Daily client summaries (calls per key, account or daily code, with the client kind and the MCP client's name) | 90 days |
| Request logs | Up to 7 days |
| The random value behind daily codes | Deleted the next day |
| Place lookup counts (no caller) | 400 days. They aren't personal information |
| Analytics events | 12 months |
| Emails you send us | As long as we need to answer you, then up to 2 years |
| Database recovery copies | Deleted data can remain in them for up to 30 days |
| Payment records held by our payment processor | As long as the processor and tax law require |

## 8. Security

- We use HTTPS for the website and the API, and tell browsers to keep using it.
- API keys, and the email addresses behind free keys, are stored only as keyed hashes. A key is shown once.
- We never receive card numbers.
- Logs leave out query text, keys, email addresses and IP addresses.
- Account pages use a content security policy that limits where scripts and content can load from, and other sites can't embed them.
- Only the people who run Waity can reach production data.

No system is perfectly secure. If a breach affects your personal information, we'll tell you, and the authorities, as the law requires.

## 9. Your rights and choices

Wherever you live, you can ask us to:

- **access** your personal information, or give you a copy in a portable format (your dashboard already shows most of it);
- **correct** it;
- **delete** it. You can delete your account yourself in Settings, which removes your account, keys and usage at once and ends any paid plan (your request history and statistics can't be read from that moment and are erased within a day); or write to us. We ask our sign-in provider to delete your sign-in record. Our payment processor keeps payment records as the law requires;
- **object to** or **restrict** some uses; and
- **turn off** analytics, or withdraw your consent to it, at any time, in Cookie settings.

To make a request, email [ops@waity.ai](mailto:ops@waity.ai) from the address on your account, or the address you used for a free key. We may ask you to confirm that it's you. We'll answer within 30 days, or sooner if your local law requires it. We won't charge you, or treat you differently, for using your rights. Where the law allows, someone else can make a request for you as your authorized agent; we may ask for proof that they act for you.

For free keys we store only a hash of your email address, so we can find your record only if you tell us the address. We can't link calls made without a key to you, so there is nothing about them for us to access or delete.

If we decline a request, we'll explain why, and you can appeal by replying to our answer. If you're in the EEA or the UK, you can also complain to your data protection authority.

## 10. US state privacy rights

This section is for residents of California and other US states with consumer privacy laws.

- **What we collected in the last 12 months:**
  - identifiers: email address, name and account ID, plus IP address, which we use briefly and don't store;
  - commercial information: plan and subscription;
  - internet activity: usage counts, request logs, and analytics unless you turned it off;
  - location: used per request; our request log keeps only an area about a kilometre across with no identifier, and an account's request history keeps only an area about 2 km across.
- **Sensitive personal information:** your account sign-in, which our sign-in provider handles; a precise location, if you or your app send one; and health-related words in a request, such as a symptom. We use these only to answer the request and don't store them.
- **Sources, purposes and recipients:** sections [2](https://waity.ai/privacy#what-we-collect), [3](https://waity.ai/privacy#how-we-use-it) and [5](https://waity.ai/privacy#sharing). **How long we keep it:** [section 7](https://waity.ai/privacy#retention).
- **No selling or sharing.**
  - We don't sell personal information or share it for cross-context behavioral advertising, and we haven't in the last 12 months.
  - We don't use or disclose sensitive personal information for any purpose that would give you a right to limit it.
  - We have no actual knowledge of selling or sharing the personal information of anyone under 16.
- **Your rights:** to know about, access, delete, correct and port your information, and to appeal our decision about a request. To make a request, follow [section 9](https://waity.ai/privacy#your-rights). If we deny your appeal, you can contact your state's attorney general.

## 11. International transfers

Waity is run from the United States. We and our providers process personal information in the United States and in other countries whose data protection laws may differ from yours. When we transfer personal information from the EEA, the UK or Switzerland, we rely on safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and the UK addendum.

## 12. Children

Waity isn't directed to children. You must be 18 or older to create an account or get a key. We don't knowingly collect personal information from children under 13, or under 16 in the EEA and the UK. If you think a child has given us personal information, write to us and we'll delete it.

## 13. Changes to this policy

We'll post any change here with a new effective date, and list it under History below. If a change is material, we'll tell account holders by email or in the dashboard before it takes effect.

### History

- October 30, 2026: full rewrite. It replaces the short privacy page previously at this address.
- October 30, 2026: analytics is on by default outside the EU, EEA, UK and Switzerland, and can be turned off in Cookie settings; in the EU, EEA, UK and Switzerland it still runs only with consent.
- October 31, 2026: account dashboards show request history and statistics for calls made with the account's keys; sections 2 and 7 describe what they keep.

## 14. Contact

Privacy questions and requests, and anything else: [ops@waity.ai](mailto:ops@waity.ai).