Privacy Policy
This Privacy Policy explains how WaveDrop collects, uses, stores and shares personal data when you visit wavedrop.ch, apply for our pilot, or use the WaveDrop app (osquare.wavedrop.ch). It is written to meet the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
WaveDrop is operated by O'SQUARE, a music collective based in Bern, Switzerland, organized as a simple partnership and represented by Benyer Marc Reber, Bächtelenweg 3, 3084 Wabern, Switzerland. Contact: hello@wavedrop.ch.
For the data of your contacts (the people you send packs to), you are the controller and we act as your processor. Section 7 explains this.
2. Data we process
Account data. When you sign in with Google we receive your name, email address, Google account ID and profile picture URL. We also store your plan, trial and subscription status, the date you registered and your last login. If you rate the setup guide, we store your rating and optional comment with your account to improve WaveDrop.
Google authorization. To send emails from your Gmail account we store an OAuth access token and refresh token for the scope gmail.send. Tokens are stored encrypted.
Content you add. Contacts (name, email address, contact types, active or unsubscribed status, and when you confirmed you may email them), packs (name, link, up to three MP3 files), email templates and drops (schedule and settings).
Sending data. For every send attempt we log the recipient's name and email address, the pack name, the subject, the time, the result and, where relevant, the error reason.
Click data. Pack links in your emails go through a WaveDrop redirect. When a recipient opens the link we record the time of the first click for that email. We do not track email opens and we do not use tracking pixels.
Unsubscribe data. When a recipient opts out of your emails we store their email address together with your account so you never email them again.
Website forms. If you apply for the pilot or contact us, we receive the details you enter (for example name, email address, artist alias, how many people you send music to, your confirmation that you are 18 or older, and your message). We are notified about new submissions by email.
Payment data. Payments will be processed by our reseller and merchant of record, Lemon Squeezy. We do not receive or store your card details. We receive your name, email, country, plan and payment status.
Technical data. Our servers process your IP address, browser type and request time to deliver the service and keep it secure. Server logs are kept for up to 30 days.
3. Why we use your data
- To create and run your account and provide the features you use (contract, GDPR Art. 6(1)(b))
- To send emails from your Gmail account when you or your drop schedule tell us to (contract)
- To show you send history, click statistics and usage limits (contract)
- To handle billing and keep accounting records (contract and legal obligation, Art. 6(1)(b) and (c))
- To prevent spam and abuse, secure the service and fix errors (legitimate interest, Art. 6(1)(f))
- To answer your pilot application or message (legitimate interest or steps before a contract)
- To send you service notices about your account. We only send marketing emails if you agree, and you can opt out at any time.
We do not sell personal data. We do not use your data or your contacts' data to train AI models and we do not use it for advertising. We do not make automated decisions that have legal or similarly significant effects on you.
4. Google user data
WaveDrop requests the following Google scopes: openid, email and profile to sign you in, and gmail.send to send emails on your behalf.
- Access: With gmail.send we can only send emails. We cannot read, search, list, change or delete any email, draft or label in your mailbox.
- Use: We use gmail.send only to send the emails you set up in WaveDrop, from your address, to the contacts you choose. We use your name and email address to identify your account.
- Storage: Tokens are stored encrypted on our servers in Germany and deleted when you delete your account or revoke access.
- Sharing: We do not share Google user data with anyone, except where needed to provide the service (our hosting provider stores the encrypted data), to comply with the law, or as part of a merger or acquisition with your prior consent.
- Human access: No person at WaveDrop reads data obtained through Google APIs, unless you ask us to for support, it is needed for security or to investigate abuse, or the law requires it.
- Revoking access: You can revoke WaveDrop's access at any time in your Google account under Security, Third party apps, or by deleting your WaveDrop account.
WaveDrop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who receives data
We use these service providers, who process data on our behalf under data processing agreements:
Emails you send through WaveDrop are delivered by Google to your recipients. Emails you write to hello@wavedrop.ch are stored by our email provider Hostpoint AG in Switzerland. Inside WaveDrop, only a small number of named team members with admin rights can see account details and recent send metadata to provide support and prevent abuse. Recipient addresses are masked in that view, and every time a full address is shown it is logged. They cannot see the content of your mailbox. We may disclose data to authorities if the law requires it.
6. Transfers abroad
Our main hosting is in Germany and our email is hosted in Switzerland. Switzerland and the EU recognize Germany as providing adequate protection. Google, Webflow and Lemon Squeezy may process data in the USA. Where a provider is certified under the Swiss-US or EU-US Data Privacy Framework we rely on that certification; otherwise we rely on the standard contractual clauses approved by the European Commission and recognized by the Swiss FDPIC.
7. Data of your contacts (we act as your processor)
When you add contacts and send emails, you decide who receives what. You are responsible for having a lawful basis to email your contacts, including their consent where the law requires it, and for informing them about your processing. We process your contacts' data only on your instructions and as described in our Data Processing Addendum. Every email sent through WaveDrop contains an unsubscribe link. Recipients who opt out are blocked from future emails from that sender.
If you received an email sent through WaveDrop and have a question about your data, please contact the sender first. You can also write to us and we will forward your request.
8. How long we keep data
9. Security
We use HTTPS for all connections, encrypted storage of Google tokens, short lived login tokens, strict access controls, rate limits and regular dependency security scans. No system is perfectly secure. If a data breach is likely to cause a high risk to you, we will inform you and the competent authority as required by law.
10. Cookies and fonts
The app uses only strictly necessary cookies: a session cookie during sign in and a secure, HttpOnly cookie that keeps you signed in for up to 7 days. We do not use analytics, advertising or tracking cookies. The app's fonts are served from our own servers, so no data is sent to Google Fonts.
11. Your rights
You can ask for access to your data, a copy in a common format, correction, deletion, restriction, or object to processing based on legitimate interest. You can withdraw consent at any time. You can delete your account yourself in the app under Settings, Profile. To exercise your rights, write to hello@wavedrop.ch. We answer within 30 days.
You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you live in the EU, you can also complain to the data protection authority in your country.
12. Age
WaveDrop is meant for people aged 18 and over. We do not knowingly collect data from children.
13. Changes
We may update this policy when our service or the law changes. We will announce material changes in the app or by email before they take effect. The current version is always available at wavedrop.ch/privacy.