Wavegrain privacy notice

Information used by Wavegrain

Account details: your email address, name and sign-in records. Your work: brand profiles, website addresses you ask us to read, prompts, scripts, slide text, uploaded and generated images, creator photos, image boards, saved formats, exports, automations and scheduling choices. Account records: your plan, credits, credit use and, if you buy a plan, your customer and subscription numbers at the payment provider. Connections: social accounts and access tokens for apps you connect to Wavegrain. If you join the waitlist, we keep your email address.

The service also processes session cookies and technical information needed to authenticate requests, protect accounts and investigate failures. To stop signup abuse, we briefly keep your IP address and a device marker.

How the service uses information

The service uses this information to sign you in, save your work, generate content, render exports and carry out uploads that you approve. Prompts, brand details and images are sent to the AI model provider used for that request. Image searches send your search words to stock photo services. Sign-in, the database, file storage and hosting run on the servers of our service providers. Payments run through our payment provider. We count page visits and app use with analytics tools that we host ourselves. These tools also record a replay of some visits, about 15 in 100, for up to 5 minutes.

Services that receive information

Wavegrain uses the kinds of service providers below. Each one receives only the information needed for its task. A list of our service providers is available on request.

Hosting and storage. Our hosting providers run the application, the sign-in service and the database that holds your account and saved work. A file storage provider stores uploaded images, generated images and exports.

Payments. When you buy a plan, you enter your payment details on a checkout page run by our payment provider. Wavegrain does not receive your full card number. Wavegrain stores the customer and subscription references and the plan that the payment provider reports back.

Signup protection. The signup form uses a bot check to tell people from automated signups. The provider of this check receives technical signals from your browser.

Analytics. Our analytics tools run on servers the operator manages, not on a third-party analytics service. Page views are counted without cookies. For a sample of visits, a replay of how the page was used is recorded, with masking turned on. Named product events, such as creating a slideshow, are also counted.

Text generation. Scripts, brand profiles, text read from images and remixes are made by AI model providers. Your prompts, brand details and, for those tasks, the related images go to the provider used for the request. If that provider is not available, a text request can go to another AI model provider.

Image generation. Slide images are made by AI image providers, depending on the image format. The image prompt goes to that provider. When you use a reference image, that image also goes to it.

Image search. When you search for images or import a board, your search words or the board link go to stock photo services or to Pinterest. Wavegrain uses its own access to Pinterest and never asks for your Pinterest login.

Optional sign-in with Google. If you choose this button, Google confirms your identity and shares your email address and basic profile with Wavegrain.

Email. Sign-in, confirmation and account emails are sent through an email delivery provider. It receives your email address and the content of each message.

AI assistants through MCP. If you connect an AI assistant to Wavegrain through MCP, the server logs one line per tool call with the tool name, the access key id, your account id, the outcome and the time, and never the inputs or outputs of the call.

Social networks you connect. Wavegrain can publish to TikTok, Instagram, Facebook, Threads, YouTube, LinkedIn and Pinterest. Each network is turned on separately, and Settings shows the ones you can connect today. A network receives information only after you connect your account to it. It then receives the photos or video, titles, captions and settings of each post you approve, and it processes them under its own privacy policy. You can disconnect a network in Settings at any time. The sections below say what each connection uses and how it is deleted.

TikTok account connection

Connecting TikTok shares an account identifier, display name, granted permissions and access credentials with Wavegrain. Credentials are encrypted in storage and are not returned by the account-list API. Wavegrain sends approved photos, titles, captions and applicable settings to TikTok. TikTok processes uploaded content under its own privacy policy.

You can disconnect TikTok in Settings. Wavegrain then revokes the connection, clears stored tokens and cancels unsent deliveries. Content already sent to TikTok must also be managed there. Inbox drafts need your action in TikTok before publication.

YouTube account connection

Wavegrain uses YouTube API Services to connect a YouTube channel and upload the Shorts you approve. Google processes this information under the Google Privacy Policy.

When you connect YouTube, Google asks you to let Wavegrain upload videos and view your YouTube account. Wavegrain reads your channel ID and channel name to show which channel is connected and to check that it is still the same channel each time access is renewed. Wavegrain stores the channel ID, the channel name, the permissions you granted and the access credentials. Credentials are encrypted in storage.

For each upload you approve, Wavegrain sends the slideshow video, title, description, visibility, the made-for-kids choice and whether the video contains AI-generated content to YouTube. Wavegrain then stores the YouTube video ID and reads that video's processing status to show the delivery status. Wavegrain does not read your other videos, comments, subscribers or analytics.

You can disconnect YouTube in Settings. Wavegrain then revokes its access at Google, deletes the stored credentials, channel ID and channel name, removes the YouTube video IDs from your delivery history and cancels unsent deliveries. Your delivery history keeps your own slideshow, title, description, times and the last known status. In addition to disconnecting in Settings, you can remove Wavegrain's access to your Google account at any time on the Google security settings page. Wavegrain renews its access to a connected channel when it uploads or checks a video, and otherwise after about 7 days without use. When Google no longer accepts Wavegrain's access, Wavegrain deletes the same data as for a disconnect, and you can connect the channel again. Videos already uploaded stay on YouTube until you remove them there. For questions or complaints about how Wavegrain handles YouTube data, use the contact details below.

Wavegrain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram, Facebook and Threads account connection

Instagram, Facebook and Threads are run by Meta, which processes this information under the Meta Privacy Policy. When you connect one of them, Meta shares with Wavegrain the ID and name of the account or Facebook Page, the app-scoped ID of the person who connected it, the permissions you granted and the access credentials. Credentials are encrypted in storage and are never shown in the app.

Wavegrain uses this access only to show which account a post goes to and to publish the posts you approve: the photos, the caption and, on Instagram, the AI label if you tick it. After a post is published, Wavegrain stores its ID and can read its like, comment and share counts to show them in your Calendar. Wavegrain does not read your messages, followers or other posts.

You can disconnect an account in Settings at any time; Wavegrain then deletes the access credentials and cancels posts that were not sent yet. You can also remove Wavegrain in the settings of Instagram, Facebook or Threads, under apps and websites. Meta then tells Wavegrain, which deletes the credentials, the account ID and name, the person ID, and the IDs and counts of the posts it made for you there. If you ask Meta to have your data deleted, you get a link to a status page with a confirmation code. Your own slideshows and captions stay in your Wavegrain account, and posts already published stay on the network until you remove them there.

LinkedIn account connection

When you connect LinkedIn, LinkedIn shares your member ID and name, the permissions you granted and an access credential, which lasts 60 days and is encrypted in storage. Wavegrain uses them only to show which profile a post goes to and to publish the images and text you approve to your own profile. Wavegrain does not read your connections, feed, comments or other members' data.

Disconnecting LinkedIn in Settings deletes the access credential and cancels posts that were not sent yet. To have your member ID and name deleted at once as well, email us as described under your rights below. LinkedIn processes posts under the LinkedIn Privacy Policy.

Pinterest account connection

When you connect Pinterest, Pinterest shares your account ID and name, the permissions you granted and access credentials, which are encrypted in storage. Wavegrain reads the list of your boards each time you open the composer, so you can pick one, and does not keep that list. It publishes only the Pins you pick and send yourself, and stores the ID of each Pin to show its status and its saves and views in your Calendar.

Disconnecting Pinterest in Settings deletes the access credentials and cancels Pins that were not sent yet. Pinterest processes Pins under the Pinterest Privacy Policy.

How long we keep information

We keep your account and your work while your account is active. During the beta, an account stays active until you ask us to delete it. Disconnecting a social account does not delete your saved slideshows. You can delete single slideshows and uploads yourself at any time.

Some data is kept for a short, fixed time. IP address limits for signup expire after 1 hour, and the signup device marker after about 1 week. Server logs are kept for 30 days. Analytics data is kept for 14 months. One image provider keeps generated images on its servers for 24 hours. A waitlist email is kept until we invite you or you ask us to remove it.

Deleting your account

To delete your account, email [email protected] from the email address of your account. Use the subject Wavegrain account deletion. If you write from another address, we may ask you to confirm that the account is yours.

Within 30 days of your request, we delete your account, your sign-in details and all your work, including uploaded and generated files, brand profiles, exports, automations and social connections. We tell you by email when it is done. Content you already posted on TikTok or other networks stays there until you remove it on that network.

Some records stay after deletion. Records of credit use and payments keep only an internal account number, with no name or email, for 10 years for accounting and tax. If you paid for a plan, the payment provider keeps its own payment records under its own privacy policy. Database backups keep a copy of deleted data until they expire after 14 days, and we do not restore deleted accounts from them.

Your choices and requests

You can edit your saved work and manage social connections in Settings. Contact us below for access, correction, deletion or other privacy requests. Include Wavegrain privacy request in the subject. We may need to verify that the request concerns your account.

Legal grounds. We use your information to provide the service you signed up for and to carry out the uploads you approve (Article 6(1)(b) GDPR). We use it to keep the service secure, stop signup abuse, fix failures and measure how the site is used, which are our legitimate interests (Article 6(1)(f) GDPR). We keep payment and accounting records because tax law requires it (Article 6(1)(c) GDPR). Where a step depends on your consent, you can withdraw it at any time, and the withdrawal does not affect what was done before.

Transfers outside the EU. Some of our service providers process data outside the European Economic Area, including in the United States. For these transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, or on the standard contractual clauses approved by the European Commission.

Your rights. You have the right to access your data, to have it corrected or deleted, to restrict its use, to receive it in a portable format, and to object to uses based on legitimate interests (Articles 15 to 21 GDPR). You can also complain to a data protection supervisory authority, for example the one where you live or the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), which is responsible for the operator.

Operator and contact

Peter Pham is the responsible operator for Wavegrain. Use the details below to get in touch.