Privacy Policy
Waveform License Manager
Effective date: October 1, 2026
1. Who we are and what this policy covers
This policy explains how Waveform Inc ("we", "us") handles personal data in connection with the Waveform License Manager, a Shopify app and its associated license activation API. The app creates, delivers and enforces software license keys on a merchant's behalf.
Waveform Inc is established in Nevada, USA. Our address is 23438 Toronja Corte, Corona, CA 92883, USA.
We handle personal data in two roles:
- As a processor for the personal data of a merchant's customers (buyers). The merchant is the controller. We process buyer data only on the merchant's behalf and on their instructions. We offer merchants a Data Processing Agreement on request.
- As a controller for the personal data of the merchant's own staff users (the people who install and operate the app) and for operational and security data such as server logs.
We set no advertising or tracking cookies. The embedded admin app keeps session state on the server, in our database, and not in cookies we set.
2. The personal data we process
Buyer (customer) data, processed for the merchant
- Email address, to deliver the license key and to match a buyer to their licenses in the "My Licenses" account page. Stored.
- First name, used only to greet the buyer in the license delivery email. Accessed transiently and never stored.
- Customer identifier (the Shopify customer id), to associate a buyer with their licenses.
- Device identifier, stored as a salted, server-side hash of a device fingerprint and never as a raw machine id, to enforce the per-license device limit.
- Device name, as reported by the buyer's software, which may contain a personal name.
- Online session identifier, for online-mode products: a per-running-instance id and optional label, used to enforce concurrency limits.
- Order and subscription references, which are non-identifying ids used for idempotency and renewals.
- IP address, which may appear transiently in our server logs when a buyer's software contacts the activation API and an error occurs, and which is also used as a short-lived rate-limiting key. We use it for security and abuse prevention and keep it only for our log retention window.
We do not read, use or store buyers' postal addresses or phone numbers. Shopify's order webhook payload may contain them, but our app parses only the fields listed above.
Merchant staff data, for which we are the controller
- Name, email and Shopify user id, plus locale and role flags, taken from the Shopify OAuth session, to authenticate the merchant's staff and operate the embedded app.
- Shopify access tokens, which are credentials stored securely and used to act on the store as authorized.
3. Why we process it, and our lawful bases
| Purpose | Data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Mint, deliver and enforce license keys; buyer self-service page | Buyer email, name, device, session and order data | Processed on the merchant's instructions. The merchant's basis is typically performance of the purchase contract and/or legitimate interests |
| Authenticate and operate the app for merchant staff | Staff name, email, id and access tokens | Performance of our contract with the merchant; legitimate interests (operating the service) |
| Security, abuse prevention and debugging | IP in logs, rate-limit keys, audit logs | Legitimate interests (securing the service) |
| Legal compliance, such as responding to data-subject requests | As applicable | Legal obligation |
We do not use personal data for marketing, and we make no automated decisions that produce legal or similarly significant effects.
4. Who we share it with (sub-processors)
We do not sell personal data or share it with third parties for their own purposes. We use the sub-processors below, each acting on our instructions.
| Sub-processor | What they process | Purpose | Location |
|---|---|---|---|
| Render | The database, key-value store and server logs | Hosting, database, rate limiting | United States (Oregon). SOC 2 Type 2 |
| Resend | Buyer email address and first name, and license key values (and, on app uninstall, a CSV of the merchant's license data) | Transactional key delivery email | United States |
| Google Fonts | A buyer's IP address, only if their email client loads the email's remote font | Email typography (incidental) | Per Google |
Shopify is the commerce platform your store runs on. It is the source of the order and customer data that flows to the app, and your relationship with Shopify is your own platform and processor relationship, so we do not list it as a sub-processor. We provide the current sub-processor list to merchants on request.
5. International transfers
Our infrastructure is hosted in the United States. If you are located in the EEA or the UK, using the app involves transferring your personal data to the United States. Contact support@waveformanager.com for information about the safeguards that apply to those transfers.
6. How long we keep it
We keep personal data only as long as needed for the purposes above, and then delete or de-identify it. In summary: license data is kept while the app is installed and the license is in service; a customer erasure request is fulfilled within 30 days; a store's data is erased after the app is uninstalled; encrypted backups roll off within 30 days; and logs are kept for our hosting platform's log retention window.
7. How we protect it
Our security measures include: TLS for traffic in transit at the platform edge; encryption at rest of the managed database at the hosting provider level, plus application-level AES-256-GCM encryption of signing keys and of database backups; hashing of device identifiers; redaction of sensitive values from logs; restricted access to production systems; and a documented incident response process.
8. Your rights
Depending on your location, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability.
- If you are a buyer of a merchant that uses our app, the merchant is the controller of your data. Please send your request to the merchant you purchased from. The merchant can action it through the app, which forwards deletion and access requests to us, and we assist the merchant in fulfilling it within the statutory timeframe.
- If you are a merchant or staff user, contact us at support@waveformanager.com and we will respond within the timeframe required by applicable law.
You may also lodge a complaint with your local data protection authority.
9. Children
The app is a business-to-business tool. It is not directed to children, and we do not knowingly process children's personal data.
10. Changes to this policy
We may update this policy. Material changes will be reflected by an updated effective date and, where appropriate, communicated to merchants.
11. Contact
Waveform Inc, 23438 Toronja Corte, Corona, CA 92883, USA.
Privacy contact: support@waveformanager.com
We have no establishment or representative in the European Union or the United Kingdom.