Privacy Policy

This policy covers Wavefront at wavefront.adwave.com, its API and its MCP server. It explains what we collect, why, who we share it with, and the choices you have. Wavefront is operated by Adwave Digital Inc (“Adwave”, “we”, “us”).

Who we are

Adwave Digital Inc decides how information is used to run Wavefront: accounts, billing, support, security and product improvement. For content and data that a workspace puts in Wavefront, the business that owns the workspace decides what goes in and where it is published, and we process it to provide the service to them. Wavefront is for businesses and their representatives who are 18 or older. Privacy requests go to privacy@adwave.com; account help goes to support@adwave.com.

What we collect

Account details: your email address, your name and profile picture when you sign in with Google, the workspaces you belong to and your role in each.
Workspace content: the business profile, voice, audience, keywords, strategies, briefs, documents you upload or import, drafts, comments, approvals, published versions and the images Wavefront makes or you supply.
Connections you set up: publishing destinations (for example WordPress, Webflow, GitHub or a webhook), Slack, Microsoft Teams, social accounts, Bing Webmaster Tools and Google. Their access tokens and keys are stored encrypted and are never shown back.
Billing: your plan, credits and invoices. Payments are handled by Stripe; we never see or store full card numbers.
Usage and security data: sign-in events, API and MCP requests, IP address and browser details, and error logs, used to run and protect the service.
Public web pages: to ground drafts in facts, Wavefront reads public pages, including your own site, the sources it cites, and site metrics from public rankings.

Google user data

You can connect a Google account to a workspace. Each Google permission is asked for only when you turn on the feature that needs it, and you can disconnect at any time.

Sign in with Google (openid, email, profile): we read your email address, name and profile picture to create and sign in to your Wavefront account.
Search Console (webmasters.readonly): an owner picks one property. Wavefront reads its search performance (queries, pages, clicks, impressions, average position) and sitemap status.
Google Analytics (analytics.readonly): an owner picks one GA4 property. Wavefront reads traffic totals, landing pages and channel groups.
Google Drive (drive.file): you pick individual files in Google’s file picker to import into a workspace. Wavefront can open only the files you pick.

How we use it. Google data is used only to provide and improve the user-facing features you turned on in that workspace: the Performance page, results on each published article, strategy suggestions, and plans and drafts that build on the searches your site already appears for. To do that, Wavefront sends parts of it (for example top queries and pages) to the AI model providers listed below, under terms that do not let them train their models on it.

What we never do. We do not sell Google user data. We do not use it for advertising, retargeting or interest-based ads. We do not use it to develop, improve or train generalized AI or machine-learning models. We do not let people read it, except with your consent for a specific message, when needed for security or to comply with the law, or when it has been aggregated and anonymized for internal operations. We do not transfer it to others except as needed to provide or improve the features above, to comply with the law, or as part of a merger or acquisition with notice to you.

Wavefront’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and deletion. Google refresh tokens are encrypted at rest. Synced Search Console and Analytics data is kept as a rolling 28-day snapshot that each sync replaces. When an owner disconnects Google in Settings → Integrations, we revoke the token with Google and delete the stored token and the synced data. You can also remove Wavefront’s access at any time from your Google Account’s security settings. Files you import from Drive become workspace documents and follow the workspace’s retention below.

How we use information

to run Wavefront: plan, draft, check, review, schedule and publish content;
to sign you in, send sign-in codes, invitations and notifications you set up;
to bill for plans and credits and to prevent fraud and abuse;
to secure the service, debug problems and answer support requests;
to improve Wavefront, using usage data and aggregated, de-identified measurements;
to meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use workspace content or Google user data to train AI models.

Service providers

These providers process information for us to run Wavefront:

Cloudflare: hosting, database, file storage and security.
Anthropic and Google (Gemini): AI models that write, check and edit drafts and make images. Inputs are not used to train their models.
Firecrawl: reads public web pages for research and fact checking.
DataForSEO: keyword and site-authority data about public websites.
Unsplash and Pexels: stock photos.
Resend: sign-in codes and notification email.
Stripe: payments and invoices.
Ayrshare and X: social posting, when you link social accounts.

Destinations and tools you connect (your CMS, Slack, Microsoft Teams, Bing, webhooks) receive the content and events you send them, under their own terms. The subprocessors list gives more detail on each provider.

We share information with professional advisers, to answer lawful requests, to protect the rights and safety of people and the service, and with a successor if Adwave is involved in a merger, acquisition or sale of assets. People in your workspace see the workspace’s content according to their role.

Retention

Workspace content is kept while the workspace exists. Published versions and their records are kept so you can see what was published and when. Billing records are kept as long as tax and accounting law requires. Security logs are kept for a limited time. When a workspace is deleted, its content, connections and stored tokens are deleted within 30 days, except where the law requires us to keep records.

Your choices and rights

Disconnect Google, Bing or any destination in the workspace settings.
Leave a workspace, or ask us to delete your account or a workspace you own.
Export content through the API or the Library.
Unsubscribe from non-essential email with the link in each message.

Depending on where you live, you may have rights to access, correct, delete or get a copy of your personal information, and to object to or limit some uses. Email privacy@adwave.com and we will answer within 30 days. We may need to confirm your identity first.

Security

We use encryption in transit, encryption at rest for tokens and keys, per-workspace access controls and audit records. No method of transmission or storage is completely secure; tell us at support@adwave.com if you find a problem.

Where data is processed

Wavefront is run from the United States, and our providers may process data in other countries. We rely on their contractual safeguards for those transfers.

Changes

We update this page when the policy changes and change the date above. Material changes are announced by email to workspace owners before they take effect.

Contact

Adwave Digital Inc, c/o Incorporating Services, Ltd., 3500 South DuPont Highway, Dover, DE 19901, USA. privacy@adwave.com.