This Privacy Policy explains how Waypost Ltd (“Waypost”, “we”, “us”) collects, uses, and protects your personal data when you use our platform. For details on data processing by our AI provider, see Section 5.2 of our Terms of Service.

What we collect

When you create an account, we collect your email address, name (if provided), and authentication credentials. When you use the platform, we process your business information, website content, contact data (if you use the CRM), and usage analytics.

How we use your data

To provide and improve the Waypost platform
To process payments via our payment provider (Stripe)
To send transactional emails (account confirmations, booking notifications, automation emails)
To generate AI-powered content, imagery and suggestions via the Claude API (Anthropic) and Google Gemini
To send SMS and WhatsApp messages, if you enable messaging
To sync bookings with your calendar, if you connect one
To monitor errors and keep the service running

If you use the People tab to manage contacts, you are the data controller for that information and Waypost is your processor — see Section 5 of our Terms of Service.

Third-party processors

We share personal data with the following processors. Some receive data only if you use the feature they support.

Anthropic (Claude API) — AI site generation, chat edits, and Co-Founder suggestions. Prompts include your business details, your website content, and — for Co-Founder features — contact names and message drafts. Anthropic's no-training policy applies to API data.
Supabase — Database hosting and authentication. Stores your account, your projects, and your CRM records including the contacts you add.
Vercel — Hosts the Waypost application. Also provides page analytics, which load only after you accept analytics cookies.
Cloudflare — Hosting and CDN for the websites you publish, DNS for waypost.co.uk subdomains and custom domains, and storage for encrypted database backups.
Stripe — Subscription billing, and — if you enable payments — your own customers' checkout, invoices and refunds. We never see or store card details.
Resend — Delivery of transactional and automation email, including booking confirmations and follow-ups you send from the CRM.
Sentry — Error monitoring, so we can find and fix faults. Events are scrubbed of email addresses, phone numbers, card numbers and access tokens before they are sent.
Google — Three separate services: Gemini generates imagery for your site; Places is used to look up business listings; and Google Calendar receives and returns booking events, but only if you choose to connect a calendar.
Twilio — SMS and WhatsApp delivery, only if you enable messaging. Receives the recipient's phone number and the message content.
Browser push services (Google, Mozilla, Apple) — Delivery of browser notifications to your own device, if you turn them on. The notification content is encrypted end to end, but your browser vendor's push service handles the delivery and can see that a message was sent and when.

Several of these providers are based outside the UK, principally in the United States, so using Waypost involves transferring personal data internationally.

Your rights

Under UK GDPR, you have the right to access, correct, delete, or export your personal data. Contact us at support@waypost.co.uk to exercise these rights.

Data retention

We retain your data for as long as your account is active. After account deletion, we remove your data within 30 days, except where retention is required by law.

Contact

Waypost Ltd
Email: support@waypost.co.uk