Privacy Policy

Wavelify (“we”, “us”) operates the Mapper platform. This Policy applies to our websites, dashboards, APIs, and edge probes (the “Service”). Where we process personal data on behalf of a business customer, the customer is the controller and this Policy is supplemented by our Data Processing Addendum and the customer’s own privacy notices.

We collect the following categories of information:

• Account and contact data — name, work email, organization, role, and authentication data (hashed passwords, multi-factor codes, session metadata).
• Billing data — plan, orders, invoices, purchase orders, and payment-terms information. We do not store full payment-card numbers.
• Network and RF telemetry — wireless measurements collected by your probes, which may include access-point and client device identifiers (such as BSSIDs/MAC addresses and SSIDs), signal strength, channel and interference data, and timestamps. This data is collected from your environment under your control.
• Usage and device data — log data, IP address, approximate location derived from IP, browser/device information, pages viewed, and diagnostic and performance data.
• Support and communications — messages you send us and related metadata.

Network and RF telemetry may include identifiers that, in some jurisdictions, are treated as personal data. You are responsible for configuring and using the Service lawfully, including any required notices and consents for the environments you monitor.

• to provide, operate, secure, maintain, and improve the Service;
• to authenticate users, including multi-factor authentication, and to prevent fraud and abuse;
• to generate dashboards, heatmaps, inventories, and informational alerts;
• to provide support, send service and security notices, and communicate about your account;
• to bill and collect fees and maintain business records;
• to create aggregated or de-identified analytics that do not identify you or any individual; and
• to comply with law and enforce our agreements.

Where we act as a processor, we use customer network and RF telemetry only to provide the Service to that customer and as instructed by them, except as required by law.

Where the GDPR or UK GDPR applies and we act as a controller, we rely on the following legal bases: performance of a contract; our legitimate interests in operating and securing the Service (balanced against your rights); compliance with legal obligations; and consent where required. Where we act as a processor, our customer determines the legal basis.

We do not sell personal information. We share information only as follows:

• Service providers / sub-processors — cloud hosting, email delivery, monitoring, and similar vendors who process data on our behalf under contract and confidentiality obligations.
• Within your organization — with other authorized users of your account, according to the roles you configure.
• Legal and safety — when required by law, legal process, or to protect the rights, safety, and security of Wavelify, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We may process and store information in countries other than where you are located. Where required, we use appropriate safeguards for cross-border transfers, such as the European Commission’s Standard Contractual Clauses.

We retain personal data for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Network and RF telemetry and log data are retained according to your plan’s configured retention windows and may be deleted or aggregated thereafter.

We use technical and organizational measures designed to protect information, including encryption in transit, access controls, multi-factor authentication, and tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. If our customer is the controller of the data, please direct your request to that customer; we will assist them as required. To exercise rights regarding data for which we are the controller, contact [email protected]. You may also have the right to lodge a complaint with your supervisory authority.

We use strictly necessary cookies to operate the Service (for example, to keep you signed in) and limited analytics to understand and improve usage. You can control cookies through your browser settings; disabling necessary cookies may break core functionality.

The Service is a business tool not directed to children, and we do not knowingly collect personal data from anyone under 18.

We may update this Policy from time to time. Material changes will be indicated by updating the “Last updated” date and, where appropriate, by additional notice.

Questions or requests regarding privacy can be sent to [email protected].