Legal draft
Privacy information
This page describes WaitBeam's current privacy-first MVP architecture. It deliberately uses no advertising, marketing or behavioural analytics technologies.
1. Controller and contact
Controller: Andrej Fröhlich, private individual, Friedrich-Engels-Platz 9/2/21, 1200 Vienna, Austria. Privacy contact: support@waitbeam.com.
[OWNER/LEGAL REVIEW: add a data protection officer contact only if one is appointed or legally required.]
2. Business accounts
WaitBeam processes the business user's name, email address, password credential, account and session records, and the business, location, service and queue settings they provide. Passwords are hashed by Better Auth and are never stored as plain text.
The session database record is deliberately created without a stored IP address or user-agent string. A secure, HttpOnly, SameSite=Lax session cookie keeps the business user signed in.
[OWNER/LEGAL REVIEW: confirm the applicable GDPR legal basis, the business-account retention period and the final account-deletion process.]
3. Accountless guests
Guests do not create accounts. WaitBeam processes only a display name, selected service, party size, queue status, operational timestamps and a cryptographically unpredictable guest access token.
The access token appears in the personal status-page URL. Anyone who receives that URL may be able to view that one guest's queue status, so it should not be shared. The token does not allow access to the staff dashboard or another guest's entry.
To prevent join spam, the public join endpoint derives a SHA-256 rate-limit key from the request IP address. WaitBeam does not store the raw IP address; the one-way key remains only in Worker memory for the rate-limit window or Worker runtime.
No phone number, email address, precise location, marketing profile or free-text note is collected in the MVP.
4. Hosting, recipients and residency
WaitBeam runs on Cloudflare Workers, Durable Objects and D1. The production D1 database is configured with EU jurisdiction and Durable Object access is requested with EU jurisdiction.
EU database jurisdiction does not by itself guarantee that every request, security log or traffic metadata item is processed only in the EU. [OWNER/LEGAL REVIEW: verify the deployed Cloudflare plan, Regional Services, Customer Metadata Boundary settings, data-processing agreement and transfer safeguards before launch.]
Messages sent to support@waitbeam.com are received through Cloudflare Email Routing and forwarded to an operator-controlled Gmail inbox. Cloudflare and Google therefore process the message and sender details. [OWNER/LEGAL REVIEW: verify processor terms, transfer safeguards and support-message retention before launch.]
Cloudflare currently adds Network Error Logging (NEL) response headers. A supporting browser may send network-error reports to Cloudflare without an application cookie. Cloudflare states that its NEL pipeline does not store personal data or log the client IP address. [OWNER/LEGAL REVIEW: confirm this processing is required or disable the zone-level NEL setting before launch.]
No Google Analytics, Meta Pixel, Hotjar, PostHog, Plausible, Sentry browser SDK or advertising tag is enabled.
5. Retention and deletion
Business sessions expire after seven days and may be refreshed after use. Business users can request account deletion; related business data is designed to cascade from the owner record.
Completed, no-show, left and removed entries remain identifiable for 24 hours so staff can correct accidental status changes. An hourly retention job then removes the guest name and access token. Depending on the run time, anonymisation occurs between 24 and 25 hours after the terminal status.
Service, party-size, timing and status fields remain without the guest name or access token for aggregate operational reporting. [OWNER/LEGAL REVIEW: confirm that this retention period and the remaining fields match the final legal basis and reporting purpose.]
6. Rights and complaints
Depending on the circumstances, data subjects may have rights of access, correction, deletion, restriction, objection and data portability, and may complain to the Austrian Data Protection Authority.
[OWNER/LEGAL REVIEW: confirm which rights apply to each processing activity and insert the final request procedure and authority contact details.]
7. Security and changes
WaitBeam uses HTTPS in production, server-side authorisation, input validation, rate limiting for public joins, unpredictable guest tokens and secrets stored outside the repository.
Optional analytics, advertising or marketing storage may be introduced only after an explicit product and legal review. Where consent is required, it must remain disabled until valid consent has been collected. No consent-management platform is installed in the MVP.
Cookies and browser storage
The MVP uses only the mechanisms below. They provide requested authentication and interface functionality and are not used for advertising, profiling or cross-site tracking.
__Secure-waitbeam.session_tokenHttpOnly cookieAuthenticates a signed-in business user. Host-only, Secure and SameSite=Lax in production.7 days; removed on sign-outYesBetter Auth after successful business sign-up or sign-in. Local HTTP development uses waitbeam.session_token without the __Secure- prefix.waitbeam-languagelocalStorageRemembers the language explicitly selected by the user. Contains only en or de.Until changed or browser storage is clearedYesBrowser after the user chooses a languagewaitbeam-themelocalStorageRemembers the light or dark appearance explicitly selected by the user. Contains only light or dark.Until changed or browser storage is clearedYesBrowser after the user changes the theme