getwaved.ai / Legal

Privacy Policy

Last updated: 14 October 2026 · Wavelink, registered in Bangladesh · applies to getwaved.ai and all Wavelink regional entities

Wavelink builds NFC products that move identity between people — and that only works when the data behind every card is handled with the same care as the product itself. This policy explains, in plain language, what we collect, why we collect it, where it lives, and how you stay in control. It applies to getwaved.ai and every Wavelink storefront, ordering flow and profile page operated by Wavelink and its regional entities in Bangladesh, the United Arab Emirates, Qatar, Bahrain, China, Germany and Brazil.

1. Who we are

Wavelink is a Bangladesh-registered company with its headquarters in Dhaka and its design studio in Chattogram, shipping to more than thirty countries. For the purposes of the EU General Data Protection Regulation (GDPR) and comparable laws such as the UAE PDPL and Brazil's LGPD, Wavelink is the data controller for the personal data described in this policy. You can reach our data protection contact at [email protected] with the subject line "Privacy".

2. What we collect

Order data — name, email, phone number, delivery address, and the text, photo or logo assets you upload for printing on your card.
Profile data — whatever you choose to publish on your NFC profile page: name, role, company, social links, portfolio links. You edit this at any time from your dashboard.
Tap analytics — when someone taps your card or scans its QR fallback, we record a timestamp, coarse country/city (from IP), and device type. We do not store the visitor's full IP address or precise GPS location.
Payment data — handled entirely by our payment processors. We never see or store full card numbers.
Technical data — device/browser type, referring page, and anonymised usage signals used to keep the site fast and safe.

3. Why we use it (legal bases)

We process order and profile data to perform our contract with you — manufacturing your card, hosting your profile, and delivering your kit. Tap analytics and aggregate product metrics rest on our legitimate interest in operating and improving the service. Marketing and advertising cookies, where used, rest on your consent, which you can withdraw at any time through your browser settings or the AdChoices link below.

4. Cookies and advertising

We use a small number of first-party cookies for language preference and session integrity. We also use Microsoft Clarity to understand how visitors use the site (session replays are anonymised and never include passwords or payment fields).

We display advertising through Google AdSense (publisher ID ca-pub-6185927994614530). Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies (including the DoubleClick DART cookie) enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the Internet. You may opt out of personalised advertising by visiting Google Ads Settings, or opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info. Where the EEA/UK privacy laws require prior opt-in, we signal this through Google's certified consent tooling before personalised ads are served.

5. Where data lives

Order records and profile content are stored in managed cloud databases located in the EU and Singapore, with operational mirrors in Bangladesh. Tap-analytics aggregates are stored in Cloudflare D1. Card-print assets (photos, logos) are stored in Cloudflare R2 with access restricted to the fulfilment team. We do not transfer personal data to any country that lacks an adequacy decision or appropriate safeguards such as standard contractual clauses.

6. Sharing

We share data only with: (a) payment processors to complete your purchase; (b) logistics partners such as DHL to deliver your kit; (c) our print partner for the assets you upload; (d) infrastructure providers (Cloudflare, Supabase) under data-processing agreements; and (e) authorities where the law compels us. We never sell personal data, and we have never done so.

7. Your rights

You may request access, correction, export, or deletion of your personal data at any time by emailing [email protected]. Profile data can be edited or removed directly from your dashboard without contacting us. If you are in the EEA or UK, you also have the right to lodge a complaint with your national supervisory authority. We respond to all verified requests within 30 days.

8. Retention

Order records are kept for seven years as required by tax law. Profile data lives until you delete it or your subscription lapses, after which the profile is unpublished immediately and purged within 90 days. Tap-analytics aggregates are retained in anonymous form indefinitely — they cannot be linked back to a person.

9. Children

Wavelink products are business tools and are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us personal data, contact us and we will delete it promptly.

10. Changes

When this policy changes materially, we update the date below and, for material changes affecting how we use your data, we notify registered customers by email at least 14 days before the change takes effect.

Questions about this page?

Write to [email protected] or message +880 1410 809023 (WhatsApp). A human answers — usually within one business day. For the full site, return to getwaved.ai.