Privacy Policy

Hi 👋

I'm Waveful, the creator-friendly social network where everyone can become a creator 🌊

My Mission 🚀

My goal is to be a social network where everyone can share their passions and feel welcomed in a comfortable and positive environment; where creators can thrive and where users can enjoy original content, find new meaningful connections and have fun.

How We Use Your Data

We collect data using the latest industry security standards. The data we collect is used solely to provide you with the best possible experience on Waveful.

Waveful does not sell your data and never will. Our sustainability is based on paid elements in the platform (such as purchasable likes and premium subscriptions), but Waveful's core features are and will always remain free.

If you have any questions or need help understanding any part of this privacy policy, please don't hesitate to contact us at

Introduction

Controller: Waveful S.r.l., with headquarters in Italy, 20121 Milan (MI), Via Daniele Manin 3, VAT Identification Number IT12343330960, email: [email protected].

Pursuant to and for the purposes of art. 13 of Regulation (EU) no. 2016/679 of the European Parliament and of the Council of 27 April 2016 concerning the protection of individuals with regard to the Processing of Personal Data, as well as the free circulation of such Data (the "Regulation" or the "GDPR") and legislative decree 30 June 2003, n. 196 "Code regarding the protection of personal data" ("Code") (Code and Regulations also jointly defined as "Regulations") we inform the interested parties ("Data Subjects") that their Personal Data will be processed in compliance with the Regulations and what is specified below.

0) Definitions

Authorized: The natural persons authorized to carry out Processing operations under the direct authority of the Controller or the Processor, pursuant to art. 29 of the Regulation and art. 2-quaterdecies of the Code.
Communication: The giving knowledge of Personal Data to one or more specific subjects other than the Data Subject, the Controller's representative in the State, the Processor and the Authorized, in any form, including by making them available or consulting.
Contents: Means any music, sound element, photograph, image, video, message, or other material, uploaded and/or published by the user on the platform (by way of example, posts, comments, messages sent and/or received through the messaging service, etc.).
Controller: Means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data; where the purposes and means of such Processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law. For the purposes of this Privacy Policy, the terms "Controller" and "Waveful" are equivalent.
Data Subject: The natural person to whom the Personal Data refers.
Designated: The natural person who is assigned specific tasks and functions related to the Processing of Personal Data and who operates under the authority of the Controller or the Processor, pursuant to art. 2-quaterdecies of the Code.
Personal Data or Data: Any information relating to a natural person, identified or identifiable, even indirectly, by reference to any other information, with particular reference to an identifier such as the name, an identification number, location data, an identifier online or to one or more characteristic elements of its physical, physiological, genetic, psychic, economic, cultural or social identity.
Privacy Policy: This document.
Processing: Means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Processor: The natural or legal person, public authority, service or other body that processes Personal Data on behalf of the Controller.
Security Measures: The set of technical (including IT), organizational and physical measures adopted by the Controller to guarantee a level of security adequate to the risk of the Processing, pursuant to art. 32 of the Regulation.
Supervisory Authority: The supervisory authority referred to in art. 51 of the Regulation.

1) Context of the Processing

This Privacy Policy is provided by the Controller in relation to the following context: Processing of Personal Data relating to the use of the Waveful application and the Waveful website by users.

2) Processing operations

The Data collected, the purposes for which they are processed, the legal bases and Data retention period are reported below in analytical form.

Operation:

Allow registration to Waveful services.

Purpose of this operation:

Allow registration to Waveful services.

Data processed in this operation:

Email, Username, Telephone number, Account name, Date of birth, Country of residence, IP address.

Legal base of this operation:

The Processing of such Data is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract [art. 6 b) GDPR].

Data retention period:

Data will be stored no later than 30 days from the deactivation of the account.

Operation:

Management of the user's personal profile on the platform and Contents upload.

Purpose of this operation:

Management of the user's personal profile on the platform and Contents upload.

Data processed in this operation:

Profile picture, Contents, Bio, Links to external websites, Username, Account name, User ID, IP address.

Legal base of this operation:

Data retention period:

Data will be stored until cancellation by the user, which can be performed at any time and, in any case, no later than 30 days from the deactivation of the account.

Operation:

Interactions with other users (through messaging services and through the ability to "react" to other users' contents, for example, with likes, Superlikes and comments), exporting Contents from other users.

Purpose of this operation:

Data processed in this operation:

Username, Data of various kinds contained in the message, Contents, Account name, User ID, IP address.

Legal base of this operation:

Data retention period:

Data will be stored until cancellation by the user, which can be performed at any time and, in any case, no later than 30 days from the deactivation of the account.

Operation:

Request to find friends and contacts that are already on Waveful through Contacts uploading. Allow to be findable by friends and contacts.

Purpose of this operation:

Request to find friends and contacts that are already on Waveful through Contacts uploading. Allow to be findable by friends and contacts.

Data processed in this operation:

Device's Address Book (only names, phone numbers and emails), Email, Telephone number, User ID, IP address.

Legal base of this operation:

Data retention period:

Data will be stored until cancellation by the user, which can be performed at any time and, in any case, no later than 30 days from the deactivation of the account.

Operation:

Create a unique link to allow the user to receive benefits and/or rewards upon registration of invited friends.

Purpose of this operation:

Create a unique link to allow the user to receive benefits and/or rewards upon registration of invited friends.

Data processed in this operation:

Unique link, User ID, IP address.

Legal base of this operation:

Data retention period:

Data will be stored no later than 30 days from the deactivation of the account.

Operation:

Purchase of premium/paid services through device stores (e.g., Google Play Store, Apple App Store).

Purpose of this operation:

Purchase of premium/paid services through device stores (e.g., Google Play Store, Apple App Store).

Data processed in this operation:

Username, Account name, User ID, IP address, Purchase object, Country of purchase.

Legal base of this operation:

Data retention period:

10 years starting from each single purchase (expiry of the limitation period applicable to the conservation of accounting records).

Operation:

Payments relating to the compensation accrued by a Creator user.

Purpose of this operation:

Payments relating to the compensation accrued by a Creator user.

Data processed in this operation:

Name, Surname, E-mail, Fiscal Code/tax code, VAT number, Telephone number, Residence/domicile address, Payment instrument, User ID, IP address.

Legal base of this operation:

Data retention period:

10 years (expiry of the limitation period applicable to the conservation of accounting records).

Operation:

Receipt and storage of tax documents required by current legislation.

Purpose of this operation:

Receipt and storage of tax documents required by current legislation.

Data processed in this operation:

Name, Surname, E-mail, Fiscal code/tax code, VAT number, certified e-mail or SDI code, Residence/domicile address, User ID, IP address.

Legal base of this operation:

The processing of such Data is necessary for compliance with a legal obligation to which the Controller is subject [art. 6 c) GDPR].

Data retention period:

10 years (expiry of the limitation period applicable to the conservation of accounting records).

Operation:

Sending of non-commercial communications to the user (notices on activities carried out on the platform).

Purpose of this operation:

Sending of non-commercial communications to the user (notices on activities carried out on the platform).

Data processed in this operation:

E-mail, Username, Account name, User ID, IP address.

Legal base of this operation:

Data retention period:

30 days from the sending of the single notice.

Operation:

Sale of physical products through the Controller's website and subsequent shipment to the user.

Purpose of this operation:

Sale of physical products through the Controller's website and subsequent shipment to the user.

Data processed in this operation:

Name, Surname, E-mail, Shipping address, Payment instrument.

Legal base of this operation:

Data retention period:

10 years starting from each single purchase (expiry of the limitation period applicable to the conservation of accounting records).

Operation:

Issuing an invoice or equivalent tax documentation relating to the purchase of products on Controller's website.

Purpose of this operation:

Issuing an invoice or equivalent tax documentation relating to the purchase of products on Controller's website.

Data processed in this operation:

Name, Surname, E-mail, Fiscal code/tax code, VAT number, certified e-mail or SDI code, Residence/domicile address.

Legal base of this operation:

The processing of such Data is necessary for compliance with a legal obligation to which the Controller is subject [art. 6 c) GDPR].

Data retention period:

10 years (expiry of the limitation period applicable to the conservation of accounting records).

Operation:

Managing user support requests.

Purpose of this operation:

Managing user support requests.

Data processed in this operation:

E-mail, Username, Account name, User ID, IP address, content of the message containing the request for assistance.

Legal base of this operation:

Data retention period:

Data will be stored no later than 30 days from the deactivation of the account.

Operation:

Provisioning the services offered by the application.

Purpose of this operation:

Provisioning the services offered by the application.

Data processed in this operation:

IP address, Navigation Data, User ID.

Legal base of this operation:

Data retention period:

Navigation Data are deleted within 30 days from the time of collection, without prejudice to any need for the investigation of crimes by the judicial authority.

Operation:

Provision of features of the platform based on artificial intelligence systems and/or automations (by way of example, features that allow the user to generate Contents and/or to automate actions on the platform, such as writing messages, responding, posting and interacting with other users).

Purpose of this operation:

Provision of features of the platform based on artificial intelligence systems and/or automations, at the user's request.

Data processed in this operation:

Contents, Data of various kinds contained in the messages processed by the feature, instructions and settings provided by the user to configure the feature, Username, Account name, User ID, IP address.

Legal base of this operation:

Data retention period:

Data will be stored until cancellation by the user, which can be performed at any time and, in any case, no later than 30 days from the deactivation of the account.

Operation:

Moderation of Contents and accounts (detection, review and removal of Contents that are illegal and/or in breach of the Terms of Use, management of reports received from users and/or authorities, application of suspension and termination measures).

Purpose of this operation:

Ensuring the safety and integrity of the platform, protecting users and third parties, and complying with the legal obligations applicable to the Controller (including Regulation (EU) 2022/2065, Digital Services Act).

Data processed in this operation:

Contents, Data of various kinds contained in the messages and/or Contents subject to moderation, reports received, Username, Account name, User ID, IP address.

Legal base of this operation:

The Processing of such Data is necessary for the purposes of the legitimate interest pursued by the Controller in ensuring the safety and integrity of the platform [art. 6 f) GDPR] and, where applicable, for compliance with a legal obligation to which the Controller is subject [art. 6 c) GDPR].

Data retention period:

Data will be stored for the time necessary to handle the report and/or the violation and, in any case, no later than the time necessary for the establishment, exercise or defense of legal claims, without prejudice to any need for the investigation of crimes by the judicial authority.

2-bis) Artificial intelligence systems and automations

The Data Subject is informed that users of the platform (including the Data Subject) may use artificial intelligence systems and/or automated tools to generate Contents and/or to perform actions on the platform (by way of example, writing messages, responding, posting and interacting with other users), as permitted by the Terms of Use. As a consequence, Contents and messages received by the Data Subject through the platform may be human, AI-generated, automated, or a combination of these, and the Controller cannot reliably determine whether a specific Content, message or action was performed personally by a natural person or through an artificial intelligence system and/or automation.

Where the Data Subject uses features of the platform based on artificial intelligence systems, the Personal Data indicated in the relevant Processing operation above may be processed through such systems, including through external providers of artificial intelligence services acting as Processors, for the sole purpose of providing the requested feature.

The Data Subject is informed that Personal Data uploaded and/or published on the platform (by way of example, Contents and messages) may be processed by artificial intelligence systems and/or automations used by other users, who act, in this respect, as independent controllers of such Processing, outside the control of the Controller.

The Controller does not carry out any decision-making based solely on automated Processing, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects the Data Subject, pursuant to art. 22 of the Regulation. Should this change, the Controller will provide the Data Subject with the information required by art. 13, paragraph 2, lett. f) of the Regulation and, where necessary, will collect the appropriate consent.

3) Processing methods and categories of recipients

Unless otherwise expressly provided for in this Privacy Policy, the Data Subject is informed that the Processing of his/her Personal Data is carried out using manual systems and/or IT, telematic or automated systems, in compliance with the principles of relevance, lawfulness, fairness and purposes provided for by the Regulation.

Pursuant to the Regulation, the Controller processes the Personal Data of the Data Subject by adopting the appropriate Security Measures aimed at minimizing the risks of unauthorized access, diffusion, loss and destruction of the aforementioned Data.

The Data Subject is also informed that the Processing of Personal Data for the accomplishment of the aforementioned purposes may be carried out by the Controller directly or with the collaboration of other subjects, as Processors, Designated or Authorized (e.g. employees and/or collaborators of the Controller).

In particular, the Data may be disclosed to the following categories of recipients (independent Controllers): other platform users (for example when sending messages or interacting with them), Italian revenue agency (fiscal agency).

The Data Subject is informed that Personal Data may be disclosed to the following categories of external Processors: cloud service providers, content delivery network (CDN) providers, payment services, accountant, e-mail services, providers of artificial intelligence and machine learning services.

The list of Processors can be consulted at any time, by request to be sent to the e-mail address indicated at the beginning of this Privacy Policy.

4) Data Transfer

The Data Subject is informed that the Personal Data processed by the Controller may be transferred to other countries within the European Union.

The Data Subject is informed that the Personal Data processed by the Controller may be transferred to other countries outside the European Union, for which there is an adequacy decision by the EU Commission or for which additional security measures are applied to the outcome of an assessment by the Controller regarding the impact of the transfer on the rights and freedoms of the Data Subject.

5) Rights of the Data Subject

The Data Subject may exercise at any time, by means of a notice to be sent to the addresses indicated at the beginning of this Privacy Policy, the rights provided for by the Regulation pursuant to articles 15-22. In particular:

The Data Subject has the right to ask the Controller for access to Personal Data, pursuant to and within the limits of art. 15 of the Regulation.
The Data Subject has the right to ask the Controller to rectificate inaccurate Personal Data, pursuant to and within the limits set out in art. 16 of the Regulation.
The Data Subject has the right to ask the Controller to erase the Personal Data, pursuant to and within the limits of art. 17 of the Regulation.
The Data Subject has the right to ask the Controller to restrict the Processing of Personal Data, pursuant to and within the limits of art. 18 of the Regulation.
The Data Subject has the right to ask the Controller to transmit his/her Personal Data in a structured, commonly used and machine-readable format, pursuant to and within the limits of art. 20 of the Regulation.
The Data Subject has the right to object to the Processing by the Controller, pursuant to and within the limits of art. 21 of the Regulation.
The Data Subject has the right to withdraw consent with reference to those Processing operations that are based on this legal basis. Pursuant to art. 7, paragraph 3 and art. 13, paragraph 2 lett. c) of the Regulation, the Data Subject is informed that, in any case, the withdrawal of consent does not affect the lawfulness of the Processing based on consent before the withdrawal itself.
The Data Subject has the right to lodge a complaint with the Supervisory Authority (for Italy, the Garante per la protezione dei dati personali, www.garanteprivacy.it), pursuant to art. 77 of the Regulation, without prejudice to any other administrative or judicial remedy.

Pursuant to art. 13, paragraph 2, lett. e) of the Regulation, the Data Subject is informed that the provision of the Personal Data indicated in the Processing operations based on the performance of a contract [art. 6 b) GDPR] is a requirement necessary for the conclusion and performance of the contract: failure to provide such Data makes it impossible for the Controller to allow registration on the platform and/or to provide the requested services.

6) Minors

The platform is reserved for users who meet the minimum age requirements provided for by the legislation of their country (by way of example, Italian users are allowed to sign up from the age of 14, pursuant to art. 2-quinquies of the Code). The Controller does not knowingly process Personal Data of subjects below such minimum age: in the event that the Controller becomes aware of the registration of a user who does not meet the age requirements, the relevant account will be removed as soon as possible.

7) Changes to this Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy at any time. The Controller will post the up-to-date Privacy Policy on the website and/or on the platform.

This Privacy Policy was last updated on July 30, 2026.