Privacy Notice

1. Who we are

WaveGo is a product of NEBULA TECH CONSULTING LTD, a company registered in England and Wales under number 16637894, with its registered office at 54 Aintree Estate, London, England, SW6 7QU, United Kingdom. For anything related to privacy, write to privacy@wavego.app.

As the company is registered in the United Kingdom, this processing is governed by the UK GDPR and the Data Protection Act 2018.

2. What this notice covers

This notice covers this website, wavego.app, and nothing else.

The WaveGo application, where customers manage fleets, drivers, schedules and onboarding, is a separate service with its own agreement. Data you enter there, including data about your drivers, is not described here. If you are a WaveGo customer and need to know how we handle data inside the application, ask us for the applicable agreement.

One exception is worth stating plainly. The cookies described in section 5 are set for .wavego.app, so they are also sent when you continue to the application at web.wavego.app, and our measurement counts the two as one journey. What the application does with the data you enter inside it is still governed by its own agreement, not by this notice.

The WaveGo mobile app has its own notice, at wavego.app/app-privacy.

3. What we collect and why

• Account and enquiry requests: when you ask for an account or a demo we collect your name, work email, company name, phone number, delivery partner, fleet size, number of depots, how you heard about us and anything else you choose to tell us. We use this to answer you, set up your account and prepare a quote.
• Chat messages: when you write to us in the chat window on this site, we receive what you write and the email address (and, if you give it, the name) the chat asks for before your first message, so we can reply there or by email.
• Usage statistics: pages visited, the page that referred you, country, browser, operating system and device type, in aggregate form. We use this to understand which pages are useful.
• Campaign data: when you arrive from an advert or a marketing link, the identifiers carried in that address — the Google Ads click identifier and any utm_ parameters — are read from the URL and passed on to the sign-up form. We use this to know which adverts and which channels lead to sign-ups, and what our advertising buys.
• Technical logs: IP address, browser identification and request timestamps, retained by our hosting and content delivery providers for security, abuse detection and fault diagnosis.

4. Lawful basis

• Steps taken at your request before entering into a contract, when you ask us for an account, a demo or a quote.
• Legitimate interests, to answer business enquiries, keep the site available and prevent abuse. We have weighed this against your rights and it does not override them.
• Consent, for any marketing email you opt in to. You can withdraw it at any time without affecting what came before.
• Legal obligation, where tax or accounting law requires us to keep records.

5. Cookies and browser storage

This site sets cookies, and at present it does not ask for your agreement before setting them. We would rather state that here than leave you to discover it.

None of them is a third-party cookie, and none of them follows you onto other companies’ websites. What they do is recognise the same browser returning to wavego.app, so that a visit, a sign-up and the advert that led to them are counted as one journey instead of three unrelated visitors. One of them, _ga, belongs to Google, and the measurement built on it is linked to our Google Ads account, which is how Google can tell us that an advert we paid for led to a sign-up.

If you would rather not have them: your browser can block or delete cookies for this site, and Google publishes an opt-out extension for Google Analytics at tools.google.com/dlpage/gaoptout. Apart from the chat window, which uses its cookies to keep your conversation open between pages and visits, nothing on this site stops working without them. The cookies are:

• datafast_visitor_id, set by DataFast and kept for one year, together with datafast_session_id, datafast_visitor_first_seen_at and datafast_visitor_session_count. These hold a random identifier, not your name or your email.
• _ga and _ga_<id>, set by Google Analytics and kept for up to two years, for the same purpose.
• wg_attr, set by this site and kept for 90 days. It records how you first arrived — the advert click identifier (gclid) and campaign tags in the address, the first page you landed on and the referring site — so that if you sign up later we can tell which campaign brought you. It is shared with web.wavego.app, where sign-up happens, and contains no name or email.
• ph_<id>_posthog, set by PostHog and kept for one year. It holds a random identifier so that a visit here and a later sign-up on web.wavego.app are counted as one journey.
• cw_conversation and cw_user_<id>, set by the chat window (Chatwoot) once it loads, so that the same conversation is still there when you change page or come back. They hold a random identifier for the conversation, not your name or your email. The chat window also keeps its own settings in browser storage on support.nebulaconsulting.com.br, the address it is served from.
• Nothing at all from Umami, which is cookieless: it builds no individual profile and does not follow visitors between sites.
• We do not use any of these to build advertising audiences or to show you adverts, and the Google Analytics setting that would allow that — Google signals — is turned off.

6. Who we share it with

We do not sell personal data and we do not pass it to third parties for their own marketing. We rely on the following providers, who process data on our behalf and under contract:

• Umami: aggregate website usage statistics.
• DataFast: website usage statistics tied to the marketing channel a visitor arrived from, so we can tell which channel brings customers rather than only how many people visited.
• Google: Google Analytics, for usage statistics and for counting sign-ups; Google Ads, which receives the fact that a sign-up happened and which advert preceded it, so we can measure what our advertising buys; and Google Tag Manager, which is what loads those two on the page.
• PostHog: product and website analytics, hosted in the European Union, which we use to see which steps visitors take from an advert to signing up. It receives the pages you view and the buttons and forms you use on this site, but not what you type into them.
• Chatwoot: the support platform behind the chat window and the demo form, run by us on our own servers at support.nebulaconsulting.com.br. It stores your chat messages and demo requests so our team can answer them.
• Cloudflare: content delivery, certificates and protection against attacks.
• DigitalOcean: hosting of the servers that serve this site and our support platform.

7. International transfers

Some of these providers process data outside the United Kingdom — in particular Google and DataFast, which process in the United States, and our Chatwoot servers, which DigitalOcean hosts in the United States. Where that happens, the transfer relies on a UK adequacy decision, which for the United States is the UK Extension to the EU–US Data Privacy Framework, or on the UK International Data Transfer Agreement, whichever applies to the provider in question.

8. How long we keep it

• Enquiries that do not lead to a commercial relationship: 24 months from the last contact.
• Customer records with tax or accounting relevance: 6 years, as required by UK law.
• Server technical logs: 90 days.
• Google Analytics data: 14 months, after which Google deletes it.
• PostHog data: 12 months.
• Aggregate statistics: kept indefinitely, as they no longer identify anyone.

9. Your rights

Under the UK GDPR you have the right to:

• Know what data of yours we process, and receive a copy of it.
• Have inaccurate or incomplete data corrected.
• Ask us to erase your data, where it is no longer needed for the purpose that justified collecting it.
• Ask us to restrict processing, or object to it, including to any marketing communication.
• Receive the data you gave us in a structured, commonly used format, and ask us to send it to another organisation.
• Withdraw any consent you have given, at any time.

10. How to exercise your rights and how to complain

Write to privacy@wavego.app. We reply within one month at the latest and we do not charge for the request. We may ask for additional information solely to confirm your identity, and we use it only for that.

If you believe we have not handled the matter properly, you can complain to the UK data protection authority, the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

11. Changes to this notice

If we change this notice we publish the new version on this page and update the date at the top. Changes that materially affect how we handle your data are communicated actively, wherever we have a means of doing so.