When your customers join a queue or book a slot through WaitQ, you collect their personal data and we process it for you. This page explains who is responsible for what, and how WaitQ helps you meet your obligations under the EU GDPR and UK GDPR.
Read the DPA · Security at WaitQ
Your role: controller
You decide which details your check-in form asks for, which channels you use to contact customers and how long you keep their records. That makes you the controller of your customers’ data. You’re responsible for having a lawful basis to collect it, telling customers how you use it in your own privacy notice, and getting consent where you send marketing messages.
Our role: processor
WaitQ processes your customers’ data only to run your queues, bookings and guest lists, send their notifications and show you analytics. We act on your instructions and never use your customers’ data for our own purposes.
For our own customers’ account, billing and support data, WaitQ is the controller. Our Privacy Policy covers that data.
A DPA is already in place
Our Data Processing Agreement applies to every WaitQ customer automatically as part of our Terms. You don’t need to request or sign a separate one. If your legal team needs a signed copy, email support@waitq.app.
The DPA covers what we process and why, the security measures we keep, how we handle subprocessors and security incidents, audits, and what happens to your data when you leave.
Where your data is stored
WaitQ’s database and application are hosted in the United States, on Supabase and Vercel. Product analytics run in the EU. Transfers from the European Economic Area are covered by the European Commission’s Standard Contractual Clauses. Every provider and its location is listed on our subprocessors page, and we give 30 days’ notice before adding a new one.
Built to collect less
- Only what you ask for. Customers give only the details your check-in form requests. By default that’s a name and one way to reach them.
- No app, no account. Customers join from a QR code, kiosk or link without downloading an app or creating a login.
- Names off public screens. You can hide names on the public check-in page and the TV display.
- You control deletion. Delete queue, booking and guest list records at any time. When your subscription ends, we delete your data after a 30-day export period.
- Encrypted throughout. Data travels over TLS 1.2 or 1.3 and is stored with AES-256 encryption, including backups.
Handling your customers’ requests
Your customers have the right to access, correct or delete their data. Your team can find a customer’s records in WaitQ, export queue and booking history on plans that include export, and delete records at any time.
If one of your customers contacts WaitQ directly, we pass the request to you, because you’re the controller, and help you respond.
Consent for messages
You choose which channels your customers can pick: push notifications, SMS, WhatsApp or email. SMS sent through Twilio honours STOP, and a number that has opted out receives no further SMS from WaitQ. When a customer opts in to marketing through a WaitQ form, we record their consent status and when it last changed, so you can prove it and honour withdrawals.
What to do next
- Mention WaitQ as a service provider in your own privacy notice.
- Set up your check-in form to collect only what you need.
- Turn on name hiding if your TV display or check-in page is in a public space.
- Keep a copy of our DPA with your records of processing.
Questions
Email support@waitq.app with any data protection question. You also have the right to complain to your national data protection authority.