Your queues, bookings and guest lists hold your customers’ names and contact details. This page explains where that data is stored, how it’s protected and how long we keep it.
Read the DPA · See subprocessors · GDPR at WaitQ
Where your data is stored
WaitQ’s database runs on Supabase in the US East (Ohio) region. The application runs on Vercel in US East (Cleveland, Ohio). Product analytics run on PostHog’s EU cloud.
Messages go through specialist providers. Email is sent by Resend from US East (North Virginia). SMS is sent through GatewayAPI and BulkGate in the European Union, or through Twilio in the United States, depending on the destination country. WhatsApp messages go through Twilio and Meta’s WhatsApp Business Platform. Push notifications go through Apple’s push service for the App Clip, and through the push service of each guest’s browser for web push.
Transfers of personal data from the European Economic Area to the United States are covered by the European Commission’s Standard Contractual Clauses. Every provider, what it does and where it runs is listed on our subprocessors page.
Built on certified infrastructure
Our two core infrastructure providers hold current SOC 2 Type 2 attestations: Vercel, which hosts the application, and Supabase, which runs the database, authentication and file storage.
WaitQ itself does not hold a SOC 2 or ISO 27001 certification. If your procurement process includes a security questionnaire, send it to us and we’ll complete it.
Encryption
In transit. waitq.app, our database and our email and analytics providers accept only TLS 1.2 or TLS 1.3 connections, and refuse the older TLS 1.0 and 1.1. Plain HTTP requests are redirected to HTTPS. Our site also tells browsers to use HTTPS for every visit for two years, including on subdomains. The application talks to the database over HTTPS through Supabase’s client library, never over an open database connection.
At rest. Your data and its backups are encrypted with AES-256, using an encryption key unique to the WaitQ project.
Email delivery. Emails travel encrypted from WaitQ to Resend. From Resend to each recipient’s inbox, encryption depends on the recipient’s mail server, and almost all of them support it.
Data we collect, and how long we keep it
WaitQ asks your customers only for what your check-in form asks for. By default that’s a name and one way to reach them. Guests join from a QR code, kiosk or link, with no app download and no account to create.
| Data | Whose data it is | How long we keep it |
| Queue, booking and guest list entries | Yours. You are the controller and WaitQ is your processor | While your subscription is active, unless you delete it sooner. Your plan sets how much history you can view and export, up to 90 days |
| Your account and team details | WaitQ’s, as controller | While your account is open, then as long as legal, tax and security records require |
| Backups | Both | Deleted data leaves backups as they rotate |
When your subscription ends, you can export your data before we delete it.
Privacy on screen
You can hide customer names on the public check-in page and on the TV display. Waiting room screens then show queue numbers and positions without showing who is waiting.
Accounts and passwords
Each team member signs in with their own account. We store passwords only as hashes, never in readable form. Sign-in sessions are protected by the same TLS and HTTPS rules as the rest of the service.
WaitQ doesn’t support single sign-on (SAML) yet. Tell us if your team needs it.
Who can access your data
We access your data only to provide the service, to keep it secure and running, and to resolve a support request you’ve asked us to handle. We never sell your data or your customers’ data, and we never use it for advertising.
Messaging and consent
You decide which channels your customers can choose: push notifications, SMS, WhatsApp or email. SMS sent through Twilio honours STOP and HELP replies, and a number that has opted out receives no further SMS from WaitQ. When a customer opts in to marketing messages through a WaitQ form, we record their current consent status and when it last changed, so you can show it and honour withdrawals.
Payments
Card details never reach WaitQ. Polar handles checkout and billing as our Merchant of Record, so WaitQ stores no payment card data.
If something goes wrong
If a security incident affects personal data we process for you, we’ll tell your account owner without undue delay. We’ll share what happened, which data was affected and what we’re doing about it, so you can meet your own reporting duties.
Report a vulnerability
If you find a security issue in WaitQ, email support@waitq.app with “Security” in the subject line. Please give us a reasonable chance to fix it before sharing it publicly, and avoid accessing other customers’ data while you test.
Documents for your IT and privacy team
Frequently asked questions
Where is WaitQ’s data stored?
In the United States. The database runs on Supabase in US East (Ohio) and the application on Vercel in US East (Cleveland, Ohio). Transfers from the EEA are covered by Standard Contractual Clauses.
Is data encrypted?
Yes. Connections use TLS 1.2 or 1.3, and stored data and backups are encrypted with AES-256.
Does WaitQ sign a DPA?
Our Data Processing Agreement applies to every customer automatically as part of our Terms. If your legal team needs a signed copy, email support@waitq.app.
How long does WaitQ keep my customers’ data?
For as long as your subscription is active, unless you delete it sooner. When your subscription ends, you have 30 days to export it, then we delete it.
Can I hide customer names on the waiting room screen?
Yes. You can hide names on both the TV display and the public check-in page.
Is WaitQ SOC 2 certified?
WaitQ isn’t. Our hosting and database providers, Vercel and Supabase, both hold SOC 2 Type 2 attestations.
Do guests need an app or an account?
No. Guests join from a QR code, kiosk or link, and give only the details your form asks for.