1. Who we are

WAYASAY is operated by PlanPaddy Technologies Limited, registered at Companies House as PLANPADDY TECHNOLOGIES LTD, company number 17490637, a company registered in the United Kingdom. We are the controller responsible for the personal information described in this policy.

For privacy questions or requests, email hello@wayasay.com. You can check our Companies House record (opens in a new tab).

2. Information we collect

Information you give us

• Account details: username, display name, email address, password and an optional phone number. We store a password hash rather than your readable password, along with verification status and account creation and update dates.
• Profile: your bio, profile photo and information you choose to include in them.
• Content: voice posts, voice comments, captions, selected post audiences, uploaded images and associated details such as author, recording length, upload format, file size and posting time.
• Voice messages: recordings you send, sender and recipient identifiers, message times, recording length and read status.
• Support and safety: correspondence, privacy requests, reports, the reported account or content, your reason for reporting and supporting information you provide.

Information generated when you use WAYASAY

• Connections and activity: follows, loves on posts and comments, blocks, notifications and whether notifications or messages have been read.
• Referrals: your referral code, a code used when joining, who invited you and the accounts attributed to your invitations. Joining through a referral creates a follow in both directions and can generate follower notifications. You can subsequently unfollow or block.
• Security records: session identifiers, authentication and recovery records, request times and IP addresses used for rate limiting and security auditing. Our security audit records account creation, successful and failed sign-ins, post creation, and account, post and comment deletion, with user/content references where applicable.
• Technical diagnostics: our hosting infrastructure and Azure Application Insights process operational logs and telemetry, such as request paths, response status, timings, failures and diagnostic details. Your browser also sends network and browser information when connecting to our services. We use these records for troubleshooting, reliability and security.
• Device preferences: your selected appearance theme and browser storage used to keep you signed in and load the web app.

Information from other people

Other users may mention you, include your voice or information in content, send you a message, invite you, follow you or report an interaction involving you. We also receive information you send through our email or social accounts. Those external platforms process information under their own policies.

Your voice and microphone

Recording requires microphone permission. You can preview a recording before choosing to publish or send it. We process uploaded audio to check its format and size, convert it to MP3 where needed, store it and enable playback. Revoking microphone permission stops future recording access; it does not remove recordings already submitted.

Audio can reveal information about you and other people, including sensitive matters such as health, beliefs or relationships. Consider what you share and whether you have permission to record others. The current service does not create voiceprints for identification or use recordings to train AI models.

3. How and why we use information

We use personal information for the following purposes. Where UK data protection law applies, our lawful bases are:

Providing the service you request

Account details, content, messages, connections and referral records let us register and authenticate you, show feeds and profiles, host and play recordings, deliver messages, connect invited users and provide notifications. Our basis is performing our contract with you.

Safety and security

Security records, reports, blocks and relevant content help us limit abuse, investigate incidents, recover accounts and enforce our rules. Our basis is our legitimate interest in protecting users and operating a safe service, balanced against your rights.

Support and reliability

Correspondence and relevant technical information help us answer questions, resolve faults and improve reliability. Our basis is our legitimate interest in supporting users and maintaining WAYASAY; help with contracted features can also be necessary to perform our contract.

Legal responsibilities and claims

We process information where needed to comply with a legal obligation, including applicable data protection requirements and valid legal demands. For legal claims, we rely on our legitimate interest in establishing, exercising or defending those claims where appropriate.

Optional processing requiring consent

Where consent is required for an optional activity, we will request it separately and explain how to withdraw it. Agreeing to our Terms or reading this policy does not give blanket consent to unrelated processing.

Required registration fields are needed to create and secure your account. Phone numbers, bios and profile photos are optional. Without microphone permission you can browse available content but cannot record through the app.

We use first-party activity records to count daily active accounts and estimate how many signed-in users are currently active. These records contain your account identifier, activity date and most recent activity time; they do not contain your voice recordings, captions, messages or a history of pages visited. An administrator dashboard shows aggregate counts. Background notification checks alone are not treated as activity. Application Insights is used for operational diagnostics and, if you allow optional usage analytics, to estimate visits, sessions and page views for guests and signed-in visitors. Optional events contain a random browser identifier, a random session identifier, a broad page category and whether you are signed in. They do not contain account identifiers, profile names, recordings, captions, messages, search text, full page URLs or URL parameters. Authentication and password-recovery pages are excluded. We do not sell personal information or run targeted advertising. The service does not make decisions producing legal or similarly significant effects solely through automated processing. Feeds use factors such as post dates, follows, visibility and blocks to select content.

Rewards are coming soon. The displayed balance does not currently represent earnings or a payment account. We will explain any additional processing before introducing rewards or payment features.

4. Who can see your content

Your username, display name, bio, profile photo and social interactions can be visible to other users through profiles and related features. Email and phone details are supplied for account purposes; avoid putting private contact details into public profile fields or recordings.

• Public posts: available to other users and through public sharing pages, including to people without an account. Public material may be indexed or copied outside WAYASAY.
• Followers-only posts: available to you and accounts currently following you, subject to blocks.
• Private posts: available to the author.
• Voice comments: follow the audience of the parent post. Commenting can notify the owner and prior participants.
• Direct voice messages: intended for the sender and recipient rather than a public audience. WAYASAY and its hosting providers store and process these messages; they are not end-to-end encrypted.

People who can access content may record or share it themselves. Removing content or changing a relationship cannot recall copies already made by others. Contact us if someone shares your information without permission.

5. Service providers and other disclosures

We use providers to operate WAYASAY. Relevant providers include:

• Microsoft Azure: hosting, database and Blob Storage services, and Application Insights for operational diagnostics and optional usage analytics.
• Resend: delivery of verification and password recovery emails. This involves the recipient address and email content needed for delivery.
• Google Fonts: the website requests fonts and icons from Google. These requests expose your IP address and browser request information to Google, including before registration. See Google's Privacy Policy (opens in a new tab).

Information is also disclosed to the audiences you choose, message recipients and users receiving relevant interaction or referral notifications. Your inviter can see the profile attributed to their invitation. A referral does not require sharing your email address or phone number with the inviter.

Relevant information may be disclosed to professional advisers, courts, regulators or law enforcement where necessary and lawful, including to protect people or handle legal claims. If the business is sold, merged or reorganised, relevant information may be shared with advisers and a successor subject to applicable data protection duties.

6. Cookies and device storage

The website uses a secure, HttpOnly cookie named __Host-Wayasay.Session to recognise your signed-in session. Its normal lifetime is 30 days and can renew with activity; signing out or session expiry can end access sooner. API access and refresh credentials are held on the web server rather than in browser local storage.

A separate essential, secure, HttpOnly session cookie named __Host-Wayasay.Preview enforces the guest listening preview across tabs and refreshes. It contains a protected random ticket. The API temporarily holds the preview deadline and the recording selected for that ticket, without linking it to an account or using it for analytics. The preview lasts up to 30 seconds and allows one recording; temporary ticket records expire within 30 minutes. Clearing cookies can start a new preview.

Local storage remembers your theme under wayasay-theme until changed or cleared. The installed web app uses a service worker and browser cache for assets such as styles, scripts, fonts and images. Its caching rules exclude HTML navigation, private API responses and audio recordings. Some profile images may be cached, so clear site data on shared devices when appropriate.

Optional usage analytics is off until you allow it. If enabled, our administrator dashboard also counts active guests and daily guest visitors using a random browser identifier, activity date and last-active time. These guest records are kept for up to 90 days and are not linked to an account. Withdrawing permission stops collection and removes current guest presence; previous daily records expire through scheduled cleanup. A first-party cookie remembers your allow/decline choice for up to 180 days. After you allow analytics, a random browser ID cookie lasts up to 90 days, and a random session ID cookie expires after 30 minutes without a tracked page view. These cookies are secure and HttpOnly; our browser script does not read your login credentials or these identifiers. Declining or withdrawing permission stops new optional events and removes the analytics ID cookies; it does not remove events already received by Azure. Event retention follows the Application Insights workspace settings. You can change your choice below at any time. Analytics is optional and declining does not restrict listening or account features.

A separate first-party antiforgery cookie protects requests that save or change your analytics choice.

This choice applies to optional browser page-view analytics. Sign-in/security cookies and the separate account activity records described above are unaffected.

You can clear cookies and site storage through your browser. This can sign you out, reset preferences and remove cached assets. Microphone permission can be managed in browser or device settings. We do not use advertising cookies.

7. Storage locations and international processing

Our primary Azure database is hosted in West US 3, United States. Our audio Blob Storage is hosted in UK South, United Kingdom. Database records include account information and records associated with posts, comments, messages, connections and referrals, so information is processed outside the UK even when a recording is stored in the UK.

Email delivery, font requests, provider support, diagnostic services and backup arrangements can involve additional locations. The location of a primary resource does not establish that all copies or provider access stay in that country. Public posts are also accessible internationally.

Where UK law restricts a transfer, an appropriate legal transfer arrangement is required, such as applicable adequacy regulations or approved contractual safeguards and the necessary assessments. Using WAYASAY is not, by itself, consent to an otherwise unlawful transfer. Contact hello@wayasay.com for details of the locations and safeguards relevant to your information.

8. How long we keep information

Daily activity records are kept for a rolling 90-day window. Most recent activity timestamps are removed after 90 days of inactivity. Cleanup runs periodically, so removal can take up to a further six hours while the service is running.

Retention depends on the information and why it is needed:

• Account and profile records: while needed to provide your account. Deleting your account immediately disables access and hides its profile and content. The retained account evidence is scheduled for erasure after 12 months unless a documented legal hold applies.
• Posts, comments and messages: deleted posts and comments are immediately hidden, including through audio playback endpoints, and their records and managed audio are scheduled for erasure after 12 months. Account closure also hides associated messages. Documented legal holds can extend retention of relevant evidence.
• Security audit history: IP addresses are removed after 90 days, while identifiable action records are retained for 12 months, unless a documented legal hold applies. We keep a permanent operational history containing only the UTC date, action and outcome, without account identifiers, content identifiers, IP addresses or captions.
• Follows, loves, referrals and notifications: while needed for the related feature, invitation attribution or relevant disputes.
• Support, reports and diagnostics: for the time needed to investigate issues, prevent recurring abuse, respond to requests or meet applicable legal requirements.
• Authentication and recovery records: have validity limits. A code or token expiring does not necessarily mean its database record is immediately deleted.

Scheduled cleanup runs in batches while the API is operating and retries failed storage deletions; expired records may remain temporarily while cleanup catches up. Copies in backups and separate Azure diagnostic records follow their own retention settings. We consider the information's sensitivity, outstanding requests or disputes and applicable legal requirements. You can contact us about erasure or restriction before a standard retention period ends; we assess those requests and any applicable exceptions. We do not promise immediate deletion from every system.

9. Security

Measures include password hashing, protected server-side web sessions, access checks for restricted content and messages, and limits on sensitive requests. No internet service can guarantee absolute security. Keep passwords and verification codes private and tell us promptly if you suspect unauthorised access.

10. Your choices and rights

You can edit available profile fields in Settings, choose post audiences, unfollow or block accounts, report content and sign out. Account deletion can be requested in Settings; if this fails or you need help removing associated information, email us. Uninstalling the app does not delete your account.

Subject to applicable law and exceptions, you can ask us to:

• Provide access to your personal information and a copy of it.
• Correct inaccurate or incomplete information.
• Delete information or restrict its use.
• Provide eligible information in a portable format.
• Stop processing based on legitimate interests where your circumstances justify an objection.
• Stop an activity for which you gave consent. Withdrawal does not affect earlier lawful processing.

Email hello@wayasay.com with your request. We may need proportionate information to verify your identity; do not send your password. We normally respond within one month. If an extension or exception applies, we will explain it. We also protect other people's rights when responding.

You can complain to the UK's Information Commissioner's Office (ICO) (opens in a new tab), or another competent authority where applicable. You do not have to contact us first, although we welcome the opportunity to resolve your concern.

11. Age requirements

Web registration requires users to confirm they are over 16 years old. This is a self-declaration, not identity or age verification. We do not currently request a date of birth on the web registration form.

If you believe someone does not meet this requirement, or a young person's information has been shared improperly, contact hello@wayasay.com so we can investigate and take appropriate action. Only include information needed to explain the concern.

12. Changes and contact details

We will update this policy as our service or practices change and revise the date above. For material changes, we will provide an appropriate notice through the service or another suitable channel. Where a change requires consent, we will request it separately.

Email hello@wayasay.com or write to PlanPaddy Technologies Limited at the registered office in section 1. Our Contact page lists our social accounts. Use email rather than public social posts for private account or privacy requests.