Privacy Policy

Last updated: October 14, 2026

At Wave, your privacy is not just a box we check—it's something we are deeply committed to. We know how important your personal data is. When you use our mobile and web apps, we handle your data with the utmost care, ensuring that you are always in control.

SOC-2 Compliance

Wave completed a SOC 2 Type 1 examination. The independent report addresses Wave's system description and the suitability of the design of controls relevant to the Security criteria as of March 1, 2025. As a Type 1 report, it did not test operating effectiveness over a period of time.

For more details on our security practices and audit information, please visit our Trust Center.

You can also download our SOC 2 Type 1 audit report.

Our Promise to You: Your Data, Your Control

We believe your data belongs to you. When you permanently delete recordings, transcriptions, summaries, or your account, the data is deleted from our live systems immediately, as described in Data Retention and Deletion below. Our goal is to give you the most convenient service while keeping your privacy intact.

Information We Collect

Account Creation:

When you sign up for Wave using Google, Apple, or Facebook, we collect your name and email address. This information is used to create and maintain your account, allow access to your data across multiple devices, and communicate important updates to you.

Purchase Information:

If you make purchases through the iOS or Android App Stores, we collect transactional data. This is used to manage billing and account services.

Audio and Text Data:

• Audio Recordings: When you record audio within the app, these recordings are uploaded to our server for transcription processing. The audio files are stored until you delete them from the app. This storage allows us to stream the audio to you from any device on which you use Wave. You may also remove the audio from an individual recording while keeping its transcription and summary, or set an automatic audio retention period in Settings, after which the audio of older recordings is deleted automatically.
• Voice Profiles (Voice ID): Voice profiles are created only when you enroll a voice in Voice ID: Wave stores a short voice sample and a speaker embedding (a numerical representation of the voice) and uses them only to label speakers in your recordings, and you can delete a voice profile at any time in Settings, after which it is no longer used to label speakers.
• Transcriptions and Summaries: The text generated from transcriptions and summaries is stored on our servers to provide you with easy access across your devices.
• Free Tools on wave.co: Files uploaded to our free web tools, such as the audio transcription tool, and the transcripts made from them may be kept privately and used to improve Wave's speech recognition. They are never published. These tools do not require an account, so we do not link these files to a person.

Usage Data:

We gather data on how you interact with our app, including features used and time spent. This helps us improve the app for you. We also conduct meta-analysis on your summaries to better understand Wave's most common use cases, ensuring that individual user identities remain anonymous.

Calendar Data and Meeting Bots:

If you choose to connect your Google or Outlook calendar, Wave accesses calendar event metadata — titles, times, attendees, and conferencing links — to show your upcoming meetings and, when you enable it, to send a meeting bot to record a meeting. Calendar synchronization and meeting bots are operated on our behalf by Recall.ai, which processes this calendar metadata and the meeting audio needed to join and record the meeting. Disconnecting your calendar stops this synchronization.

Connected AI Clients (MCP):

If you choose to connect Wave to a third-party AI client through the Model Context Protocol (MCP), Wave receives the search terms and filters that client sends and returns data from your Wave account to answer your prompts. Depending on your request, this may include technical session and folder identifiers; session titles, dates, duration, type, platform, language, links, summaries, notes, speaker names, and transcripts; folders, tags, and action items (including assignees, due dates, and creation or update times); and, for phone sessions, call direction, status, whether the call is ongoing, the communications provider, contact name, and phone numbers. Wave sends this data only in response to authenticated requests from a client you authorized. The provider of that client processes and may retain the data under its own privacy policy and settings. You can stop future access by disconnecting Wave from that client or revoking its authorization.

Wave for Slack:

If you add Wave to a Slack workspace and connect your Wave account, Wave stores the workspace's name and ID, an encrypted bot token, and the link between your Slack user ID and your Wave account. Wave receives only the messages you send to Wave or that mention it, a message you choose with "Ask Wave about this", links to Wave recordings you paste, and your Slack time zone (used to schedule a weekly digest you turn on). It does not read your channels or use your Slack conversations for anything else. Answers come only from your own Wave recordings and are shown only to you unless you share them; recaps, digests and link previews reach a channel only when you turn them on or confirm them. Questions are answered by the same Wave Assistant described below, and answers are kept for 30 days so you can share or rate them. Disconnecting, removing Wave from the workspace, or deleting your Wave account removes this Slack data.

How We Use Google User Data

If you sign up for Wave using your Google account:

• We collect your Google name and email address. This data is used exclusively to:
  • Create and manage your Wave account
  • Provide secure login and synchronization of your data across multiple devices
  • Send you important notifications about your account or relevant Wave updates
• For sign-in, we do not use any Google user data beyond your name and email address. Separately, if you choose to connect your Google Calendar, we access the calendar event metadata described under "Calendar Data and Meeting Bots" above — and nothing else. Your Google user data is not used for advertising or marketing purposes, nor is it shared with any third parties outside of the services described below.
• We do not use data obtained from Google Workspace APIs to develop, improve, or train generalized AI or machine learning models.

Our Technology Partners: Ensuring Secure, Seamless Experiences

Wave utilizes cutting-edge tools to deliver transcription and summarization services. Here's who we partner with and how we share data with them:

• Google Cloud: All data is stored securely using Google Cloud infrastructure, protected by Google's native encryption. This includes audio files, transcriptions, and text storage.
• Turbopuffer: We use Turbopuffer to power fast text search across your sessions. Titles, summaries, and transcript text are stored in Turbopuffer's search infrastructure (hosted on Google Cloud in the United States), encrypted in transit and at rest, and are removed when you delete your sessions or your account. See Turbopuffer's Privacy Policy.
• OpenAI: We use OpenAI's language models to generate summaries and power AI features from your transcripts. Transcripts may contain personal data — including identifying information mentioned in recorded conversations — and OpenAI processes that text on our instructions solely to provide the requested feature, not to train its models. See OpenAI's Privacy Policy.
• Anthropic: We use Anthropic's Claude models to power the Wave assistant and chat responses and to build an understanding of your sessions. Anthropic receives transcript excerpts and your prompts and processes them on our instructions solely to provide the requested feature; under Anthropic's commercial terms, API data is not used to train its models by default. See Anthropic's Privacy Policy.
• AssemblyAI: Your audio is transcribed using AssemblyAI's services. AssemblyAI processes your audio and the resulting transcript on our behalf under its data processing terms and retention policy. See AssemblyAI's Privacy Policy.
• Gladia: As a backup to AssemblyAI (for example, during an AssemblyAI outage), your audio may be transcribed using Gladia's services. Gladia processes your audio and the resulting transcript on our behalf under its data processing terms and retention policy. See Gladia's Privacy Policy.
• Twilio: Phone call recording is facilitated using Twilio's services. See Twilio's Privacy Policy.
• Recall.ai: Calendar synchronization and meeting bots are operated through Recall.ai, which processes calendar event metadata and meeting audio on our behalf as described under "Calendar Data and Meeting Bots" above.
• Trigger.dev: Trigger.dev orchestrates the background processing jobs for our transcription and summarization pipeline. Session data is processed in those jobs, and Trigger.dev retains job logs and traces for its retention period.
• Telnyx: Phone calling and text messaging (SMS) on Wave phone numbers are delivered through Telnyx's communications network. Telnyx processes call and message routing data on our behalf. See Telnyx's Privacy Policy.
• Posthog: We use Posthog, a privacy-focused analytics platform, to analyze user interactions and improve our service. For MCP usage, we send aggregate tool-level measurements such as the tool called, response time, success or error status, result count, and whether filters were used. MCP analytics do not include a Wave account identifier, search text, session or folder identifiers, tag values, transcripts, action-item content, or tool error text.
• Google LLC: We use Google Analytics 4, Google Tag Manager, and Google Ads (including conversion tracking and the Google / DoubleClick advertising network) to measure website traffic, attribute advertising, and run remarketing. These tools may receive your IP address, device and browser information, and on-site activity. See Google's Privacy Policy; you can control ad personalization at Google My Ad Center.
• Intercom, Inc.: We use Intercom to provide website and in-app customer support chat. Intercom processes your support messages and basic session metadata. See Intercom's Privacy Policy.
• Vercel Inc.: Our website is hosted on Vercel, and we use Vercel Analytics and Speed Insights for aggregate, non-identifying performance and traffic measurement. See Vercel's Privacy Policy.
• Stripe, Inc.: Subscriptions purchased on our website are processed by Stripe, which handles your payment details and billing information. See Stripe's Privacy Policy.
• Customer.io: We send product, lifecycle, and transactional email (like receipts and account notifications) through Customer.io, which processes your name, email address, and account activity needed to deliver those messages. See Customer.io's Privacy Policy.
• Sentry: We use Sentry for application error monitoring, which may process technical identifiers and diagnostic data when errors occur. See Sentry's Privacy Policy.
• Adapty: In-app subscription state and purchase events are managed through Adapty, which processes account and transaction identifiers.

Data Sharing and Transfer

Third-Party Service Providers:

We share audio data with AssemblyAI (and, as a backup, Gladia) for transcription, text data with OpenAI for summarization and with Anthropic for the assistant, chat, and session understanding, and session text (titles, summaries, and transcripts) with Turbopuffer to provide search across your sessions. If you connect a calendar or use meeting bots, calendar metadata and meeting audio are processed by Recall.ai, and Trigger.dev orchestrates our transcription and summarization processing jobs and retains job logs and traces for its retention period.

We share pseudonymous usage data (event and device data tied to an internal identifier, not your name or content) with Posthog to analyze how our app is being used.

When you authorize an AI client through MCP, we share the Wave data requested by that client so it can fulfill your prompt. The client provider is a recipient you direct us to disclose data to, not a Wave service provider. Its use and retention of that data are governed by its own terms and privacy policy. You can revoke the client's future access at any time.

No Selling or Renting of Data:

We do not sell, rent, or disclose your personal data to unauthorized third parties.

Cookies and Similar Technologies

Our website (wave.co) and web app (app.wave.co) use cookies in three categories. Necessary cookies are always on. If you visit from the European Union, the European Economic Area, the United Kingdom, or Switzerland, analytics and advertising cookies are used only after you agree to them in our cookie banner. Elsewhere they are on by default and you can turn them off. If your browser sends a Global Privacy Control signal, we honor it as an opt-out of advertising cookies and of the "sharing" of personal information for advertising. You can change your choice at any time in Cookie settings, also linked in the footer of every page. One choice covers wave.co and app.wave.co and is kept for 12 months; we keep a record of each choice (its id, the categories chosen, and the time) as proof of consent, without your IP address or account.

Our mobile apps use Adjust to attribute app installs to advertising campaigns, the Meta (Facebook) SDK to measure our ads on Facebook and Instagram, and Google Firebase Analytics to understand app usage. On iOS, your device's advertising identifier is shared with these providers only if you allow tracking in Apple's App Tracking Transparency prompt.

Text Messaging (SMS)

Wave offers phone features that let you purchase a dedicated phone number to make calls and send and receive text messages. If you use these features, we collect and store your messages, the phone numbers you communicate with, and delivery metadata so we can display your conversation history across your devices. Messages are delivered through our communications provider, Telnyx.

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text messaging services.

Message frequency varies based on your usage. Message and data rates may apply. Recipients of messages sent from Wave numbers can reply STOP at any time to stop receiving messages from that number, or reply HELP for assistance. For questions about messaging, contact us at support@wave.co.

Data Retention and Deletion

We retain your data as long as you maintain an active account. Recordings you delete first move to Recently Deleted, where you can restore them for 30 days. When you permanently delete content or delete your account, the associated data is deleted from our live systems immediately; short-lived disaster-recovery copies of our databases and file storage expire automatically within 7 days, and we never use them to restore deleted content to the live service. We do not keep deleted content in long-term backup archives. Server logs are kept for 30 days to diagnose issues, then automatically deleted.

Data Security

• All data is encrypted both at rest and in transit
• Strict access controls limit data access to authorized personnel
• Regular security audits and monitoring protect against unauthorized access

Google API Services User Data Policy

Our use and transfer of information received from Google APIs comply with Google's API Services User Data Policy, including the Limited Use requirements.

Legal Bases for Processing (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, Wave is the controller of the personal data described in this policy, and we rely on the following legal bases under Article 6 of the GDPR and UK GDPR (and the equivalent rules of the Swiss FADP):

• Providing the service and your account: creating and maintaining your account, syncing your data across devices, subscriptions, and support — performance of our contract with you (Art. 6(1)(b)).
• Transcription, summaries, search, and the assistant: processing your recordings and the text we generate from them so the features you use work — performance of our contract with you (Art. 6(1)(b)).
• Voice ID speaker profiles: your consent (Art. 6(1)(a)), given when you enroll a voice. Because voice characteristics used to recognize a person may be special-category (biometric) data, we also rely on explicit consent under Art. 9(2)(a). You can withdraw consent at any time by deleting the voice profile or turning off Voice ID in Settings; this does not affect processing that took place before you withdrew it.
• Product analytics and crash reporting in our apps: our legitimate interests in understanding how Wave is used, fixing errors, and improving the service (Art. 6(1)(f)). You can object at any time by emailing privacy@wave.co. Analytics cookies on our website are used only with your consent, as described under Cookies and Similar Technologies.
• Advertising cookies and pixels: your consent through our cookie banner (Art. 6(1)(a)). You can change your choice at any time in Cookie settings.
• Email: transactional email such as receipts and account notices — performance of our contract with you (Art. 6(1)(b)); product and marketing email — your consent or, where the law allows it for existing customers, our legitimate interests (Art. 6(1)(a) or (f)). Every marketing email includes an unsubscribe link.
• Security, fraud, and abuse prevention: our legitimate interests in keeping Wave and its users safe (Art. 6(1)(f)) and, where applicable, compliance with legal obligations (Art. 6(1)(c)).
• Legal, tax, and accounting records: compliance with our legal obligations (Art. 6(1)(c)).

Your Rights Under the GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights over your personal data:

• Access: to get confirmation of whether we process your personal data and a copy of it.
• Rectification: to have inaccurate or incomplete personal data corrected.
• Erasure: to have your personal data deleted.
• Restriction: to ask us to limit how we use your personal data in certain circumstances.
• Portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• Objection: to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
• Withdrawal of consent: where we rely on your consent, to withdraw it at any time, without affecting processing that took place before you withdrew it.
• Complaint: to lodge a complaint with a data protection supervisory authority, in particular the one where you live or work — for example, the Irish Data Protection Commission (dataprotection.ie) in Ireland, the Information Commissioner's Office (ico.org.uk) in the United Kingdom, or the Federal Data Protection and Information Commissioner (edoeb.admin.ch) in Switzerland.

To exercise these rights, email privacy@wave.co. You can also delete recordings or your entire account, and export individual recordings, transcripts, and summaries, directly in the Wave app. We respond within one month of receiving your request; where a request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. We may need to verify your identity before acting on a request, usually by confirming it from the email address on your Wave account. You can also send requests through our EU and UK representative, Prighter, as described below.

International Transfers

Wave is based in the United States, and your personal data is processed in the United States. For business customers, transfers of personal data from the EEA, the UK, and Switzerland are covered by the Standard Contractual Clauses and the UK International Data Transfer Addendum in section 12 of our Data Processing Addendum.

EU and UK Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• United Kingdom (UK)
• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit https://app.prighter.com/portal/14963340205.

Your California Privacy Rights

This section applies to California residents and describes your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA).

Categories of personal information we collect:

• Identifiers: name, email address, account identifiers, and IP address.
• Internet or device activity: browser and device type, pages viewed, and interactions with our website and app.
• Geolocation: coarse, city- or region-level location inferred from IP address.
• Commercial information: subscription and transaction records.

Disclosure and "sharing":

We disclose the categories above to the service providers listed under "Our Technology Partners" for the purposes described there. Our use of Google and Microsoft advertising and analytics tools may constitute "sharing" of identifiers and internet activity for cross-context behavioral advertising as defined by the CPRA. We do not sell your personal information for money.

Your rights:

• The right to know what personal information we collect, use, and disclose.
• The right to delete personal information we have collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of your personal information.
• The right to limit the use and disclosure of sensitive personal information.
• The right not to receive discriminatory treatment for exercising any of these rights.

To exercise any of these rights — including opting out of the sale or sharing of your personal information — email us at privacy@wave.co with the subject line "California Privacy Request," at no cost to you. To opt out of sharing for advertising on our website, you can also turn off Advertising in Cookie settings; we also honor the Global Privacy Control signal as an opt-out. You may also designate an authorized agent to submit a request on your behalf. We will not discriminate against you for exercising your rights.

Business Customers

If you use Wave in the course of business and we process personal data on your behalf, our Data Processing Addendum applies. It includes our GDPR and CCPA processing terms, security measures, and the full list of subprocessors we use to provide the service.

Updates to This Policy

We'll notify you of any changes by updating this page with a new effective date.

Contact Us

For privacy inquiries, please contact us at privacy@wave.co.