Privacy Policy

1. Who this policy covers

This policy applies to Waffel ("Waffel", "we", "us"), a tool built for Australian UGC creators to manage brand deals — from contract to signature to payment to a tax-ready income record — and, where you choose to connect it, to read the Gmail threads where those deals are actually negotiated. It covers the Waffel web app and this website.

2. What we collect

We collect information in three ways:

• What you give us directly — your name, email, handle, ABN and GST status when you set up your account; brand names, contacts, deal terms, deliverables, rates and notes you enter or a brand sends back through a deal link.
• What we access through Gmail, if you connect it — with your explicit consent via Google's OAuth sign-in, Waffel can read the subject, sender, and content of email threads in your inbox, in order to identify brand deal conversations and help you track them. We currently request read-only access — Waffel cannot send email on your behalf unless a future version explicitly asks you for that separately.
• What we collect automatically — basic technical data (browser type, device, general usage) to keep the product working and to understand what's actually being used.

3. Our use of information received from Google APIs

Waffel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Gmail data is used only to identify brand-deal-related threads and to help you track their status, terms and follow-ups within Waffel.
• We do not use Gmail data for advertising, and we do not sell it.
• We do not use Gmail data to train generalised or non-personalised AI or machine learning models.
• Human review of Gmail content is limited to what's necessary for security, legal compliance, or with your explicit consent (for example, if you contact us about a support issue involving a specific thread).
• You can disconnect Gmail access at any time from within Waffel, or by revoking access directly at myaccount.google.com/permissions.

4. How we use information

• To run the core product — building, tracking, signing and getting paid for deals.
• To identify and summarise brand-deal threads from a connected inbox, and to draft (never auto-send, at this stage) follow-up and payment-chase messages for you to review.
• To keep your income log accurate for Australian financial-year reporting.
• To communicate with you about your account, and, if you've opted in, about the product itself.
• To improve the product — understanding what's breaking or going unused.

5. Where information is stored

As of this beta: your Gmail connection is stored as an encrypted credential that only Waffel's servers can read — it is never exposed to your browser or to any other party. Deal, brand and note data is currently stored locally in your own browser rather than in a central database, which means it doesn't yet sync across your devices. We're actively building toward centralised, encrypted cloud storage as the product matures, and this policy will be updated when that changes.

6. Who we share information with

We don't sell your information. We share it only with:

• Google — to authenticate the Gmail connection you set up.
• Payment processors (e.g. Stripe, once payments go live) — to move money from a brand to you. We don't hold your funds ourselves.
• Service providers who host or operate the infrastructure Waffel runs on, bound to protect your data and prohibited from using it for their own purposes.
• Law enforcement or regulators, only where we're legally required to.

7. Your rights

Under the Australian Privacy Principles, you can ask us what information we hold about you, correct it, or request its deletion. Disconnecting Gmail access and deleting your account data can also be done directly within the product. Contact us using the details below for anything that isn't yet self-service.

8. Cookies

We use a small number of cookies that are strictly necessary for the product to work — for example, keeping you signed in and maintaining a secure Gmail connection. We don't use advertising or cross-site tracking cookies.

9. Children's privacy

Waffel is built for creators running a business and is not directed at children. We don't knowingly collect information from anyone under 16.

10. Changes to this policy

We'll update the date at the top of this page when this policy changes, and if a change is significant — particularly anything affecting how Gmail data is handled — we'll tell connected users directly rather than relying on you to check back.

11. Contact

Questions about this policy, or a request relating to your data: vinson.chen@waffelai.com.