Privacy policy
This page covers two audiences: Awaitee’s customers, who hold an account, and the visitors who go through the waiting room of a customer’s site. Awaitee tracks no one: no advertising cookie, no profile, nothing is sold.
Data controller
TooLooLoo, Raphaël Hue, 29 rue des Trois Rois, 44000 Nantes, France. Contact: hello@awaitee.com. For the visitors of a customer site’s waiting room, the controller is the customer who created the event; Awaitee acts as their processor.
Customers’ data
The account’s email address; for 15 minutes, the sign-in link sent to that address; the events created, their settings, name, message and logo; payments (Stripe session identifier, tier, amount, date); the figures of each event (visitors, wait, entries, seats freed), with no individual data. When a link leaves by email, a keyed hash of the IP address that asked for it is kept for one hour, to limit bulk sending. The sign-in form goes through a Cloudflare Turnstile check: Cloudflare then receives, for the time of the check, technical information about the browser.
Data of waiting room visitors
A visitor gets a ticket drawn at random, with no name or address, kept in their browser. When their turn comes, a presence authorisation, also drawn at random, is kept in the browser’s storage for the site visited; it keeps their seat while they are active. Their IP address is used to route each request and is not stored by the service; when the customer has turned on the per-IP limit, only an encrypted fingerprint specific to the event is kept, and it is erased one hour after the event ends. When the customer has turned on Turnstile, Cloudflare receives, for the time of the check, technical information about the browser, under its own privacy policy.
Purposes and legal bases
Each processing has its legal basis (GDPR, article 6). Performance of the contract: running the account, the events, the queue, the dashboard and the payment, and sending sign-in links. Legal obligation: billing and keeping invoices, held by Stripe. Legitimate interest: the security of the service and, for the customer, the fairness of their queue (Turnstile check, per-IP limit).
Cookies
A single cookie, exempt from consent: the session cookie that keeps a customer signed in to the dashboard (thirty days). The waiting page and the script placed on customer sites use no cookie: they keep the ticket and the presence authorisation in the browser’s storage, which is needed for the service the visitor asks for, waiting in line.
Retention
A sign-in link is erased as soon as it is used, otherwise after 15 minutes. Tickets and presence authorisations only serve for the time of the event; IP fingerprints are erased one hour after it ends. An event’s settings and figures are kept for as long as the account exists. Cloudflare keeps technical logs of requests, kept 7 days at most, for security and diagnosis. Stripe keeps the customer (email, invoices) for as long as its own legal obligations require, ten years for invoices.
Processors
Three providers. Cloudflare (Cloudflare, Inc., United States) hosts and runs the service, its data and its logs, and provides Turnstile. Stripe (Stripe Payments Europe, Ireland) sells the tiers in its own name, as reseller of the service, and handles payment, invoicing and VAT: it receives the customer’s email and billing details, as an independent controller for those, under its own privacy policy; Awaitee never sees or stores a card number. Resend (Resend Inc., United States) sends the sign-in links and receives the recipient address and the message. Cloudflare, Stripe and Resend may process data outside the European Union, under the standard contractual clauses their terms carry. Nothing is ever sold or used for advertising.
Rights
A customer can access their data, have it corrected or deleted, ask for a copy, object to a processing based on legitimate interest or ask for it to be restricted, by writing to hello@awaitee.com. A waiting room visitor contacts the site they wanted to visit, which is the controller, or hello@awaitee.com, which passes it on. A complaint can also be lodged with the CNIL (France’s data protection authority).
Contact
hello@awaitee.com