Waiveon privacy policy

Waiveon is waiver signing and check-in software for parks and venues, run by Rime Operations LLC ("Waiveon", "we"). A venue (the "organization") installs it and uses it to collect signed waivers and to check its visitors in.

For the people who sign a venue's waiver or buy from its store, Waiveon is the venue's service provider (a "processor" in some laws): it holds their data on the venue's behalf and on its instructions, and the venue decides what it collects and answers to its own customers. For the venue's own staff accounts and for visitors to waiveon.com, Waiveon decides how data is used, as this policy describes.

When an organization connects its Shopify store, Waiveon reads orders through the Shopify Admin API with two permissions: read orders and read products. From each order it keeps the order number, the line items (name, quantity, price, product id), the order and product tags, the sales channel, the payment status, and the buyer's name, email address and phone number. It also records the store's domain and id, and the plan the store chose for Waiveon.

It does not keep shipping or billing addresses, order notes, payment details, or the raw order record. Those fields are dropped before anything is stored; the one thing read from an address is a phone number, used as the buyer's phone when the order itself carries none.

• To match a sale to the signed waiver of the person who made it.
• To tell the front desk who is expected and whether their waiver is valid.
• To create and track passes (day, multi-visit, membership) that an order buys.

Waiveon connects a store to nothing else. It does not sell, share for advertising, or use order data to build profiles across organizations.

Someone signing a venue's waiver gives, through Waiveon's signing page: their name, email address, phone number, postal address and date of birth, an emergency contact (name, phone and relationship), the names and dates of birth of any minors they sign for, whether they agree to photos, and their signature, drawn and typed.

To show later how and when the waiver was signed, Waiveon also records the device's IP address, the browser it reported, the time of each step (opening the waiver, reaching its end, each agreement, the signature) and, for a link the venue emailed, the address it was sent to.

A signed waiver is a legal record. It holds what the signer gave, an append-only log of how it was signed and a sealed copy of the document. Each is kept for at least ten years from signing, or until a listed minor turns twenty-five, whichever is later, for as long as Waiveon offers the service. If Waiveon stops offering it, the venue is told at least thirty days ahead and given a complete copy of its signed waivers before any is deleted. A venue may also bring in waivers its visitors signed with another waiver provider; Waiveon holds those imports the same way.

Waivers are collected by Waiveon from the signer, not received from Shopify, and are stored separately from Shopify data. They are not deleted or altered by a Shopify uninstall or a Shopify data-removal request; removal of Shopify data severs the link between an order and a waiver, and the waiver stands.

• Orders, check-ins and the customer records derived from them: while the organization is a Waiveon customer.
• When the app is uninstalled, the store's orders and related records are deleted on Shopify's shop-removal notice, or within thirty days of the uninstall if that notice never arrives.
• When Shopify relays a customer's removal request, that person's orders and check-ins are anonymized and their derived records deleted, usually within days and always within thirty.
• When Shopify relays a customer's data request, the organization's administrators are notified and can export everything held about that person, with a thirty-day deadline.
• Operational logs age out on a fixed schedule: sync history after ninety days, webhook receipts after thirty, the record of which staff member viewed which record after four hundred days.

Only the organization's own signed-in staff, by role: viewers see counts, staff see the desk, administrators see exports and settings. Staff views of orders, customers, check-ins, waivers, passes and search results are logged with who looked and when. Waiveon's own operators access an organization's data only to run and support the service.

Traffic between your browser, Shopify and Waiveon is encrypted in transit. Store credentials are encrypted at rest with a key that never leaves the server. Passwords are hashed. Where an organization's deployment has object storage configured, sealed waiver documents are stored there encrypted, under an object lock that refuses changes and deletion for the retention period; otherwise they are stored on the hosting provider's encrypted disks. Personal data is never written to application logs. Everything is stored in the United States.

If a security incident affects an organization's data, we tell its administrators without undue delay after confirming it, with what we know and what we are doing about it, and we tell Shopify where its data is involved. The organization tells its own customers, under its own obligations, and we help it do so.

These providers process data for Waiveon, and only what is listed:

Shopify is the source of order data, not a processor of Waiveon's; its own policies govern the store.

For each person a venue gives an account, Waiveon keeps their name or username, email address, role, a hash of their password, when they last signed in, and the record of which records they viewed. It is used to run the account and keep the venue's data safe, and kept while the account exists.

Waiveon sets one cookie: the session cookie that keeps staff signed in. It sets no advertising or tracking cookies. The browser also keeps a few small notes for staff convenience, such as how far the product tour has got. Page views on waiveon.com are counted by Cloudflare Web Analytics, which uses no cookies and identifies no one.

Waiveon is used by venues and their adult visitors, and is not directed to children. A child's name and date of birth reach Waiveon only when a parent or guardian enters them on a waiver they sign for the child. Questions about a child's information, and requests to remove it, go to the venue, as below.

Depending on where you live, privacy laws in several US states give you rights over your personal information: to know what is held about you, to have it corrected or deleted, and to say no to its sale. Waiveon does not sell personal information, or share it for advertising, for anyone.

If you signed a venue's waiver or bought from its store, ask the venue: it decides what happens to your information, and Waiveon acts on its instructions and helps it answer. If you bought through Shopify you can also ask through Shopify, which relays the request to Waiveon automatically. A request that reaches us directly is passed to the venue. A signed waiver may be kept for the period above even after a deletion request, because it is a legal record the venue may need.

For your own staff account, write to support@waiveon.com. An organization can disconnect its store or uninstall the app at any time; imported orders are kept until the store is removed as described above, and signed waivers are kept as legal records.

When this policy changes, the date at the top changes with it. Material changes are announced to organizations by email before they take effect.

Rime Operations LLC, which runs Waiveon, answers questions about this policy at support@waiveon.com.