Privacy Policy

For the purposes of the EU and UK General Data Protection Regulation (GDPR) and similar laws, Waterfall is the data controller of the personal information described here, except where we act as a processor on behalf of a facility or business customer (see "Facilities and Business Customers" below). You can reach us about any privacy matter at hello@waterfallwisdom.com, or by writing to our privacy team using the details in the Contact section at the end of this policy.

Account and profile information: your name, email address, phone number (optional), role, language, and any profile details you choose to add such as birth year, hometown, background, or relationships. Story content you provide: voice recordings, video (where offered), photographs of documents or objects, and any text you type. From this content we generate transcripts, extracted principles and lessons, quality signals, and, where enabled, emotion signals. Usage and device information: pages viewed, features used, approximate location derived from your IP address, device and browser type, and diagnostic logs. Payment information: when you upgrade to a paid plan, our payment processor (Stripe) collects and processes your card details. We do not store full card numbers on our own systems. Communications: messages you send us, support requests, and your notification preferences.

Some of what you share with Waterfall may be considered sensitive or special category data. This can include: - Voice recordings, which in some jurisdictions are treated as biometric information. - Emotion signals derived from audio, where you have enabled that feature. - Information you choose to reveal in a story that touches on health, religion, ethnicity, political views, or sexual orientation. We only process this data with your explicit consent, or where another lawful basis applies, and we apply additional safeguards. You are always free to decline to answer any question, to pause, and to delete a recording.

We use personal information to: - Provide, operate, and maintain the Service and your account. - Transcribe, analyse, and organise the stories you record so you and the people you choose can revisit them. - Generate lessons, principles, and, with consent, anonymised training data for the Wisdom Model and the Water emotional intelligence engine. - Power the family circle feature, so members you invite can access the stories and answers you choose to share. - Communicate with you about the Service, including transactional emails and, where you opt in, updates. - Process payments and manage subscriptions. - Keep the Service secure, prevent fraud and abuse, and comply with legal obligations. We do not sell your personal information, and we do not use the content of your stories for advertising.

Where the GDPR applies, we rely on the following legal bases: - Consent: for recording and processing your stories, for any sensitive or special category data, for AI model training, and for optional features such as emotion analysis. You may withdraw consent at any time. - Contract: to provide the Service you have signed up for and to process payments. - Legitimate interests: to secure the Service, prevent abuse, understand how the Service is used, and improve it, balanced against your rights. - Legal obligation: to comply with laws that apply to us. Where we rely on legitimate interests, you have the right to object, as described in "Your Privacy Rights".

Waterfall is built around layered, revocable consent. For each recording you decide how it may be used, from most private to most open: - Platform only: used within Waterfall for you and the people you choose. - Training: may be anonymised and used to train our AI models. - API: may be anonymised and made available through our API to third parties. - Attributed: may be quoted with your name. Separately, you control visibility of each recording: private (only you), circle (your family circle), or public (any signed-in Waterfall user, and eligible for platform-wide wisdom search). Every consent choice is versioned and can be changed or revoked at any time. When you revoke consent, we remove the affected content from future training, delete associated training pairs, and remove it from search, subject to the retention rules below.

With your consent, we use story content to build the Wisdom Model and the Water engine. Before content is used for training, we remove or mask direct identifiers (a process we call PII scrubbing) so that training data does not identify you. Anonymised and aggregated data that can no longer reasonably be linked to you is not treated as personal information and may be retained and used to improve our models. If you withdraw training consent, we stop using your content for new training; models already trained cannot always be reversed, but we will not feed your withdrawn content into future training.

We share personal information only as needed to run the Service: - Service providers (processors) acting on our instructions, including Google Cloud and Firebase (hosting, database, storage, speech to text, and AI), Hume.ai (optional emotion analysis), Stripe (payments), SendGrid (email), and Twilio (SMS). Each is bound by contract to protect your data. - People you choose: family circle members you invite, and anyone who can see recordings you mark public. - Facilities and advocates: where you record through a facility or a personal advocate, authorised staff for that account may access your stories to support you. - Legal and safety: where required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets, with notice where required. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Waterfall is operated using Google Cloud and Firebase infrastructure and may process and store information in the United States and other countries. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical and organisational measures. You can contact us for more information about these safeguards.

We keep personal information for as long as your account is active and as long as needed to provide the Service. Story content is kept until you delete it or close your account, subject to any retention period required by your jurisdiction or by a facility agreement. When you delete a recording or your account, we remove the content from active systems, delete associated training pairs and search vectors, and record the deletion in an audit log. Backups are purged on a rolling schedule. We may retain limited information where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

Depending on where you live, you have some or all of the following rights over your personal information: - Access: obtain a copy of the personal information we hold about you. - Rectification: correct information that is inaccurate or incomplete. - Erasure: ask us to delete your personal information. - Restriction and objection: limit or object to certain processing, including processing based on legitimate interests. - Portability: receive your information in a portable, machine readable format, including an export of your stories. - Withdraw consent: at any time, without affecting processing already carried out. You can exercise most rights directly in the app (profile, consent, and export settings) or by emailing hello@waterfallwisdom.com. We will respond within the time required by law. You also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect and how we use and disclose it, to request access and deletion, to correct inaccurate information, and to not be discriminated against for exercising your rights. We do not sell your personal information and we do not share it for cross-context behavioural advertising, so no opt-out of sale or sharing is required, but you may still contact us to exercise your rights. Because Waterfall can process sensitive personal information such as voice recordings, we limit its use to providing the Service and the purposes you have consented to. To make a request, email hello@waterfallwisdom.com. You may use an authorised agent, and we will verify your identity before responding.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights similar to those described above, including the rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, or certain profiling. We do not engage in targeted advertising or the sale of personal information. To exercise these rights, or to appeal a decision, contact hello@waterfallwisdom.com.

Voice recordings and voice-derived data may be considered biometric identifiers or biometric information under laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington state law. Where these laws apply, we collect and process voice data only with your informed consent, use it solely to provide and improve the Service as described in this policy, do not sell or lease it, protect it using reasonable security, and retain it only as long as needed for the purpose you consented to or as required by law, after which it is deleted.

Some stories may touch on health or wellbeing. Where laws such as the Washington My Health My Data Act or similar consumer health privacy laws apply, we treat that information as consumer health data, collect and share it only with your consent, and honour your right to withdraw consent and request deletion. We do not use health-related content for advertising and do not sell it.

For users in Canada, we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (Law 25). This includes obtaining meaningful consent, limiting collection to what is necessary, being transparent about transfers outside your province or country, and honouring your rights to access and correct your information. Quebec residents may also have rights regarding automated decision-making and data portability. Contact hello@waterfallwisdom.com to exercise these rights.

Waterfall is designed with and for older adults. We take extra care to make consent clear, to allow people to pause and resume, and to reassure contributors that they can edit or delete later. Where a senior is supported by a substitute decision-maker, guardian, power of attorney, or a facility acting under the appropriate authority and consent, that representative may help manage the senior's account and consent choices. We may ask for evidence of authority. Family circle members are consumers of shared stories only and cannot change a senior's account or consent settings.

Waterfall is not directed to children. Our wisdom collection Service is intended for adults, and you must be at least 18 to create a contributor account. Our youth companion product, River, is intended for users aged 13 and older and asks users to confirm they meet that age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

We use a small number of cookies and similar technologies to keep you signed in, remember your theme and language, and understand how the Service is used. We do not use advertising cookies. For details, and to learn how to manage your choices, see our Cookie Policy.

We use technical and organisational measures to protect personal information, including encryption in transit, access controls, hashed API keys, audited administrative access, and secrets management. Audio and other content are stored in access-controlled cloud storage. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authorities of a data breach where required by law.

Waterfall uses AI to transcribe recordings, extract lessons, score quality, and, with consent, read emotional signals. These processes support the Service and the people using it; they do not produce legal or similarly significant decisions about you without human involvement. You can ask us about how a given feature works, and where required by law you can request human review.

When a care facility, research partner, or developer uses Waterfall to collect or process personal information, that organisation is the controller of the information it directs us to process, and Waterfall acts as a processor on its behalf under a data processing agreement. If you contributed through such an organisation and wish to exercise your rights, you may contact them or us, and we will work together to assist you.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

If you have questions, requests, or complaints about this policy or your personal information, contact our privacy team at hello@waterfallwisdom.com. We will do our best to resolve your concern. If you are in the EEA or the UK and are not satisfied, you have the right to complain to your local data protection authority. If we have appointed an EU or UK representative or data protection officer, their contact details will be published here.