Privacy Policy

Welcome to WaveHub ("WaveHub", "we", "our", or "us"). We operate the platform available at www.wavehub.co.il and related mobile applications (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Service.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2.1 Information You Provide Directly

• Account registration details (name, email address, password hash)
• Profile information you choose to add (display name, avatar)
• Payment and billing information (processed securely via PayPlus — see Section 7)
• Content you upload, create, or export through the editor (clips, edited videos)
• Communications you send us (support requests, feedback)

2.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, referring URL, pages visited, timestamps
• Device identifiers and usage patterns within the Service
• Cookies and similar tracking technologies (see Section 9)
• Aggregated analytics data (session duration, feature usage)

2.3 Information from Third Parties

• If you sign in via Google OAuth, we receive your Google profile information (name, email, profile picture)
• Payment status and transaction references from PayPlus
• Publicly available beach and weather data from integrated forecast providers

• To create and manage your account and authenticate you securely
• To provide, operate, and improve the Service and its features
• To process payments and manage subscription billing via PayPlus
• To send transactional emails (account verification, password reset, receipts)
• To send service-related notifications and, with your consent, marketing communications
• To enforce our Terms of Service and applicable laws
• To detect and prevent fraud, abuse, and security incidents
• To analyze usage trends and improve platform performance
• To respond to your support requests

We do not sell your personal data. We may share your information only in the following limited circumstances:

• Service Providers: Third-party vendors who help us operate the Service (cloud hosting, email delivery, analytics, payment processing). These providers are contractually obligated to protect your data and use it only as directed by us.
• PayPlus (Payment Processor): Payment card data is transmitted directly to PayPlus and is never stored on our servers. PayPlus is PCI-DSS compliant.
• Jamendo (Music Provider): When you use the editor music library, track requests are sent to the Jamendo API. Jamendo may collect standard request metadata (IP, user-agent) per their own privacy policy.
• Audius (Beach Music Provider): Beach live-stream pages may stream music via the Audius decentralized network. Playback requests are subject to Audius's privacy practices.
• Legal Obligations: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of WaveHub, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

The Service integrates with the following third-party platforms. Each has its own privacy policy that governs how they handle data:

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Account data: retained while your account is active and for up to 90 days after deletion
• Uploaded media and exported clips: retained per your subscription storage quota; deleted within 30 days of account deletion
• Payment transaction records: retained for 7 years for legal and accounting purposes
• Log and analytics data: retained for up to 12 months in aggregated or anonymised form

WaveHub uses PayPlus as its exclusive payment processor. The following security measures are in place:

• All payment pages are hosted on PayPlus's PCI-DSS Level 1 certified infrastructure
• Card data is tokenized — WaveHub receives only a non-reversible payment token
• Recurring subscription charges are managed by PayPlus recurring billing; WaveHub stores no card details
• Card update requests redirect you to a PayPlus-hosted secure page
• Webhook notifications from PayPlus to WaveHub are validated using a shared secret to prevent forgery

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS/HTTPS encryption for all data in transit
• Passwords stored as salted bcrypt hashes; plaintext passwords are never retained
• Access controls and role-based permissions for internal systems
• Regular security reviews and dependency updates

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We use the following types of cookies and local storage:

• Essential cookies: Required for authentication sessions and security (e.g., NextAuth session cookie). Cannot be disabled.
• Preference cookies: Store your language and theme preferences. Persistent for up to 1 year.
• Analytics: Aggregated usage data to understand how the Service is used. No personally identifiable information is shared with analytics providers.
• Local storage: Some features (e.g., video chat history, editor state) use browser local storage. This data never leaves your device.

You can configure your browser to refuse cookies or alert you when cookies are being sent. Disabling essential cookies may affect Service functionality.

Depending on your jurisdiction (including the EU/EEA under GDPR and Israel under the Protection of Privacy Law), you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request that we restrict processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at info@wavehub.co.il . We will respond within 30 days.

The Service is not directed to children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete it promptly. If you believe a child has submitted information to us, contact us at info@wavehub.co.il .

WaveHub is based in Israel, which has been recognized by the European Commission as providing an adequate level of data protection. If you access the Service from outside Israel, your information may be transferred to, stored, and processed in Israel and other countries where our service providers operate. By using the Service, you consent to such transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Effective Date" and, where appropriate, by sending an email notification to the address associated with your account. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: