Privacy Policy

1. Who is responsible for your data

The data controller for WaitingRoom (https://waitingroom.work) is:

• [Your full legal name or company name]
• [Your registered address, Belgium]
• Company number: [KBO/BCE company number]
• Email: info@waitingroom.work

For any question about this policy or your personal data, contact us at the email address above.

2. What data we collect

We only collect the data needed to run the service:

• Account data — your email address and the first name you provide. If you sign in with Google, we receive your email address and basic profile information (name) from Google.
• Job-hunt data you enter — job listings you save (company, role, location, salary, links), application states, interview entries, personal notes and “vibe scores”.
• Documents you upload — files such as CVs or cover letters that you attach to a listing. These may contain additional personal data about you; you decide what you upload.
• Technical data — authentication cookies and, when you log in through the browser extension, extension-local access and refresh tokens needed to keep you signed in, plus standard server logs (IP address, timestamps) kept by our hosting and authentication providers for security purposes.
• Browser-extension data — after you explicitly enable job detection, the extension reads the URL and visible job details on pages that appear to contain a job listing. It sends the listing URL to WaitingRoom to check whether you already saved it. When you choose Save job, the extension sends a static, script-free copy of that detected listing together with the extracted role, company, location, salary, your vibe score and your note. This copy is kept privately with the saved job so you can read it after the original listing goes offline. The extension does not build or retain a history of other pages you visit.

We do not use product analytics, advertising trackers or marketing profiling, track you across other websites, or sell your data.

3. Why we process your data and on what legal basis

• Providing the service (creating your account, storing and displaying your job-hunt data and documents) — necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).
• Security and abuse prevention (authentication logs, rate limiting) — our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
• Transactional email (login codes, important service notices) — necessary for the performance of our contract with you (Art. 6(1)(b) GDPR). We do not send marketing email.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

4. Where your data is stored and who processes it

Your data is stored in the European Union. We use the following processors under data processing agreements (Art. 28 GDPR):

• Supabase — database, authentication and file storage. Your data is hosted in Frankfurt, Germany (AWS eu-central-1).
• Vercel — application hosting and content delivery. Vercel Inc. is a US company; any transfer of personal data to the United States is covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
• Google — only if you choose to sign in with Google, in which case Google processes your login under its own privacy policy.

5. How long we keep your data

• Account and job-hunt data — kept until you delete it or delete your account. You can delete individual items, wipe all your data or delete your entire account at any time from Settings.
• Inactive accounts — we may delete accounts that have been inactive for more than 24 months, after notifying you by email.
• Security logs — kept by our providers for a limited period (typically up to 90 days) and then deleted.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16) — you can edit your name, email and all job-hunt data in the app;
• have your data erased (Art. 17) — use Settings → Danger → Delete account, or email us;
• receive your data in a portable, machine-readable format (Art. 20) — use Settings → Danger → Download my data;
• restrict or object to certain processing (Art. 18 and 21);
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, use the in-app tools or email info@waitingroom.work. We respond within one month.

If you believe we are not handling your data correctly, you can lodge a complaint with the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be.

7. Security

All traffic is encrypted (HTTPS). Your data is protected by per-user access rules (row-level security) so only you can read your own listings, interviews and documents. Uploaded files are stored in a private bucket and are only accessible through short-lived signed links generated for your account.

8. Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Browser-extension data is used only to detect and save job listings, show whether a listing is already saved, and provide the WaitingRoom features you request. We do not sell this data, use it for advertising or transfer it for unrelated purposes.

9. Children

WaitingRoom is not intended for children under 13, the age from which minors may consent to information-society services in Belgium. We do not knowingly collect data from children under 13.

10. Changes to this policy

If we change this policy in a meaningful way, we will notify you by email or through the app before the change takes effect. The date at the top shows when this policy was last revised.

See also our Extension Policy, Cookie Policy and Terms of Service.