This policy explains how personal data is handled in Waypoint (app.wpoint.pro and wpoint.pro).
1. Who is responsible
- DNZ Labs Xolo Go OÜ, Paju tn 1a, 50603 Tartu, Estonia (VAT EE102156920) — "Waypoint", "we" — is the controller for your account, your startup's content and everything you do in the app.
- Your Club (the incubator, accelerator or programme you joined through) is a separate controller for the information it receives about you to run its programme (see section 4). The Club's own privacy notice applies to what it does with that information.
- For data a Club gives us to run its programme (for example its admins' accounts, the people it invites and its announcements), we act on the Club's instructions under a data agreement with the Club.
Contact for anything about your data: privacy@wpoint.pro
2. What we collect
- Account: name, email, profile photo and LinkedIn (optional), Club, role, account status, sign-in records and the version of these terms you accepted.
- Startup and team: startup name, one-liner, stage, sector, country, team members, their roles and titles, invitations.
- Your content: pitch decks and other documents, the guided idea, programme calls, analyses produced from them, hypotheses, evidence, tasks and notes.
- Founder Pulse: weekly check-ins (area statuses, blocker sentences, focus, weekly commitment), stage milestones, stage changes, help requests to your Club, and your sharing choices.
- AI Coach: your questions, the Coach's answers and your ratings.
- Usage and technical data: activity dates, usage counters (for example analyses this month), AI usage costs, notifications, and technical logs (IP address, browser, timestamps) kept by our hosting provider.
- Contact form on wpoint.pro: your name, email, organisation and message, used only to reply to you.
Please don't upload special category data about identifiable people (for example patient health data) or other people's personal data you are not allowed to share.
3. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Provide Waypoint to you and your team: accounts, analyses, Coach, planning, Pulse, notifications | Contract (our Terms) |
| Show your Club what it always sees (section 4) | Contract, and the legitimate interest of your Club and of Waypoint in running the programme |
| Share your Pulse or analysis summary with your Club, or send it a help request | Consent, given by your startup's owner (or, for a help request, by the member who sends it), which can be withdrawn at any time |
| Keep Waypoint secure, prevent abuse, fix problems and keep audit records | Legitimate interest |
| Product emails (reminders, invitations, analysis ready) | Contract; you can turn each type off in Settings › Notifications |
| Reply to a message sent through the contact form on wpoint.pro | Legitimate interest, or steps you asked for before an agreement |
| Legal obligations | Legal obligation |
We don't sell personal data and we don't use it for advertising.
4. What your Club sees
| Information | Your Club |
|---|---|
| Your name, startup, role and title, stage, last activity | Always |
| Whether your startup checked in this week | Always |
| Anonymous totals across all startups in the Club (shown only when at least 5 are counted) | Always |
| Your startup's weekly Pulse: area statuses, stage progress, streak, commitments kept | Only if your startup's owner shares it |
| Your latest analysis summary: date, audience, overall readiness, band per area, next move title | Only if your startup's owner shares it |
| One blocker and a message | Only when a team member sends "Ask my Club for help" |
| Documents, full analyses, hypotheses, evidence, tasks, weekly commitments, notes | Never |
| AI Coach conversations | Never — private to each person, also inside the team |
Turning sharing off removes the Club's access, including history.
5. AI processing
To produce analyses and Coach answers, the relevant parts of your startup's content are sent to our AI provider (OpenAI) through our servers. They are used only to generate the answer, are not used to train AI models, and are kept by the provider only for a limited period for abuse monitoring under its own terms. Results are generated automatically; no decision with legal or similarly significant effect is taken about you by automated means.
6. Who processes data for us
Base44 (hosting, database, file storage, sign-in), OpenAI (AI analysis and Coach), Resend (email delivery), Google (only if you sign in with Google) and, when paid mentor sessions are available, Stripe (payments). The current list is on our Sub-processors page.
7. International transfers
Some providers are in the United States. Transfers rely on the safeguards recognised by the GDPR, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
8. How long we keep data
- While your account is active.
- Archived startups are kept until their owner restores or deletes them.
- When you delete your account, we delete your profile, Coach conversations, notifications and your solo startups at once; startups you share with a team stay with the team.
- Files uploaded to a startup that is later deleted stay in private storage that only Waypoint can reach, because our hosting provider does not yet let us delete them one by one. They are never shown or used again, and we will remove them as soon as the provider allows it.
- If your Club's agreement ends, its founders' data is kept for 2 months so they can export it or move, then deleted, unless the law requires us to keep it longer.
- Audit records keep only counts and identifiers, never your content.
- Contact form messages are kept for up to 12 months after our last exchange.
9. Your rights
You can access, correct, export and delete your data yourself in Settings (Profile, Privacy, Data & account). You can also ask us to restrict or object to processing, or withdraw consent for sharing at any time. Email privacy@wpoint.pro; we answer within one month. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the data protection authority where you live (for example CNPD in Portugal or ANPD in Brazil).
10. Security
Startups and Clubs are isolated from each other; a startup's data can be read only by its active team members, and every sensitive action goes through checked server functions and is logged. Data is encrypted in transit. No system is perfectly secure.
11. Cookies
We only use what is needed for Waypoint to work. See the Cookie Policy.
12. Age
Waypoint is for people aged 18 or over. We don't knowingly collect data from younger people.
13. Changes
We will tell you in the app or by email about material changes before they apply.