Privacy Policy

Last Modified: July 16, 2026

Thank you for your interest in Good Airs Tech LLC ("Wance," "we," "our," or "us"). Wance provides a Backend-as-a-Service (BaaS) platform offering user authentication, database, file storage, and cloud functions. This Privacy Notice explains how information about you that directly identifies you, or that makes you identifiable ("personal information"), is collected, used, and disclosed by Wance in connection with our website at wance.dev (the "Site") and the services we offer in connection with the Site (collectively, the "Service").

What Does This Privacy Notice Apply To?

This Privacy Notice explains how we use your personal information when you use the Service, either as an individual customer or when you access the Service through one of our enterprise customers' accounts. We are the data controller of your personal information when we use it as described in this Privacy Notice.

Our Service allows customers to submit, manage, or otherwise use content relating to others — such as the end users of applications built and managed through the Service, or their employees and contractors ("Customer Data"). We use Customer Data primarily as a processor, meaning we process it on behalf of and under the instructions of the relevant customer, in accordance with our Data Processing Agreement. This Privacy Notice does not apply to our processing of Customer Data in our capacity as a processor. If you are an end user of an application built on Wance, please refer to the privacy notice of the relevant Wance customer.

This Privacy Notice does not apply to our employees or contractors, or to aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you.

Region-Specific Disclosures

  • California: If you are a California resident, you have the right to know what personal information we collect, to request deletion, to request correction of inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell your personal information as defined under the CCPA/CPRA. To exercise these rights, contact us at [email protected]. We will not discriminate against you for exercising any of these rights.
  • Nevada: We do not sell your personal information within the meaning of Chapter 603A of the Nevada Revised Statutes. To submit an opt-out request, contact us at [email protected].
  • European Economic Area, United Kingdom, or Switzerland: If you are located in the EEA, UK, or Switzerland, please see Section 11 — European-Specific Disclosures for additional disclosures, including lawful bases for processing, international transfer mechanisms, and your rights.
  • Note for International Visitors: Personal information may be transferred to, stored, and processed in countries other than where it was collected. Our Service is primarily hosted in and provided from the United States. Where we transfer personal information internationally, we use appropriate safeguards as described in Section 12 — International Data Transfers.

1. Information We Collect and Our Use

Information That You Provide

  • Registration information: Your name, email address, and organization details, collected when you register for an account. Used to administer your account, provide services, and communicate with you.
  • Payment information: Transactional information for subscriptions and usage-based billing. We use third-party payment processors (including Stripe) and do not retain credit card numbers.
  • Communications: Your contact information and the contents of your communications, collected when you contact us, used to respond to inquiries and improve our Service.
  • User Content: Files, documents, data, or information you create, upload, or transmit as part of your use of the Service. You retain full control over this information.

Information from Third-Party Sources

  • Single Sign-On (SSO): We use SSO providers (GitHub and Google) to authenticate accounts, receiving the name and email address associated with your account per the provider's authorization procedures.
  • Social Media: Profile information you permit a social network to share when you interact with our Site through it.

Information Collected Automatically

  • Device and usage data: IP address, browser type, operating system, device identifiers, access times, pages viewed, links clicked, and referring URLs.
  • Service interaction data: API call patterns, performance metrics, and error logs, used to maintain and improve service quality.

2. How We Share Personal Information

  • Service Providers: Third parties who help deliver or improve the Service, contractually bound to use personal information only as instructed and subject to confidentiality. Our key providers include:
    • Cloud infrastructure: Amazon Web Services (AWS)
    • Payment processing: Stripe
    • Email: Resend
    • Authentication: GitHub and Google
  • Legal Requirements: As required by law, legal process, or to protect the rights, property, or safety of Wance, our customers, or others.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with reasonable efforts to ensure consistent treatment.
  • With Your Consent: For any other purpose with your prior authorization.
  • Aggregated/Anonymized Data: Information that does not reasonably identify you.

We do not sell your personal information, and we do not share it with third parties for their own direct marketing purposes.

3. Your Rights and Control Over Your Information

Depending on your location, you may have the rights below. To exercise any of them, contact us at [email protected].

  • Right of Access — confirmation of whether we process your data and a copy of it, the categories, purposes, and recipients.
  • Right to Rectification — correction of inaccurate or incomplete information.
  • Right to Erasure (Deletion) — deletion where continued processing is no longer justified. See Section 6.
  • Right to Data Portability — a copy of the data you provided in a structured, machine-readable format (e.g., JSON or CSV).
  • Right to Restriction — to limit processing in certain circumstances.
  • Right to Object — to processing based on our legitimate interests; for direct marketing, at any time for any reason.
  • Right to Withdraw Consent — at any time, without affecting the lawfulness of prior processing.
  • Right to Lodge a Complaint — with your local data protection authority. See Section 11.

Exercising Your Rights

Email [email protected] with the subject line "Data Subject Request." We will respond to verified requests within 30 days (CCPA: we acknowledge within 10 business days and respond within 45 days, extendable by 45 days with notice). We may require you to verify your identity. You may designate an authorized agent with valid authorization.

Email Communications

You may receive emails about Service updates, products, or promotional offers. Marketing emails include tracking technologies to assess engagement; you can unsubscribe via the links provided. You cannot unsubscribe from certain service-related communications (e.g., account verification, security notices).

Modifying Account Information

You can modify certain account information through your account settings, and use Service features to edit or delete your User Content.

4. How We Use Cookies and Other Tracking Technology

Cookies We Use

  • Strictly Necessary Cookies: Required for the Service to function (session/authentication, CSRF protection, load balancing). Cannot be disabled.
  • Third-Party Cookies: Our payment processor (Stripe) and authentication providers may set cookies for fraud detection and session management.

How We Use This Data

Remember preferences; provide custom content; monitor Service effectiveness; analyze usage; diagnose technical problems; and provide and enhance the Service.

Managing Your Preferences

You can manage cookie preferences through your browser. We do not currently respond to Do Not Track signals. Blocking cookies may affect functionality.

5. Data Retention

We retain personal information only as long as needed for the purposes in this Notice, unless a longer period is required by law.

  • Account information: Retained while your account is active; after closure, contact information is retained for 60 days for recovery, then permanently deleted from active systems.
  • User Content: Retained for the duration of your account; deleted within 30 days of account deletion from active systems. Backup copies may persist for up to 90 days before being overwritten.
  • Payment records: Retained as required by tax and accounting obligations (typically 7 years).
  • Usage and analytics data: Retained in identifiable form for up to 24 months, then aggregated or anonymized.
  • Communications: Support communications retained for up to 24 months after resolution.
  • Legal hold: We may retain information beyond these periods where required by litigation or legal obligation.

6. Data Deletion Requests

  • How to submit: Email [email protected] with the subject line "Data Deletion Request," specifying whether you want deletion of specific data or your complete account.
  • Identity verification: We will verify your identity before processing.
  • Timeline: We acknowledge within 5 business days and complete deletion within 30 days of verification (up to 90 days for complex requests, with notice).
  • Scope: We delete your personal information from active systems, instruct service providers to do the same, and delete your User Content.
  • Exceptions: We may retain information where required by law, for fraud prevention, to resolve disputes, or where deletion is technically infeasible; backups may persist up to 90 days. We will inform you of any data we cannot delete and why.
  • Confirmation: We send confirmation once deletion is complete.

7. Security

We implement commercially reasonable physical, technical, and organizational measures to protect personal information, including:

⚠️ Replace this list with controls Wance actually implements. Do not state a control you do not have.

  • We use industry-standard encryption to protect personal information in transit (TLS 1.2 or higher) and at rest (AES-256), including database storage.
  • Role-based access controls and multi-factor authentication for internal systems
  • Internal security reviews performed at least monthly
  • Incident response procedures
  • Audit logging and monitoring

No security system is completely secure, and we cannot guarantee the absolute security of your information.

Security Breach Notification

In the event of a breach affecting your personal information, we will investigate promptly and take steps to contain and remediate it. Where required by law, we will notify affected individuals and relevant authorities without undue delay (and within 72 hours for authority notification under GDPR).

8. Links to Third-Party Websites and Services

Our Site may link to third-party websites or services we do not control. We are not responsible for their practices; review their privacy notices before providing information.

9. Children's Privacy

Our Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it promptly. Contact [email protected] if you believe we have collected such information.

10. Changes to This Privacy Notice

We may change this Privacy Notice from time to time. We will notify you of material changes through appropriate means (email or prominent notice on the Site) at least 30 days before they take effect. The "Last Modified" date indicates the most recent revision. Continued use after changes take effect constitutes acceptance.

11. European-Specific Disclosures (EEA, UK, Switzerland)

Legal Bases for Processing

  • Contract Performance: Account creation, authentication, service delivery, and payment processing.
  • Legitimate Interests: Service improvement and analytics, fraud prevention and security, customer support, and enforcing our Terms — balanced against your rights.
  • Consent: Marketing communications, non-essential analytics/tracking, and any data sharing for optional features. You may withdraw consent at any time.
  • Legal Obligation: Tax and accounting requirements, law enforcement disclosures, and regulatory compliance.

Your European Privacy Rights

In addition to the rights in Section 3, you may lodge a complaint with your local supervisory authority:

12. International Data Transfers

Wance is headquartered in the United States, and our Service is primarily hosted in the United States. If you access the Service from outside the U.S., your personal information will be transferred to the United States and potentially other countries where our service providers operate.

Where we transfer personal information from the EEA, UK, or Switzerland to countries not deemed to provide adequate protection, we use appropriate safeguards, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission and the UK ICO.
  • Data Processing Agreements with sub-processors that include appropriate transfer mechanisms and security obligations.
  • Supplementary measures such as encryption and access controls.

You may request a copy of the relevant transfer mechanisms by contacting [email protected].

13. Contact Us

If you are unsatisfied with our response, you have the right to lodge a complaint with the appropriate data protection authority in your jurisdiction.

This template is provided for drafting purposes and is not legal advice. Have it reviewed by qualified U.S. privacy counsel (and EU counsel if you onboard EEA users) before publishing.

A Spanish translation of this document is available as a courtesy. In case of any discrepancy between the versions, the English version prevails.