Legal

Privacy Policy

Version 2026-08-12 · Effective 12 August 2026 · Waterline Technology Co.

Waterline Technology Co.

www.waterline-runway.com · app.waterline-runway.com

1. In Short

Waterline holds payroll figures, funding status and runway dates. That is sensitive commercial information and this policy is written against what the software does. The short version:

We do not sell or rent personal information and we never have.

We do not use your data to train machine learning or AI models.

We show no advertising and there are no advertising or third-party tracking technologies in the Service.

We use no third-party analytics product. Our product analytics is a first-party count of eight events against a random identifier, carrying no email address, no account or company identifier, and no figure from anyone’s model.

The Service has no public profiles, feeds or shared pages. Nothing you put into it is published outside of the model.

You can export your entire model at any time — including when a subscription has lapsed — and delete your account yourself from inside the Service.

The rest of this policy explains the details. If something here does not match what you observe the software doing, tell us at info@waterline-runway.com and we will make it right.

2. Scope, and Two Different Roles We Play

2.1 What this policy covers

This policy describes how Waterline Technology Co. (“Waterline,” “we” or “us”), an Idaho corporation, handles personal information in connection with the Waterline application at https://app.waterline-runway.com and our website at https://www.waterline-runway.com (together, the “Service”). It does not cover third-party services that the Service connects to, each of which has its own policy.

2.2 The distinction that matters most here

Waterline handles two very different kinds of information, and our legal role differs between them. Most privacy policies blur this. We would rather not.

Where we act as a processor. We do not use the model for our own purposes, not sell or share it, and do not combine it with information from anywhere else — apart from the aggregate statistics described in Section 6, which you can opt-out of.

3. What We Collect

3.1 Information you give us directly

Account information. Your email address and, if you sign in with Google, the name and profile identifier Google returns. Your password is stored only as a hash by our authentication provider and is never visible to us.

Company and membership information. The names you give your companies, who is a member of each company, the role of each member, and the email addresses of people you invite.

Billing information. Your billing contact details and a record of your subscription and invoices. Payment card numbers are collected and held by Stripe on its own hosted pages and never pass through or get stored by the Service.

Your model. Everything you enter or import, described in Section 2.2. This is the bulk of what we hold, and it is the part we hold as a processor rather than for ourselves.

Support correspondence. What you write to us and anything you choose to attach.

3.2 Information collected automatically

Much less than a policy of this kind usually lists because the Service does not collect it:

Product analytics. Whether a visitor reached the landing page, opened the demo, started or completed signup, completed setup, first saved a model, and started or completed checkout — eight events, against a random identifier generated in your browser. There is no field in that record for an account identifier, company identifier, email address, URL, referrer, user agent, screen size or any figure from a model. The identifier cannot be resolved to a person by anything we hold. This is a first-party count, not a third-party analytics product.

Error reports. If a crash occurs, a diagnostic event may be sent to a collector we operate or configure. Before anything leaves your browser it is scrubbed: email addresses and number-like values are replaced, values under keys resembling credentials are removed, and structured objects are dropped outright rather than truncated. Error reporting is off entirely unless a collector is configured and operational.

Server and platform logs. Our hosting, database, and authentication providers keep their own operational logs, which include IP addresses and request metadata, under their retention schedules. We use these for security and troubleshooting.

Audit records. We record administrative and destructive actions — a company created, renamed or deleted, an account’s data wiped, a subscription changed — with who did it and when. We deliberately do not record IP addresses in this log.

We do not collect precise geolocation. We do not build profiles or draw inferences about you. We do not fingerprint your device.

3.3 Information from third parties

Google, if you choose to sign in with it, provides your email address, name, and a stable identifier. We do not receive contacts, calendars, or files from your Google account.

Stripe: subscription status, payment outcomes, and billing contact details.

Intuit, if you connect QuickBooks Online, provides the reports and transaction data you select for import and the name of the connected company file so you can confirm you paired the right one.

We do not buy personal information from data brokers, receive information from advertising networks, or obtain data from social platforms beyond the Google sign-in described above.

4. Why We Use It

We use the information described above for these purposes and no others:

We do not use your information for advertising, personalization or recommendations, profiling, or to train machine learning or AI models. If we ever want to use it for something not listed above, we will update this policy and, where the law requires consent, ask for it first.

4.1 Marketing

We may send you occasional messages about Waterline itself. You can opt out of those at any time using the unsubscribe link or by writing to us; you will still receive service messages about billing, security and changes to these documents because those are part of providing the Service.

5. Who We Share It With

5.1 Service providers

These are the only third parties that process information on our behalf. All processing of your model takes place in the United States. Each is bound to use the information only to provide its service to us.

If we add or change a service provider in a way that materially affects how your information is handled, we will give at least thirty days’ notice by email or in-product notice. If you have documented security or compliance objections to a new provider, you may cancel without further charge at the end of your current month.

5.2 People you invite

When you invite someone into a company, they receive that company’s entire model — including individual salaries — whatever tabs or focus settings the interface shows them. Interface focus organizes attention, it is not confidentiality control. This is worth understanding before you invite an outside advisor and it is stated the same way in our Terms of Service.

5.3 Legal and safety

We may disclose information where we believe in good faith it is necessary to comply with a law, regulation, legal process or lawful government request, to enforce our Terms, or to protect the rights, property or safety of Waterline, our customers or others. Where we are legally permitted to tell you about a request for your data before responding to it, we will.

5.4 Business transfers

If Waterline is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction. Any acquirer would remain bound by this policy for information collected under it until you are given notice of any change.

5.5 What we do not do

We do not share personal information with advertising networks, data brokers, analytics vendors or business partners for their own purposes. We have no affiliates or corporate group to share with. Nothing you enter is made public by the Service.

6. Aggregate Statistics

We compute aggregate, de-identified figures across our customer base — for example how many organizations use Waterline, total cash modeled, or median runway — and may publish them. Three constraints apply and they are enforced in the software rather than promised in principle:

No published figure identifies a customer or an individual.

Any figure computed from a sample smaller than the minimum cohort size (currently ten companies) is withheld entirely rather than rounded or blurred because a blurred number still carries information.

A company can be excluded at any time in its own settings. An excluded company’s model is not read by the aggregation process at all; model data is filtered out before the data is touched, not filtered out of the result afterwards.

7. Cookies and Browser Storage

The Service does not use advertising cookies, tracking pixels, web beacons, session replay, or any third-party tracking technology. There is no cookie banner because there is nothing to consent to beyond what is strictly necessary.

What the Service does use is storage inside your own browser:

Your sign-in session – kept by our authentication provider so you are not asked to sign in on every page.

A working copy of your model – work is not lost if your connection drops or the tab closes.

The demo – held entirely in your browser and reset twelve hours after you first open it.

Interface preferences – stored per device.

The random product-analytics identifier described in Section 3.2.

You can clear this at any time through your browser settings, though doing so signs you out and discards any unsaved local work. Because we do not sell or share personal information and run no targeted advertising, there is nothing for a Global Privacy Control or Do Not Track signal to switch off. We treat such a signal as a request to opt out of any sale or sharing, and the answer is that we do none.

8. How Long We Keep It

9. Security

We maintain administrative and technical safeguards appropriate to the size of service and sensitivity of information held. As of this policy, these include:

Encryption of traffic in transit using TLS and encryption of stored data at rest by our hosting and database providers.

Tenant isolation enforced in the database itself by row-level security policies, so access to a company depends on a membership record rather than on how the interface behaves. A soft-deleted company is unreachable thar than hidden from lists. We run an automated isolation test suite against the database.

Authentication and session handling operated by a managed provider that supports password, emailed-link, and Google sign-in.

Storage of third-party credentials, such as your accounting system’s refresh token, in an encrypted secrets vault with no long-lived access token retained. Reading the connection table yields an identifier with no usable credential.

Hosted, redirect-based payment checkout, so no card data is transmitted to, processed by, or stored in the Service.

Scrubbing of diagnostic error events in the browser before transmission, as described in Section 3.2.

An audit record of administrative and destructive actions.

What we do not have: we do not, yet, hold a SOC 2 Type II attestation or an equivalent third-party audit nor do we conduct scheduled third-party penetration testing. If you are running a vendor security review, write to us and we will provide a description of these measures, our current provider list, our tenant isolation model, isolation test results, our incident response practice, and written answers to a questionnaire.

No system is completely secure and we cannot guarantee absolute security.

9.1 If something goes wrong

If we become aware of a security breach to the systems holding your information, we will investigate promptly and notify you without unreasonable delay and within seventy-two hours of confirming that information has been misused. Where we hold personal information belonging to a customer rather than to us, we will notify that customer as the owner of the information and cooperate with them, consistent with Idaho Code § 28-51-105(2). Our notice will describe what is known, which categories of data are affected, and what we have done. If you are a customer, deciding what notice you must then give your own people and regulators is your responsibility as controller and we will help.

10. Your Choices and Rights

10.1 What you can do yourself

Most of what a privacy request would achieve is built into the Service and does not require contacting anyone:

Export. An owner can export a company’s entire model as a machine-readable JSON file at any time — including during a trial, while a payment is past due, and after a subscription has lapsed. This is our data portability mechanism and does not require contacting us.

Correction. Everything in your model is editable by anyone with editing rights.

Deletion of a company. Immediate unreachability, restorable by an owner for 30 days, and permanently purged after that.

Deletion of your account. This deletes your account data, deletes the companies you solely own, and removes you from companies with another owner — we do not delete those even if you are a co-owner to avoid destroying someone else’s data.

Opting a company out of aggregate statistics in that company’s settings.

10.2 Rights you can exercise by contacting us

Depending on where you live, you may have the right to know what personal information we hold about you and how we use it, get a copy of it, correct it, delete it, opt out of its sale or sharing or targeted advertising or profiling, limit the use of sensitive personal information, and not to be discriminated against for exercising any of these. Write to info@waterline-runway.com and we will respond within the time the applicable law allows, generally forty-five days and at most ninety with notice, or one month under GDPR-style rules.

We will verify your identity, typically by confirming control of the email address on the account, before acting. You may use an authorized agent, who must provide written authorization, but we may still ask you to confirm the request directly. Exercising any of these rights costs nothing and will not change your price or service level.

10.3 If your information is in someone else’s model

If your employer or client entered your salary or role into a Waterline model, we hold it as a processor on their instructions. Send your request to them. If you send it to us, we will refer you to the customer if we are permitted to identify them and help them respond. We will not access, alter, or delete a customer’s model at the request of someone who is not the owner.

10.4 We do not sell or share your information

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are used in California and other state privacy laws. We have not done so in the preceding twelve months, including with respect to anyone under sixteen. We offer no financial incentive programs in exchange for personal information.

11. State Privacy Laws

11.1 Idaho

We are an Idaho corporation. Idaho has not enacted a comprehensive consumer privacy statute, so there is no Idaho analogue to the access and deletion rights described above. Idaho’s principal requirement in this area is the breach notification duty at Idaho Code §§ 28-51-104 to 28-51-107, which we address in Section 9.1. The absence of an Idaho statute does not limit rights you have under the law of the state you live in and we honor those regardless of where we are incorporated.

11.2 California

For California residents, the categories of personal information we have collected in the preceding twelve months are: identifiers (name, email address, account identifier, and IP address in provider logs); commercial information (your subscription and payment history); internet or network activity (the eight product-analytics events and scrubbed error reports); and, within customer models, professional or employment-related information about a customer’s staff, including compensation. We collect these from you, from your device, and from Google, Stripe, and Intuit as described in Section 3.3. We disclose them for business purposes only to the service providers listed in Section 5.1. We do not collect sensitive personal information as the CCPA defines it: no Social Security or government identification numbers, no financial account credentials, no precise geolocation, no racial, religious, health, genetic, or biometric data, and no contents of your mail or messages.

Compensation data is not “sensitive personal information” under that statutory definition, but it is plainly confidential, and we treat it with the care described in Section 9, above what the statute requires.

Where we act as a service provider, we certify that we understand and will comply with the restrictions the CCPA places on that role: we will not sell or share the personal information we receive, will not retain, use or disclose it for any purpose other than performing the Service and the business purposes the statute permits, will not combine it with personal information from other sources except as the statute allows, and will assist our customer in responding to consumer requests. California is unusual in extending its consumer rights to information about people acting in an employment or business-to-business capacity, which is most of what a Waterline model contains — so for California residents, Section 10.3 is particularly likely to be the relevant route.

11.3 Other states

Comprehensive privacy laws are now in force in a substantial number of states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana and Kentucky. Two things are worth knowing about how they apply here.

Most of them have applicability thresholds — typically tens or hundreds of thousands of consumers, or a share of revenue from selling data — that Waterline does not currently meet. Most of them exclude personal data about individuals acting in a commercial or employment context, which is what a Waterline model consists of. In many cases these statutes will not formally apply to us at all.

We do not intend to rely on that. If you are a resident of a state with a consumer privacy law and you make a request, we will handle it under the rights described in Section 10.2, in the manner and within the time your state’s law specifies, including any appeal process. If we decline a request you may appeal by writing to info@waterline-runway.com with “Privacy Appeal” in the subject line; if we decline the appeal we will tell you how to contact your state attorney general.

12. International Users and Data Location

Waterline is operated from Idaho, in the United States, and all processing of your model takes place in the United States. If you access the Service from elsewhere, your information will be transferred to and processed in the United States, whose data protection laws differ from those where you live.

The Service is offered for use in the United States. We are not established in the European Economic Area, we have not appointed an Article 27 representative, we do not have a Data Protection Officer, and we do not currently offer a data processing agreement incorporating the Standard Contractual Clauses. Customers should not submit personal data subject to the GDPR or the UK GDPR to the Service without first executing a written data processing agreement with us. If you need one, write to us before submitting the data rather than afterwards.

We would rather say this than claim transfer mechanisms we have not put in place. Where we do process personal data of people in these regions — for example because you contacted us from there — we handle it in accordance with this policy, and Section 4 sets out the lawful bases we rely on.

13. Children

The Service is a business tool for organizations and their advisors. It is not directed to children, and our Terms of Service require you to be at least eighteen. We do not knowingly collect personal information from anyone under eighteen, and we do not knowingly collect, use or disclose personal information from a child under thirteen within the meaning of the Children’s Online Privacy Protection Act. If you believe a child has given us information, please write to info@waterline-runway.com and we will delete it promptly.

14. Changes to This Policy

We may revise this policy. Each version is identified by the date it was published, shown at the top. Where a revision materially changes how we handle personal information, we will tell you by email or by a prominent notice in the Service, and — as with our Terms — we will ask you to accept it inside the Service before you continue, recording which version you accepted and when. While a revision is pending your acceptance, your model stays readable and exportable; we will not hold your data to force agreement. Where the law requires consent for a change, we will obtain it before the change takes effect.

15. How to Reach Us

Waterline Technology Co.

Attn: Privacy

97 Wilderness Way, Boise, Idaho 83716

Email: info@waterline-runway.com

Website: https://www.waterline-runway.com · Application: https://app.waterline-runway.com

We do not operate a toll-free number. Email is the fastest way to reach us and reaches the person who can act on your request.