Last updated 2026 · English version governs

1. Who we are

This service is operated by waitdead ("waitdead.ai", "we", "us"). We are an independent AI security review firm. Our legal-entity registration is in progress; the registered company name, number, and address will be published here once finalized: [to be supplied: registered legal entity name, number, registered address].

The data controller for the purposes of applicable data-protection law is [to be supplied: controller entity, once registered]. We have not yet appointed a formal data-protection officer; the contact point for all privacy matters is our intake channel (see Section 9). Our governing jurisdiction will be confirmed on registration: [to be supplied: governing jurisdiction].

2. Data we collect

We collect only what we need to respond to you and to deliver a review.

• Booking & contact. When you book a review or submit the intake form, we collect your name, email address, company, and country, plus whatever you choose to write in your message.
• Free scan. When you run the free scan, you paste a public artifact — a public MCP server URL, an OpenAPI manifest, or an agent configuration. Secrets are redacted on submit, and pasted input is treated as untrusted data, not as a trusted instruction. Please do not paste credentials, tokens, or private/internal endpoints; the scan is designed for public surfaces only.
• Anti-abuse. Our forms include a honeypot field and standard request metadata used solely to prevent automated abuse.
• Operational logs. Our hosting and DNS providers process technical data (such as IP address and request timestamps) needed to serve the site securely.

We do not run third-party advertising trackers, and we do not sell personal data.

3. Why we use it — and our legal basis

We process the data above on two legal bases under the GDPR (and the analogous bases under CCPA/CPRA):

• Contract (Art. 6(1)(b)). To respond to your enquiry, scope and deliver a review, and manage the engagement you requested.
• Legitimate interest (Art. 6(1)(f)). To run the free scan you asked for, to operate and secure our site and forms, to prevent abuse, and to follow up on a lead you initiated. You can object at any time (see Section 8).

4. Retention

We keep personal data only as long as we have a reason to.

• Booking & intake records are retained for the life of the enquiry or engagement and for a reasonable period afterward to meet legal, accounting, and dispute-handling needs: [to be supplied: retention period, pending counsel].
• Scan artifacts. The public artifact you paste, and the exposure checklist generated from it, are retained as part of the tracked lead so we can follow up; they are deleted on request and otherwise after the retention window above. Because input is treated as untrusted data and secrets are redacted on submit, we do not intentionally store credentials.

5. Sub-processors

We share personal data only with the service providers needed to operate. These are the only sub-processors we use; the current list is maintained on our Trust page.

6. International transfers

Our hosting is in the EU (Germany, via Contabo). Some sub-processors may process data outside your country — for example, transactional email is sent through a region outside the EU. Where personal data is transferred internationally, we rely on the appropriate safeguards, such as Standard Contractual Clauses or an equivalent transfer mechanism, in line with applicable law: [to be supplied: specific transfer mechanism, pending counsel].

7. How we protect it

• TLS 1.3 with valid certificates on all our sites; HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are set.
• Framework and version fingerprints are stripped.
• Secrets are redacted on scan submit, and pasted input is treated as untrusted data.
• AI-derived findings are labeled as such and gated behind human sign-off.

We do not yet hold SOC 2, ISO 27001, or ISO 42001; those are planned, not held.

8. Your rights

Subject to applicable law, you have the right to access the personal data we hold about you, to request its correction or erasure, to object to or restrict processing based on legitimate interest, and to data portability. Under the CCPA/CPRA you also have the right to know what we collect and to request deletion; we do not sell or "share" personal data for cross-context behavioural advertising. You may also lodge a complaint with your local supervisory authority.

9. How to exercise them

Use our intake channel — crm.waitdead.com/intake — to make any privacy request; it creates a tracked ticket so nothing is lost. A dedicated inbound security/privacy mailbox is being stood up with our own mail server (in progress); until then, the intake form is the reliable channel. We do not operate a phone line.

10. Changes to this policy

We may update this policy as our entity registration completes, as counsel review finishes, or as our processing changes. We will update the "Last updated" date above; material changes will be reflected here before they take effect.

If anything in this policy conflicts with the rights granted to you by applicable law, the law prevails.