PRIVATE BY DEFAULT.

WHO OPERATES THESE SERVICES

WAE Media, LLC ("WAE", "we", "us") operates the WAE HQ website (waehq.com) and the WAE Intelligence application through which platform accounts and business assets — currently Meta (Facebook and Instagram), with a Google / YouTube connection capability that is implemented as integration code and remains activation-gated — can be connected to WAE systems.

WAE Media, LLC is organized in the State of Delaware, United States. Its principal place of business is San Francisco, California, and its official business and mailing address is 2261 Market Street, STE 83934, San Francisco, CA 94114, United States.

Privacy questions and requests: [email protected].

SCOPE OF THIS POLICY

This policy applies to:

• the WAE HQ public website at waehq.com, including its public pages, machine-readable surfaces, and contact submissions;
• the WAE Intelligence application and its WAE OS integrations; and
• the connection of Meta, Facebook, and Instagram accounts and business assets to WAE workspaces through Meta OAuth; and
• the connection of Google accounts and YouTube channels to WAE workspaces through Google OAuth, once that connection capability is activated — its current state is disclosed in its dedicated section below.

It does not automatically cover every WAE brand website or property; other WAE properties may publish separate policies. This policy does not change Meta's own terms, Google's own terms, or how Meta or Google handle data on their own platforms.

The WAE HQ public website has no user accounts, no login, and no public workspace. Product and workspace processing is therefore limited to the WAE Intelligence / Meta integration described in its dedicated section below and, once activated, the WAE Intelligence / Google (YouTube) integration described alongside it.

INFORMATION PEOPLE PROVIDE DIRECTLY

WAE HQ publishes its content publicly and does not require visitors to register, create accounts, or submit information to read the site.

When a person contacts WAE — for business, press, partnership, privacy, security, or any other purpose — WAE receives what the sender provides: for example a name, email address, company or affiliation, the subject of the inquiry, message contents, and any links or attachments the sender chooses to include.

WAE uses that information to respond to the inquiry, evaluate partnership or business opportunities, handle press requests, process privacy and data-rights requests, triage security reports, and maintain business records.

TECHNICAL INFORMATION PROCESSED AUTOMATICALLY

WAE HQ is a static website. The hosting platform (Cloudflare) processes standard request-level operational data at the network edge to deliver, secure, and operate the site — for example IP addresses and user-agent strings are handled in the course of serving requests and protecting the platform. That processing belongs to the hosting platform's own operations.

WAE's own application does not maintain a visitor-level request log and does not operate a visitor analytics product. WAE does not build advertising profiles from site traffic.

COOKIES AND TRACKING

• WAE HQ does not serve optional tracking cookies or third-party advertising cookies.
• The site's public pages do not write cookies or browser storage for tracking, profiling, or advertising.
• WAE HQ loads no third-party analytics, pixels, or ad tags.

Because the site does not operate optional tracking cookies, there is no cookie-banner consent ecosystem to manage. This section is the tracking disclosure; it is part of this policy rather than a separate notice.

BUSINESS, PRESS, PARTNERSHIP, AND OTHER SUBMISSIONS

All inbound contact uses one direct institutional email channel:[email protected]. WAE HQ does not publish an automated web-form service or a form-response SLA; submissions are handled by people.

Submissions are used only for the purpose they were sent for and for WAE's institutional record-keeping: responding, evaluating opportunities, fulfilling press and diligence requests, processing rights requests, and maintaining business correspondence records. WAE does not sell submitted information and does not use it for advertising.

ASK WAE — HOW PUBLIC QUERIES ARE HANDLED

Ask WAE is a deterministic public-intelligence interface over WAE's admitted public evidence corpus. Queries are resolved in the visitor's browser against a static public corpus file; query text is not transmitted to WAE servers and is not sent to any AI model provider. In Production, no AI provider receives public Ask WAE prompts.

Ask WAE does not collect a conversation history, does not build a profile of the person asking, and does not use submitted queries to train models.

WAE INTELLIGENCE — META PLATFORM DATA

This section is the dedicated disclosure for the WAE Intelligence Meta integration. It describes the Meta Platform Data WAE may process when a person connects a Meta account through WAE Intelligence.

WAE Intelligence is currently operated in Meta's Developmentapp mode; Meta's platform controls govern which accounts can connect while the app is in that mode. The disclosures below describe the implemented capability truthfully, including capabilities that are fail-closed until enabled and authorized.

META PLATFORM DATA WAE MAY PROCESS

When a person connects a Meta account through WAE Intelligence and grants the requested permissions, WAE may process — only to the extent the granted permissions allow:

• Meta account identifiers needed to establish and maintain the connection, such as the Meta user ID received through Meta's token verification;
• the set of granted permissions (scopes) and the authorization state of the connection;
• Facebook Pages the account can manage, including Page identifiers and names, and the Page-level credential Meta issues for Pages the person selects;
• linked Instagram professional or business account identifiers and usernames, where Meta provides them;
• OAuth connection metadata, such as connection identifiers, timestamps, and revocation status;
• access credentials (tokens) required for authorized platform operations, stored server-side in encrypted form;
• identifiers and operational records of publishing requests and results, where publishing is enabled and authorized; and
• outcome data for published media — for example video views, plays, likes, comments, shares, saves, or reach — where outcome reading is enabled and supported.

WAE does not, through this integration, collect private messages, friends lists, unrelated personal posts, advertising profiles, payment information, or passwords.

WHY WAE PROCESSES META PLATFORM DATA

• to authenticate and connect a Meta account to a WAE workspace;
• to discover eligible Facebook Pages and linked Instagram professional or business accounts;
• to associate authorized platform targets with WAE workspaces and brands;
• to perform authorized publishing actions when that capability is enabled;
• to read provider outcome and performance data for published content, when enabled and supported;
• to secure the connection and enforce authorization and revocation state; and
• for audit, operational troubleshooting, and business records maintenance.

Publishing and outcome reading happen only when enabled andwhen authorized for the specific target, and onlywhere the user grants the relevant permission. External publishing from WAE OS is subject to an authorization gate and is not enabled by default.

OAUTH AND TOKEN HANDLING

• OAuth access tokens are handled server-side; the browser does not receive them.
• Credentials are not intentionally exposed in public-facing responses or public logs.
• Persisted Meta OAuth and Page credentials are stored in encrypted form using a server-held encryption key.
• Access is limited to the operational use required for the authorized integration behavior.
• The OAuth flow is fail-closed: without the required application and encryption configuration, the connection path does not activate.

WAE does not publish tokens, keys, or secrets, and will never ask you to send them.

WAE INTELLIGENCE — GOOGLE / YOUTUBE

This section is the dedicated disclosure for the WAE Intelligence Google / YouTube integration. It describes the Google user data and YouTube channel data WAE may process when a person connects a Google account and authorizes access to a YouTube channel.

GOOGLE / YOUTUBE INTEGRATION — CURRENT STATE

The Google / YouTube connection capability is implemented as integration code and remains activation-gated. WAE's Google Cloud configuration for this integration is not yet established, the OAuth flow is fail-closed until that configuration exists, and no live Google OAuth connection through WAE has occurred to date. WAE does not claim that the integration is live, that Google has verified WAE's application, or that YouTube publishing is enabled.

WAE publishes the disclosures below now so that the privacy commitments exist before the integration is activated — the disclosures describe the implemented and planned capability truthfully, including capabilities that are fail-closed until enabled, authorized, and provider-approved.

Implemented today (integration code and storage law):

• brand-scoped connection records with granted scopes recorded;
• encrypted-at-rest credential storage, refresh tokens stored only in encrypted form;
• a terminal revocation state — a revoked connection never re-activates; and
• a publishing law that restricts unaudited YouTube uploads to private visibility.

Not yet implemented or not yet live:

• the live Google OAuth authorization and token-exchange boundary (fail-closed until WAE's Google Cloud configuration exists);
• WAE's Google Cloud project configuration — no credentials have been created;
• an automated token-revalidation and deletion sweep that enforces the 7-day and 30-day deletion commitments (currently handled through the institutional request channel);
• Google's app verification and brand verification — not applied for and not claimed; and
• the YouTube API compliance audit required before public (non-private) publishing.

GOOGLE / YOUTUBE DATA WAE MAY PROCESS

When the integration is active and a person connects a Google account and authorizes access to a YouTube channel, WAE may process — only to the extent the granted scopes allow:

• Google account identifiers needed to establish and maintain the connection, such as the subject identifier Google returns in token verification;
• the set of granted OAuth scopes and the authorization state of the connection;
• YouTube channel identity and metadata for channels the authorized account controls, including channel identifiers, titles, and the association between a channel and a WAE brand workspace;
• OAuth connection metadata, such as connection identifiers, timestamps, and revocation status;
• access and refresh tokens required for authorized platform operations, handled server-side and stored in encrypted form;
• identifiers and operational records of YouTube upload and publishing requests and results, where uploading is enabled and authorized — including the visibility (privacy status) applied to each upload; and
• outcome and analytics data for published content — for example views, watch time, likes, or subscriber changes — where analytics reading is enabled and supported.

WAE does not, through this integration, collect Google account passwords, private messages, the content of unrelated Google services, or data outside the scopes granted by the person connecting.

WHY WAE PROCESSES GOOGLE / YOUTUBE DATA

• to authenticate and connect a Google account to a WAE workspace;
• to discover the YouTube channels the authorized account controls, so the right channel can be selected and bound to a WAE brand;
• to bind an authorized YouTube channel to exactly one WAE brand workspace (a provider identity is not shared across brands);
• to perform authorized YouTube publishing actions when that capability is enabled and provider approval exists;
• to read YouTube analytics and outcome data for published content, when enabled and supported;
• to secure the connection and enforce authorization and revocation state; and
• for audit, operational troubleshooting, and business records maintenance.

Publishing and analytics reading happen only when enabledand when authorized for the specific channel, and onlywhere the person grants the relevant permission. External publishing from WAE OS is subject to an authorization gate and is not enabled by default.

GOOGLE OAUTH AND TOKEN HANDLING

• OAuth access tokens are handled server-side; the browser does not receive them.
• Stored Google OAuth credentials are encrypted at rest; refresh tokens are stored only in encrypted form.
• The granted scopes are recorded with each connection, and access is limited to the operational use required for the authorized integration behavior.
• Credentials are not intentionally exposed in public-facing responses or public logs.
• The OAuth flow is fail-closed: without the required application and encryption configuration, the connection path does not activate.

WAE does not publish tokens, keys, or secrets, and will never ask you to send them. WAE will never ask for your Google account password.

YOUTUBE PUBLISHING PERMISSIONS AND INDEPENDENT AUTHORIZATION

Connecting a Google account and authorizing a YouTube channel does not by itself enable WAE to publish. Publishing from WAE OS is subject to a governed approval and authorization gate, and each publishing action requires the authorizing user's consent at the time of the action.

YouTube imposes its own independent requirements on applications that publish through the YouTube API, including a YouTube API compliance audit before public publishing. WAE's YouTube publishing capability is therefore limited to private video visibility until the required YouTube API audit is completed and public publishing is authorized. WAE does not claim that YouTube has audited or approved WAE's application, and WAE does not publish without the required authorization.

WAE does not autonomously publish: publication decisions remain governed by human approval inside WAE OS, and the authorizing user retains control over the data published to YouTube.

GOOGLE / YOUTUBE DATA RETENTION AND REFRESH

• connection credentials are retained while the connection is active and needed for the authorized operation;
• WAE periodically reconfirms that stored authorization tokens remain valid, and stops using and addresses stored data for connections whose authorization can no longer be confirmed;
• stored YouTube API data that is not analytics or statistics data is refreshed or deleted on a rolling basis in line with YouTube's 30-calendar-day stored-data policy;
• analytics and statistics data may be kept longer while the authorization remains active, with authorization re-verified at least every 30 days;
• on revocation or disconnection, WAE marks the connection and its credentials as revoked and stops operational use — and follows the deletion commitments in the "Your choices" and Data Rights sections; and
• some records may be retained for audit, security, and legitimate operational purposes, and where retention is required or permitted by applicable law.

GOOGLE / YOUTUBE — YOUR CHOICES AND REVOCATION

You can revoke WAE Intelligence's access to your Google account data at any time through Google's own account controls — the Google security settings page at security.google.com/settings/security/permissions. Google controls that experience and may update it over time.

Where WAE OS exposes a disconnect control for a connected Google / YouTube integration, using it triggers Google-side token revocation and marks the connection disconnected in WAE records. Revoking stops further authorized use; it is not the same as deleting WAE-held records. For deletion, use the Data Rights & Deletion path.

WAE's deletion commitments for Google / YouTube data follow the deadlines YouTube's developer policies require: WAE will delete authorized data associated with a revoked consent as soon as possible and within 7 calendar days when you revoke through a WAE-provided mechanism, and within 30 calendar days when you revoke through Google's security settings page. WAE confirms these commitments operationally by periodically re-verifying stored authorization tokens.

YOUTUBE API SERVICES AND GOOGLE PRIVACY POLICY

WAE uses YouTube API Services in its Google / YouTube integration. In addition to WAE's normal deletion procedure and this policy, use of YouTube-connected features is also subject to YouTube's Terms of Service: www.youtube.com/t/terms.

Google's own handling of data on Google's services is described in the Google Privacy Policy: policies.google.com/privacy. This WAE policy describes WAE's handling of the Google user data WAE receives; it does not describe or change Google's practices.

SERVICE PROVIDERS AND RECIPIENTS

• Cloudflare hosts and delivers the WAE HQ website (Pages, Workers, and related infrastructure) and processes request-level data in that capacity.
• Meta is involved as the connected platform for the WAE Intelligence integration and receives data in that capacity, including publishing actions taken through its APIs.
• Google is involved as the connected platform and OAuth provider for the WAE Intelligence Google / YouTube integration, once activated, and receives data in that capacity — including the authentication handshake and, where enabled and authorized, uploads and publishing actions taken through YouTube API Services.
• WAE's institutional mailbox ([email protected]) is served by WAE's own mail system built on Cloudflare Email Routing; Cloudflare processes the email in that capacity, and inbound messages are archived in WAE's private mail archive.

WAE shares data with these recipients only as necessary to operate the covered services. WAE does not share personal information with advertising partners or data brokers.

SALE, SHARING, AND ADVERTISING STATUS

WAE does not sell personal information or Meta Platform Data. WAE does not share personal information for cross-context behavioral advertising. WAE does not serve third-party advertising cookies on WAE HQ and does not use personal information to build advertising profiles.

RETENTION

WAE keeps data for bounded, purpose-based periods:

• active connection credentials are retained while the connection is active and needed for the authorized operation;
• when a connection is revoked or disconnected, WAE marks the credentials and connection records as revoked and stops operational use of them;
• for Google / YouTube connections, WAE additionally follows the deletion and refresh deadlines disclosed in the dedicated Google / YouTube sections of this policy (7-day deletion on revocation through a WAE-provided mechanism, 30-day deletion on revocation through Google's security settings, and rolling 30-day refresh or deletion of stored API data);
• revocation marking does not by itself mean every WAE-held record is immediately physically deleted — records may be retained for audit, security, and legitimate operational purposes, and where retention is required or permitted by applicable law;
• business correspondence is retained as part of WAE's institutional records while it remains relevant to the relationship and its legal/operational purposes; and
• deletion requests are handled through the path described below.

WAE does not publish a fixed retention schedule because the relevant periods depend on the purpose of each record and on applicable legal obligations. Where a fixed period is not published, none is claimed.

SECURITY PRACTICES

• Persisted OAuth credentials are encrypted at rest with a server-held key, and tokens never reach the browser.
• The site ships restrictive security headers (a closed content security policy, no third-party script origins, and related protections).
• WAE does not publish tokens, keys, or secrets in public output.
• Security reports from good-faith researchers are triaged through the institutional channel described on the Security page.

These statements describe implemented practices, not a guarantee. No system is immune to attack. Security researchers should read the WAE Security & Vulnerability Disclosure Policy atwaehq.com/security/.

YOUR CHOICES: REVOCATION AND DISCONNECTION

You can revoke WAE Intelligence's authorization at any time through Meta's own account and app authorization controls — for example, under the "Apps and Websites" (or Business Integrations) section of your Meta or Facebook account settings, where WAE Intelligence can be removed. Meta's help pages describe the current steps; Meta controls that experience.

Where WAE OS exposes a disconnect control in the workspace console for a connected integration, using it triggers Meta-side permission revocation and marks the connection disconnected in WAE records.

Revoking permissions or disconnecting stops further authorized use — it does not by itself automatically prove physical deletion of every WAE-held record. For deletion, use the path below.

On the WAE HQ website itself there are no accounts, subscriptions, or communications preferences to manage, because the site collects none.

For Google / YouTube connections, revocation works the same way through Google's account controls (Google security settings), with the deletion deadlines disclosed in the dedicated Google / YouTube section above.

DATA RIGHTS AND REQUESTS

Depending on where you are and the law that applies, you may have rights that include the ability to:

• request access to information WAE holds about you or your connection;
• request correction where appropriate;
• request deletion of WAE-held data;
• revoke platform permissions through Meta; and
• contact WAE with privacy questions.

Both the general WAE request path and the WAE Intelligence / Meta path are published on the Data Rights & Deletion page:waehq.com/data-deletion/.

Rights may vary under applicable law. This policy is not a claim of blanket compliance with any specific jurisdiction's privacy statute.

IDENTITY VERIFICATION

Before WAE acts on a request about records that belong to a specific person or account, WAE may need to verify that the requester is that person — or is otherwise entitled to act on those records. Verification may require enough detail to locate the records (for example the account or connection involved and the approximate dates).

WAE will never ask for passwords, access tokens, or other credentials as part of verification, and sending credentials is not a valid way to prove identity.

INTERNATIONAL AND JURISDICTIONAL LANGUAGE

WAE Media, LLC is organized in Delaware, United States, with principal place of business in San Francisco, California, United States, and an official business and mailing address of 2261 Market Street, STE 83934, San Francisco, CA 94114, United States. The covered services are operated from the United States, and information is processed in the locations where WAE and its service providers operate.

If you access the services from another jurisdiction, you understand your information will be processed in those locations. WAE does not claim compliance with any specific foreign privacy statute, and this policy is not a representation of compliance with any particular jurisdiction's law. Where a specific statute's rights are invoked, WAE handles the request through the Data Rights & Deletion path.

AI AND MODEL USE

Public Ask WAE queries are resolved locally in the visitor's browser against a static public evidence corpus. In Production, WAE HQ does not call an AI model provider for public queries, and public query text is not retained by WAE and is not used to train models.

WAE describes its AI-native media production practice on its public AI Production Studio page. That practice is WAE's internal operational use and is not a use of visitor data.

WAE makes no claim about training models on user or visitor data because no such use exists for the covered public services. Where this policy does not state an AI data use, none is claimed.

Specifically: WAE does not use Google / YouTube authorized data to train models, and makes no claim of any such use. Provider data is used for the operational purposes disclosed in its dedicated section, and WAE claims no AI-model training use of it unless a verified, authorized implementation and a valid authorization exist and are disclosed here.

CHILDREN

The WAE HQ website and the WAE Intelligence integration are not directed at children. WAE does not operate a technical age-gate or age-verification mechanism on these surfaces, and this statement is not a claim that one exists.

CHANGES TO THIS POLICY

WAE may update this policy as its services and data practices change. When the policy changes, WAE will update the effective and last-updated dates shown below. WAE does not operate a notification mailing list for policy updates; check this page for the current version.

EFFECTIVE DATE AND CONTACT

Effective: September 21, 2026 · Last updated: October 8, 2026.

Questions about this policy, about WAE's handling of Meta Platform Data or Google / YouTube data, or privacy requests: [email protected].

ABOUT GOOGLE AND YOUTUBE

"Google" and "YouTube" are used on this page as descriptive references to the products and services of Google LLC. WAE's use of Google OAuth and YouTube API Services does not imply that Google or YouTube endorses, approves, or certifies WAE, WAE HQ, or WAE Intelligence. Google controls its own consent experience, its own platform policies, and its own API verification requirements.

ABOUT META

"Meta", "Facebook", and "Instagram" are used on this page as descriptive references to the platform products of Meta Platforms. WAE's use of Meta's OAuth and Graph APIs does not imply that Meta, Facebook, or Instagram endorses, approves, or certifies WAE, WAE HQ, or WAE Intelligence. Meta controls its own permission experience and its own platform policies.