Coherence Auditor — Privacy Policy
Version 1.1
Last updated: October 7th, 2026
This notice explains how WaveAccess USA handles personal data in connection with Coherence Auditor. It is a summary aid and does not replace the sections below.
1. Definitions
1.1. “WaveAccess USA,” “we,” “us,” or “our” means WaveAccess USA, a C-Corporation registered in Nevada, United States, with its principal place of business at 10161 Park Run Drive, Suite 150, Las Vegas, Nevada 89145, United States.
1.2. “Coherence Auditor” means the software repository analysis product operated by WaveAccess USA.
1.3. “Service” means Coherence Auditor and its website at www.coherenceaudit.ai, including the Free Analysis, Results, and public Sample Report.
1.4. “User” or “you” means an individual using the Service or whose personal data is processed in connection with it.
1.5. “Repository Materials” means the source code, tests, documentation, repository structure, and related engineering evidence a User submits or expressly authorizes the Service to access.
1.6. “Free Analysis” means the deliberately limited analysis of Repository Materials available through the Service without payment.
1.7. “Result” means the limited output generated for a Free Analysis, which may include findings, evidence, confidence indicators, summaries, and recommendations.
1.8. “Sample Report” means the anonymized, deliberately incomplete illustrative report publicly available without login or email.
1.9. “Personal data” means information relating to an identified or identifiable individual, including information treated as personal information under applicable privacy law.
2. Scope and Responsibility
2.1. Notice, not contract. This Privacy Policy explains personal-data processing associated with the Service. It is a notice, not a contract. Acknowledging it does not constitute consent to all processing described here.
2.2. Our own purposes. WaveAccess USA acts as controller for personal data it processes for its own purposes, including website operation, Free Analysis request management, marketing-consent management, and security.
2.3. Enterprise repository data. Our role for personal data inside enterprise Repository Materials depends on the processing arrangement. Where WaveAccess USA processes such data on an enterprise customer’s behalf, the customer is responsible for the lawful basis for that processing and any required notices to affected individuals.
2.4. Public access. You do not need an account, login, registration, or Terms acceptance to browse the public website or view the Sample Report. A Free Analysis requires an email address, Terms acceptance, and acknowledgment of this notice. There is no password or email-verification step.
3. Information We Process
3.1. Website and technical information. We process technical and security logs to operate and protect the Service. These logs are kept for a limited period for security and then deleted. No debug or trace export of source code is active.
3.2. Free Analysis information. We process your email address, the repository URL you submit, Repository Materials, and the generated Result. Repositories are submitted by URL, without a token-paste method. The Result is available for approximately 7 days through a cookie/token on your device and is then automatically deleted. Access is bound to that device; no account, password, or email verification is used. Entering your email address on another device does not provide access to the Result.
3.3. Personal data within repositories. Repository Materials may contain contributor names, contributor email addresses, commit metadata, documentation or issue references, and other personal data embedded in source code or repository history. This information may come from someone other than the individual to whom it relates. Repository content is processed transiently as described in Sections 5–8. The Result is not intended to reproduce that personal data.
3.4. Marketing information. If you opt in to product updates and early-access news, we process your email address, marketing preferences, and evidence of your consent and withdrawal.
3.5. Booking information. Booking a 30-minute call is separate from the Free Analysis. If you provide personal data to arrange a call, we use it to handle your request under the same privacy principles described here.
3.6. Privacy correspondence. We process the information you provide when contacting us about your personal data to handle and respond to your request.
4. Purposes and Legal Bases
4.1. European legal bases. Where the GDPR applies, the following bases apply according to the purpose and our role. Where we process enterprise repository content on a customer’s behalf, the customer determines the lawful basis and we process the data under the applicable processing arrangement.
| Clause | Purpose and relevant data | GDPR basis |
|---|---|---|
| 4.2 | Manage your Free Analysis request, analyze Repository Materials, and provide the Result. | Article 6(1)(b), where necessary to provide the service you request as an individual. Where you act for an organization or repository data concerns others and we act as controller, Article 6(1)(f): our legitimate interest in providing the authorized software analysis, subject to the individuals’ rights and interests. |
| 4.3 | Operate and protect the Service using technical and security information. | Article 6(1)(f): our legitimate interest in operating a secure and reliable Service, subject to necessity and the rights and interests of affected individuals. |
| 4.4 | Send optional Coherence Auditor product updates and early-access news. | Article 6(1)(a): consent, together with applicable electronic-marketing requirements. |
| 4.5 | Maintain consent evidence and honor withdrawal. | Article 6(1)(c), where required to demonstrate consent or honor a legal obligation; otherwise Article 6(1)(f), for proportionate evidence of choices and prevention of unwanted marketing. |
| 4.6 | Arrange a requested 30-minute call and handle related information. | Article 6(1)(b), for steps requested by an individual before entering a contract; otherwise Article 6(1)(f), for handling business inquiries, subject to individual rights and interests. |
| 4.7 | Handle privacy requests and correspondence. | Article 6(1)(c), where needed to fulfill applicable legal duties; otherwise Article 6(1)(f), for responding to and keeping proportionate evidence of requests. |
4.8. Required information. Your email address and repository URL are required for a Free Analysis; access to the Repository Materials is necessary to perform it. Without this information, we cannot provide the Free Analysis. Optional marketing consent is not a condition of analysis or Result access.
4.9. Calls and inquiries. If you request a call or send an inquiry, provide enough information for us to respond. Withholding information necessary to handle the request may prevent us from completing it.
4.10. Acceptance is not privacy consent. Accepting the Terms does not make consent the legal basis for processing necessary to provide the requested Free Analysis.
5. Repository and Source-Code Data
5.1. Processing purpose. Repository Materials are processed to evaluate software coherence and change-readiness and produce the requested Result. Content is sent to Anthropic only to generate the analysis and is not shared with any other third party. Hetzner infrastructure in Falkenstein, Germany supports our own application systems. No debug or trace export of source code is active.
5.2. Other individuals’ information. A User submitting Repository Materials must have authority for their submission and processing. Where processing occurs on an enterprise customer’s behalf, that customer is responsible for establishing the lawful basis and providing required notices to contributors and other individuals whose data appears in the materials.
5.3. Allocation of duties. Customer responsibilities do not remove obligations that applicable law places on WaveAccess USA.
5.4. No unrelated reuse. Repository content is never used to train any model and is not used for unrelated marketing or benchmarking. We delete it from our systems promptly once the Result is generated. Anthropic’s separate retention is described in Sections 6–8.
6. AI and Other Recipients
6.1. AI-assisted analysis. We use Anthropic (Claude models) as our AI processor. Anthropic processes and stores data in the United States. On our own systems, repository content is deleted promptly once the Result is generated. Zero Data Retention is not enabled. Anthropic’s commercial terms provide that this content is not used to train its models.
6.2. Hosting and email delivery. The Service runs on Hetzner infrastructure with servers in Falkenstein, Germany. Website and application data are stored in the EU. Transactional and marketing email is delivered through Twilio SendGrid, which processes email data in the United States. Repository content is not sent to SendGrid.
6.3. Responsibility. Use of service providers does not remove WaveAccess USA’s applicable data-protection obligations.
6.4. Repository disclosure limits. Repository content is sent to Anthropic only for analysis and is not shared with any other third party. No debug or trace export of source code is active.
6.5. AI transparency. The interface informs you that you are interacting with an AI-assisted system. The Result is marked as AI-generated in a machine-readable format; it does not name the specific model or provider. AI-generated findings may contain errors. The analysis concerns software artifacts, not automated decisions about individuals, as described in Section 12.
7. International Transfers
7.1. EU hosting and US processing. The core application runs on Hetzner servers in Falkenstein, Germany, and website and application data are stored in the EU. Repository content is transferred to Anthropic for processing and storage in the United States. Email data is transferred to Twilio SendGrid for processing in the United States.
7.2. Transfer safeguards. Transfers of personal data to Anthropic and Twilio SendGrid in the United States rely on the EU Standard Contractual Clauses. EU hosting of the core application does not remove these US transfers.
7.3. Safeguard information. You may request information about the applicable transfer safeguards, including a copy of the Standard Contractual Clauses, by contacting privacy@coherenceaudit.ai. Your requests are answered within the time limits set out in Sections 13 and 15 of this notice. Information may be redacted where necessary to protect confidential information or other persons’ rights.
8. Retention
8.1. Retention periods. We retain personal data according to the purposes and periods below. Deletion from our systems and retention by our AI processor are separate: Repository content is processed by our AI processor (Anthropic) solely to generate your analysis and is never used to train any model. The AI processor may retain the content for a limited period, up to 30 days, for security and misuse-prevention purposes, after which it is deleted. On our own systems, repository content is deleted promptly once the Result is generated.
| Clause | Data category | Period or criteria |
|---|---|---|
| 8.2 | Temporary repository/source content | On our systems, deleted promptly once the Result is generated. Anthropic may retain content in the United States for up to 30 days for security and misuse prevention, after which it is deleted. The content is never used to train any model; Zero Data Retention is not enabled. |
| 8.3 | Generated Free Analysis Result | Available for approximately 7 days through a cookie/token on your device, then automatically deleted. |
| 8.4 | Free Analysis / lead email | Retained until you withdraw consent or request deletion. Providing an email for analysis does not enroll you in marketing or constitute consent to marketing. |
| 8.5 | Technical/security logs | Retained for a limited period for security and then deleted. |
| 8.6 | Marketing-consent evidence | Kept until withdrawal and for a reasonable period afterward to demonstrate and honor your choices. |
| 8.7 | Email used for marketing | Retained until you withdraw consent or request deletion. Marketing stops on unsubscribe or withdrawal; consent evidence is handled as described in Section 8.6. |
| 8.8 | Call/contact information, if provided | Kept only for as long as necessary to handle the request and related correspondence, subject to applicable legal requirements. |
| 8.9 | Privacy-request handling records | Kept only for as long as necessary to handle the request and meet applicable recordkeeping obligations. |
9. Marketing Communications
9.1. Separate choice. The optional, unchecked choice is: “I’d like to receive product updates and early-access news about Coherence Auditor by email.”
9.2. No automatic enrollment. Entering an email for a Free Analysis or acknowledging this notice does not enroll you in marketing. Receiving the Free Analysis is not conditioned on marketing consent.
9.3. Consent evidence. Marketing consent is recorded, including when it was given and what was consented to.
9.4. Withdrawal. You may withdraw marketing consent through the unsubscribe mechanism in marketing emails or by contacting privacy@coherenceaudit.ai. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
9.5. Scope. Consent to Coherence Auditor product updates and early-access news will not silently expand to unrelated marketing categories.
10. Cookies and Similar Technologies
10.1. What we store. Coherence Auditor stores only what is necessary to run the Service on your device. Specifically, we store: (a) an access token that lets you open your generated Result on the same device for a limited period (7 days); (b) your response to the cookie notice; and (c) your display-theme preference (light or dark). All of these are first-party. We do not use analytics, advertising, or cross-site tracking cookies, and we do not share this information with third parties. Because only strictly necessary and functional storage that you request is used, no prior consent is required; if a non-essential technology is ever introduced, we will ask for consent first.
10.2. Cookie Declaration. Further detail is set out in our Cookie Declaration.
11. Security
11.1. Security measures. We use HTTPS/TLS across the website and all flows, host the core application and its stored data in the EU, limit access to personnel and the AI processor who need it to provide the Service, and delete repository content from our systems promptly after analysis. Anthropic’s US processing and retention are described in Sections 6–8.
11.2. Limits. No method of transmission or storage eliminates every risk. This does not limit obligations imposed by applicable data-protection law.
11.3. Personal-data breaches. We notify affected individuals and supervisory authorities of personal-data breaches where applicable law requires it.
12. Automated Processing
12.1. Software analysis. Coherence Auditor’s automated analysis concerns software artifacts. It does not make automated decisions producing legal or similarly significant effects about individuals. GDPR Article 22 automated decision-making is therefore not applicable to this Service as described here.
13. Privacy Rights and Requests
13.1. European rights. Where the GDPR applies, and subject to its conditions and exceptions, you may request access to, correction of, erasure of, or restriction of processing of your personal data.
13.2. Portability. Where applicable, you may receive personal data you provided in a structured, commonly used, machine-readable format and request its transmission to another controller where technically feasible.
13.3. Objection. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time.
13.4. Consent withdrawal. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
13.5. Complaints. You may lodge a complaint with a competent supervisory authority, including in the EEA country of your habitual residence, place of work, or alleged infringement, where applicable.
13.6. How to request. Contact privacy@coherenceaudit.ai or write to WaveAccess USA at the address in Section 18. Identify the right you wish to exercise and provide enough information to locate the relevant data. We may request proportionate information needed to verify a request. GDPR requests are answered within one month, extendable by two further months where permitted for complexity or number of requests; we provide notice and reasons within the first month.
13.7. Enterprise content. Requests relating to Repository Materials processed on an enterprise customer’s behalf will depend on the applicable allocation of responsibilities.
14. European Contacts
14.1. Controller contact. WaveAccess USA may be contacted at privacy@coherenceaudit.ai, by telephone at +1 866 311 2467, or at 10161 Park Run Drive, Suite 150, Las Vegas, Nevada 89145, United States.
14.2. Supervisory authority. You may complain to a competent supervisory authority as described in Section 13.5. Contacting us or the DPO does not limit that right.
14.3. Data Protection Officer. Contact our Data Protection Officer at DPO@wave-access.com.
15. US State Privacy Information
15.1. Applicable state rights. We treat California CCPA/CPRA, Virginia VCDPA, and Nevada privacy requirements as applicable. The rights below are subject to the relevant law’s conditions, verification requirements, and exceptions. Submit requests or appeals to privacy@coherenceaudit.ai. We respond to California, Virginia, and Nevada requests within 45 days, with extensions only as permitted by applicable law and with required notice. Any shorter deadline for a particular right applies.
15.2. Nevada. Covered Nevada consumers may submit a verified request to opt out of covered sales to privacy@coherenceaudit.ai, our designated privacy request address. Inquiries about reviewing or correcting information may also be sent there. Sections 3 and 6 describe information and recipient categories, Section 10 addresses device storage, and Section 17 describes notice changes.
15.3. Sale of personal data. We do not sell personal data.
15.4. California. Rights under the CCPA/CPRA include access to categories and specific pieces of personal information, deletion, correction, portability where applicable, opting out of sale or sharing, limiting qualifying uses or disclosures of sensitive personal information, and freedom from unlawful discrimination for exercising rights. Authorized agents may submit requests subject to applicable verification rules. For requests subject to the 45-day response period, an additional 45 days may be taken where permitted, with timely notice. Shorter deadlines apply to certain opt-out and limitation requests.
15.5. Virginia. Rights under the VCDPA include confirming processing, access, correction, deletion, portability, and opting out of targeted advertising, sale, and profiling for decisions producing legal or similarly significant effects. You may appeal a refusal through privacy@coherenceaudit.ai. A further 45 days may be taken where permitted with notice and reasons. Appeals are answered within 60 days, with information on contacting the Virginia Attorney General if denied.
16. Individuals Under 18
16.1. Intended audience. The Service is for professional and business use and is not intended for individuals under 18. WaveAccess USA does not knowingly collect personal data from children through the Service.
16.2. Contact. If you believe a child has provided personal data through the Service, contact privacy@coherenceaudit.ai.
17. Changes to This Notice
17.1. Updates. We may update this notice by posting the updated version. When we post changes, we identify the "Last Updated" date to this notice. We strongly encourage you to check this notice often to stay informed about our privacy practices. If we make any material changes, we will provide appropriate notice.
17.2. New purposes. Where a new processing purpose requires consent, we will obtain it before beginning that processing. Continued browsing does not constitute consent to materially new consent-based processing.
18. Contact
18.1. Operator. WaveAccess USA
10161 Park Run Drive, Suite 150
Las Vegas, Nevada 89145, United States
18.2. Privacy requests and questions. privacy@coherenceaudit.ai.
18.3. Legal and general inquiries. privacy@coherenceaudit.ai. Tel. +1 866 311 2467.