What we do with your information.

What we collect

• What you send us. If you use the contact form or email us, we receive the details you give: your name, email address, business or organization, city or town, website address, and your message. When you submit the contact form, those details, plus the email address and optional phone number you give us, are sent to our business email inbox so we can reply. This website does not keep its own copy of form entries.
• Basic technical data. Our hosting provider, Vercel, may record technical details of each visit, such as IP address, browser type and the pages requested, to keep the site running and secure.

This site does not use advertising, tracking cookies or analytics tools at this time. If that changes, we will update this page first.

How we use it

• To reply to you and prepare a concept for your website.
• To run and protect this website.

We do not sell your information or share it for advertising.

Who else sees it

Service providers that help us run the site or handle email, such as our hosting and email providers, may process information on our behalf. We may also share information if the law requires it.

How long we keep it

We keep emails and project details for as long as we need them to work with you and to keep normal business records. You can ask us to delete your information at any time, and we will unless we are required to keep it.

Your choices

You can ask to see, correct or delete the information we hold about you, or ask us to stop contacting you.

Children

This website is for businesses and organizations. It is not directed at children under 13, and we do not knowingly collect their information.

Changes

If we change this policy, we will post the new version here with a new date.

Contractor program

This section was added on October 26, 2026. It covers people who apply to sell for Waylii and people who become contractors. The sections above still describe the public website and customer inquiries. The contractor wording is pending review by our attorney.

What applicants and contractors give us. An application can include a name, email, phone number, city and state, availability, why the person is interested, confirmation that they are 18 or older, and confirmation that they read this policy. After approval, a contractor signs in with a username and password and sets up a Google Authenticator code. We store a password hash, an encrypted authenticator secret, hashed recovery codes, and session records. Onboarding can include an independent-contractor agreement and electronic signature, a Form W-9 and taxpayer identification number, contact details, date of birth, and payout details (direct deposit, PayPal, or Zelle). We also keep training progress, which version of this policy was acknowledged, and the time of those submissions. A one-way hash of the IP address is stored with the submission. The raw IP address is included inside the encrypted signature and form record, not in a separate readable field.

Why we need it. We use application information to decide whether to approve someone. We use the agreement, contact details, and account records to contract with the person and to run the contractor account. We use the W-9, taxpayer identification number, and payment records because tax law can require Form 1099-NEC, backup withholding, and related filings. We use payout details to pay commissions the contractor has earned. We use sign-in, authenticator, IP-hash, and timestamp data to protect the accounts and to show when a form was signed. Date of birth, name, address, and Social Security number are also what Iowa may require if a Centralized Employee Registry report is filed.

How the sensitive answers are stored. Application answers, the W-9 including the taxpayer identification number, payout details, and the signed agreement are encrypted in the browser with the owner’s public key before they are sent. The server stores that ciphertext. Only the owner, using a private key that is not stored on the server, can decrypt it. The username and the email address used to sign in are kept in a form the server can read, because the account cannot work without them. The approval email is sent to the email address the owner reads from the decrypted application.

Who else sees it. We do not sell contractor information. We share it with the IRS and the Iowa Department of Revenue when a filing or a tax obligation requires it. If Iowa Code chapter 252G requires a contractor report, that report goes to the Iowa Centralized Employee Registry. Companies that process this program for us are Vercel (hosting and storage of the encrypted records), Resend (email), and Cloudflare Turnstile (the bot check on the sign-up form). They process that information for those jobs.

How long we keep it. W-9 and payment records are kept for at least four years after the last tax filing that uses them. IRS Publication 1099 tells filers to keep copies of information returns for at least three years from the due date, and for four years when federal withholding, including backup withholding, was imposed. We use the longer period for these records, and we do not delete a stored W-9 from the contractor tools. A rejected application’s encrypted answers are deleted after 12 months. The reference number and the decision can remain. Sign-in and training records are kept while the account exists and as long as we need them for security or for a tax or legal duty.

Access, correction, and deletion. You can ask to see, correct, or delete contractor information we hold about you. We will do that where the law allows. We may keep information we are required to keep, including W-9 and payment records for the period above. Email hello@waylii.services and include the application reference or username if you have it.

If information is breached. If a breach of security involves personal information covered by Iowa Code chapter 715C, we will notify affected Iowa residents in the most expeditious manner possible and without unreasonable delay, consistent with that chapter, including any delay a law-enforcement agency requests in writing. Notice will describe the breach, the approximate date, the type of information, how to reach consumer reporting agencies, and that suspected identity theft can be reported to local law enforcement or the Attorney General. If notice goes to more than 500 Iowa residents, we will also notify the Iowa Attorney General as that chapter requires. A written determination that there is no reasonable likelihood of financial harm, when the statute allows it, is kept for five years. Encrypted data is personal information under that chapter if the key needed to read it is also acquired in the breach.

Contact

Questions or requests: hello@waylii.services