Privacy Policy

1. Introduction

Gear Wave ("Gear Wave," "we," "our," or "us") values your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share information when you access or use the Gear Wave platform, website, mobile application, and related services (the "Services").

2. Information We Collect

Gear Wave may collect the following categories of information:

2a. Prospect and Business-Contact Information

We maintain records about businesses and business contacts who are not yet Gear Wave users ("prospects"), for the purpose of business-to-business outreach about the platform. Prospect records may include contact identifiers, the source of the information, our communication history with the contact, consent and opt-out status, and automatically generated internal assessments such as engagement scores, inferred interest, and suggested next steps. These assessments are used only to prioritize our own outreach; they are not used to make decisions about credit, employment, insurance, housing, or any other decision with a legal or similarly significant effect. We honor opt-out requests through a suppression list that blocks further outreach across SMS, email, and calling channels, and we retain the minimum record needed to keep honoring the opt-out. Prospects may request access, correction, or deletion of their records at support@gearwaveapp.com.

3. How We Use Information

Gear Wave may use collected information to:

• Create and manage user accounts
• Process payments, security-deposit authorization holds, and Net-15 owner payouts
• Verify user identities through Stripe Identity before the first booking
• Facilitate rentals and in-platform communication
• Operate the Founding-Owner program (matching a user to a U.S. state and metro)
• Improve platform performance and pricing
• Detect fraud, scraping, automated access, and abuse
• Provide customer support and resolve disputes
• Send transactional notifications and, where opted in, marketing updates
• Build preliminary business listings and contact rental businesses about joining the platform
• Draft, prioritize, and schedule our communications using AI assistance, always with human review before sending
• Summarize calls and meetings and record follow-up commitments
• Comply with legal obligations and respond to lawful requests

4. Payment Processing & Deposits

Gear Wave currently uses a third-party payment service provided by Stripe, Inc. ("Stripe"), to process all payments made through the Services, and for related analytics and business services. If you make a payment through the Services, you will receive an email confirmation automatically generated by stripe.com. Any personal information, including credit card and other payment information, that you provide through Stripe's website may be collected by Stripe and by us for purposes of processing the payment, and will be subject to Stripe's privacy policy. Stripe collects identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection. We have no control over, and shall not be responsible for, Stripe's use of information collected through Stripe's website. PLEASE NOTE THAT THIS POLICY DOES NOT ADDRESS THE COLLECTION AND USE OF INFORMATION THROUGH STRIPE'S WEBSITE OR STRIPE'S PRIVACY OR INFORMATION PRACTICES. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy. Subscriptions purchased inside the Gear Wave mobile apps are processed by Apple or Google under their own terms and privacy policies. Gear Wave does not receive your payment card details for those purchases; it receives your subscription entitlement status, plan identifier, renewal and cancellation events, and an anonymous store transaction identifier through its subscription-management provider.

5. Identity Verification

Renters and owners must complete government-ID and selfie verification through Stripe Identity before transacting. The ID image, selfie, and biometric matching data are collected and retained by Stripe under Stripe's privacy policy. Gear Wave receives only the pass/fail result, the verified legal name, and document metadata sufficient to display a verified badge. We do not retain raw ID images on our own servers. Boater-education cards and insurance documentation uploaded through the Gear Wave booking flow are stored by Gear Wave and retained in accordance with our Data Retention & Deletion Policy.

6. Location Data

Gear Wave may collect and use location information to:

• Display nearby rental listings
• Facilitate pickup, delivery, and return coordination
• Match Founding-Owner program claims to the correct U.S. state and metro
• Improve search and marketplace functionality

7. Sharing of Information

Gear Wave may share information with:

• Stripe (payments, Connect payouts, Identity verification)
• Subprocessors used to operate the platform (hosting, email delivery, analytics, customer support tooling)
• The other party to a confirmed booking — limited to first name, last initial, profile photo, verified badge, and the contact channel needed to coordinate pickup and return
• Law enforcement when legally required, or to investigate fraud, scraping, or threats to platform integrity
• A successor or acquirer (and its advisors) in connection with a reorganization, merger, acquisition, financing, or sale of all or substantially all of Gear Wave's assets, in which case users will be notified of any resulting change in ownership or in the use of their personal information

8. Mobile Communications

Gear Wave may send SMS messages to the mobile phone number you provide. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Message and data rates may apply. Reply STOP to opt out and HELP for assistance.

• Verbal opt-in: During a phone conversation with a Gear Wave representative or AI assistant, you will be informed about the types of messages you will receive, message frequency (typically 2–4 messages per month, with additional messages during onboarding if applicable), that message and data rates may apply, and how to reply HELP for assistance and STOP to opt out. You will also be directed to our Terms and Conditions (https://gearwaveapp.com/terms) and Privacy Policy (https://gearwaveapp.com/privacy). You are enrolled only after providing explicit verbal consent.
• Web form opt-in: By completing a form at https://gearwaveapp.com, entering your mobile phone number, and selecting an unchecked consent checkbox, you agree to receive SMS messages. The web form includes message frequency information, message and data rate disclosures, HELP and STOP instructions, and links to our Terms and Conditions (https://gearwaveapp.com/terms) and Privacy Policy (https://gearwaveapp.com/privacy).

8a. Automated Processing of Communications

Messages you exchange with us by SMS, email, or in-platform chat, and messages we draft to send to you, may be processed by artificial-intelligence services to classify the request, summarize the conversation, and propose replies for a Gear Wave team member to review. We use enterprise AI providers under agreements that prohibit using our data to train their general-purpose models. AI output is reviewed by a person before any message is sent. We store message content, timestamps, delivery and failure status reported by carriers or email providers, and, for email, whether a message was opened or a link was clicked. Messages composed outside 7:00 AM to 6:00 PM in your local time zone may be held and delivered inside that window.

8b. Calls, Recording, and Voicemail

If you speak with us by phone, the call may be handled by a Gear Wave team member or by an automated AI voice assistant, and you will be told at the start of the call when an AI assistant is being used. Calls may be recorded and transcribed for quality, training, dispute resolution, and follow-up purposes; where recording requires consent, you will be notified before recording begins and may decline, in which case the call will continue without recording or be transferred to a person. We store call metadata (time, duration, outcome, whether voicemail was reached), recordings and transcripts where made, and AI-generated summaries and suggested follow-ups. You may ask us not to call you at any time by telling the representative or AI assistant, replying STOP to a related text, or emailing support@gearwaveapp.com; we add the number to a suppression list that blocks further outreach.

8c. Scheduled Meetings and Meeting Intelligence

When you schedule a meeting with us, our scheduling provider collects the information you submit (name, email, phone number, time zone, and your answers to any scheduling questions) and shares it with us so we can prepare for and hold the meeting. Video meetings may be recorded and transcribed by the conferencing provider, and participants are notified in the meeting when recording begins. We retrieve the transcript, and in some cases the recording, and use AI services to produce a written summary, a list of topics and questions discussed, commitments made by each side, and suggested follow-up items. These outputs are stored with your contact record and used to serve your inquiry and improve our follow-up. If you do not want a meeting recorded or analyzed, tell us before or at the start of the meeting and we will disable recording. You may request a copy or deletion of a meeting summary at support@gearwaveapp.com.

9. Data Security

Gear Wave maintains a written information-security program with administrative, technical, and physical safeguards designed to protect personal and commercial information. Current controls include:

• Encryption in transit using TLS 1.2 or higher for all client-server, server-server, and webhook traffic.
• Encryption at rest for database, object storage, and backup media, with integration credentials encrypted using AES-256-GCM under a dedicated application key.
• Authentication controls including breach-corpus password screening — user passwords are checked against the Have I Been Pwned breach corpus and rejected if found compromised.
• Row-level security enforced at the database layer on all user-scoped tables, restricted service-role access, principle-of-least-privilege IAM, and audit logging on privileged operations.
• Physical security controls limiting access to any premises where sensitive data is processed; production servers and data centers are operated by the underlying cloud provider and access is limited to authorized personnel only.
• Annual review of vendor sub-processors, the suppression and unsubscribe pipeline, and incident-response runbooks.

10. Where Information Is Stored

Gear Wave stores personal information in the United States. Service providers may process information on Gear Wave's behalf in other jurisdictions, subject to contractual safeguards consistent with this Policy.

11. User Responsibilities

Users are responsible for:

• Maintaining account confidentiality and not sharing login credentials.
• Using a strong, unique password that has not been reused on other services; Gear Wave will reject passwords known to appear in public breach corpora.
• Enabling two-factor authentication on the email address associated with their Gear Wave account.
• Providing accurate information and keeping contact details current.
• Not sharing their verified identity, government ID, or Stripe Identity session with another person.
• Promptly reporting any suspected unauthorized access to support@gearwaveapp.com.

12. Cookies & Tracking Technologies

Gear Wave may use cookies, analytics tools, and similar technologies to improve user experience, analyze traffic, attribute partner referrals, and personalize content. These technologies include analytics services (such as Google Analytics) and tracking links or codes used to attribute partner and affiliate referrals. Users can limit cookies through their browser settings and can opt out of Google Analytics using Google's opt-out tools; disabling cookies may affect platform functionality.

13. Data Retention

Gear Wave retains, stores and uses personal information for the least amount of time necessary for its relationship with users and to provide access to its Services, and in accordance with its data retention policies and applicable law.

14. User Rights

Depending on applicable law (including the CCPA/CPRA for California residents), users may have rights to: The Gear Wave platform is offered only in the United States. Requests to exercise these rights may be submitted by email to support@gearwaveapp.com or through the request form at www.gearwaveapp.com/privacy. Gear Wave will verify requests using information associated with the account and will not discriminate against any user for exercising rights available under applicable law. An authorized agent may submit a request on a user's behalf with written authorization.

• Access personal data we hold about them
• Request corrections to inaccurate data
• Request deletion of data (subject to legal-retention requirements)
• Opt out of certain communications and the "sale" or "sharing" of personal information as defined under California law (we do not sell personal information)

14a. Automated Scoring and Profiling

We generate internal scores and inferences — such as lead scores, conversation health scores, inferred intent, and sentiment — to prioritize our own outreach and support work. These outputs are advisory to our team, are not used for automated decision-making that produces legal or similarly significant effects, and are never used for credit, employment, insurance, housing, or eligibility decisions. You may request access to, correction of, or deletion of these internal assessments at support@gearwaveapp.com.

15. Children's Privacy

The Services are not intended for individuals under the age of 18. We do not knowingly collect information from minors. If we learn that we have collected personal information from a minor, we will delete it.

16. Third-Party Services

The platform may contain links or integrations with third-party services (Stripe, Mapbox, email providers, and others). Gear Wave is not responsible for the privacy practices of third parties.

16a. Service Providers and AI Subprocessors

Categories of providers we rely on include: payments and identity verification (Stripe); cloud hosting, database, and storage; email delivery and deliverability tooling; SMS and voice telephony; conferencing and scheduling (Calendly, Google Workspace and Google Meet, Zoom); transcription; and AI model providers used for classification, summarization, and drafting. Our agreements with AI and transcription providers prohibit the use of Gear Wave data to train their general-purpose models. A current list of subprocessors is available on request at support@gearwaveapp.com.

17. Changes to This Policy

Gear Wave may update this Privacy Policy periodically. Material changes will be communicated by email or in-app notice. Continued use of the platform after the effective date of an update constitutes acceptance.

18. Contact Information

Questions regarding this Privacy Policy may be directed to Gear Wave at support@gearwaveapp.com — www.gearwaveapp.com