Privacy Policy

Waypoint Eight LLC

Effective Date: May 28, 2026 Last Updated: May 28, 2026

1. Introduction

Waypoint Eight LLC ("Waypoint Eight," "we," "us," or "our") operates the website located at https://waypointeight.com (the "Site") and provides managed virtual assistant services that match United States–based founders and service-business owners with vetted, dedicated assistants located in the Philippines, supported by account management and backup coverage (collectively, the "Services").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the rights and choices available to you. It applies to two distinct groups of people:

• Prospective and current clients who visit our marketing Site, submit inquiries, use our interactive tools (such as our ROI calculator and pricing configurator), download resources, or book calls with us; and
• Virtual assistant candidates and applicants who use the careers area of our Site (pages under /careers/) to register an account, complete an application, and go through our assessment and verification process.

Because Waypoint Eight is established in the United States and processes the personal information of individuals located in both the United States and the Philippines, this Policy is designed to comply with United States federal and state privacy laws as well as the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations ("DPA"). Where the laws of these jurisdictions differ, we apply the standard that provides the greater protection to you.

Please read this Policy carefully. By using the Site or submitting personal information to us, you acknowledge that you have read and understood it. If you do not agree with our practices, please do not use the Site or submit information to us.

This Policy covers the Site at waypointeight.com and the Services described above. Separate Waypoint Eight properties that operate on their own deployment (for example, fatum.waypointeight.com) may be governed by their own privacy policies, and this Policy does not extend to those separate properties except where they expressly adopt it.

2. Who Is Responsible for Your Information (Controller / Personal Information Controller)

Waypoint Eight LLC is the entity responsible for the personal information described in this Policy. Under United States law we act as a "business" or "controller," and under the Philippine DPA we act as a "Personal Information Controller."

Privacy and data protection contact. We have designated a contact responsible for overseeing data protection matters and for handling privacy requests and concerns, including those of data subjects in the Philippines. You may reach our data protection contact — including to exercise any of the rights described in Section 12, to ask a question about this Policy, or to raise a concern — by email at Loading contact… or by mail at the address in Section 18. We will route your message to the person accountable for our data protection compliance and respond within the timeframes required by applicable law.

3. The Personal Information We Collect

We collect different categories of personal information depending on whether you are a prospective client or a virtual assistant candidate. We have organized this section accordingly so you can see exactly what applies to you.

3.1 Information We Collect From Prospective Clients

When you interact with our marketing Site, we may collect the following:

• Identity and contact information: your name, email address, and phone number.
• Business information: your company name, industry, and team size.
• Free-text content you provide: the messages, inquiries, pain points, and challenges you describe in our contact and qualification forms.
• Sales-qualification information: the role you are looking to fill, your budget band, your level of decision-making authority, and your timeline.
• Marketing consent records: when you agree to receive marketing communications, we record proof of that consent, including a timestamp, the version of the consent language you agreed to, your IP address, and your browser user-agent string.
• Interaction and lead-scoring data: inputs you enter into our ROI calculator and the choices you make in our pricing configurator, and actions such as downloading a PDF resource. This information is tied to an anonymous session identifier and is stored as telemetry for lead-scoring purposes. It is not a full record of your browsing history.
• Billing and payment information (engaged clients only): if you enter a paid engagement with us, we collect billing details such as your billing name, billing contact information, and the records of invoices and payments associated with your account. Card and bank-account details are entered into and processed by our payment processors (Stripe and QuickBooks Payments); we do not store full payment-card numbers ourselves. See Section 8 for more about these processors.

The public Site itself has no checkout or e-commerce function, so simply browsing the Site, submitting a lead form, or using our tools does not require or collect any payment information. We do not collect mailing or shipping addresses from clients. Payment is collected only from clients who enter a paid engagement, and is handled by invoice through our payment processors as described above.

3.2 Information We Collect From Virtual Assistant Candidates and Applicants

If you apply to become a virtual assistant through the careers area of our Site, we collect substantially more information, including categories that are legally "sensitive." We collect:

• Account credentials: your email address and a password (stored only in hashed form), and, if you enable two-factor authentication, an encrypted time-based one-time-password (TOTP) secret.
• Profile information: your display name, phone number (stored encrypted), city and country, date of birth, sex, and availability details (hours per week, start date, and time zone).
• Employment history: prior employers, roles, dates of employment, and descriptions of your work.
• Government and identity documents: government-issued identification, NBI clearance, your résumé, an optional barangay document, and a headshot. These are stored encrypted in private storage.
• Voice sample: an audio recording you create in your browser.
• Work-style simulation results: the name and email you provide when beginning the assessment, together with your results.
• Workspace-verification data: device and browser metrics such as available RAM, number of CPU threads, screen size, operating system, connection hints, and internet speed-test results; your attestations; and your user-agent.
• Consent records: versioned copies of the legal text you agreed to, together with your IP address and user-agent in hashed form.

Sensitive information notice. Several of the categories above — your government-issued identifiers, NBI clearance, date of birth, sex, and your voice recording (which is a biometric identifier) — are treated as "sensitive personal information" under the Philippine DPA and as "sensitive data" under several United States state privacy laws. We process this information only for the recruitment, verification, placement, and account-security purposes described in this Policy, only with your consent or another lawful basis, and we apply heightened security safeguards to it. We do not use sensitive information for advertising, and we do not sell it.

3.3 Information We Collect Automatically From Everyone

Regardless of who you are, when you visit the Site we may automatically collect:

• An anonymous session identifier used to operate features such as the ROI calculator, the assessment flow, and the workspace audit.
• A lead-scoring event buffer that temporarily records in-session interactions.
• Aggregate traffic data from our privacy-focused analytics provider (Cloudflare Web Analytics), where enabled. This produces aggregate metrics about Site usage and does not build advertising profiles about you.
• Consent metadata (IP address and user-agent) captured at the moment you submit a form, so we can demonstrate the consent you provided.

Section 7 explains the specific cookies and similar technologies we use.

4. How We Collect Your Information

We collect personal information in three ways: directly from you, automatically as you use the Site, and from a small number of service providers acting on our behalf.

Directly from you. Most information comes from you when you complete one of our forms or flows. The following table maps each collection point to what is gathered.

Automatically. As described in Section 3.3, we collect anonymous session identifiers, ROI and pricing interaction logs, an analytics beacon (where enabled), and consent metadata at the point of form submission.

From service providers. Certain providers that operate parts of the Site on our behalf (for example, our scheduling and bot-protection tools) collect information directly through their embedded components, which they then make available to us. Section 8 lists these providers.

We confirm that the Site has no purchase or checkout flow and no standalone newsletter-subscription form. Marketing consent is gathered together with our inquiry and qualification forms rather than through a separate newsletter signup.

5. Why We Use Your Information (Purposes and Lawful Bases)

We use your personal information only for purposes that are specified, legitimate, and consistent with this Policy. The Philippine DPA requires us to identify a lawful basis for each processing activity, and the table below does so. Where we rely on consent, you may withdraw it at any time as described in Sections 11 and 12.

We will not use your personal information for a new, materially different purpose without first updating this Policy and, where the law requires, obtaining your consent.

6. Marketing Communications and Your Consent

We send marketing communications only to people who have opted in to receive them. We collect this opt-in consent through a required consent checkbox on our contact form and our smart-qualification flow. By checking that box, you agree that Waypoint Eight may contact you by phone call, text message, and email with marketing and promotional information. This is first-party outreach from Waypoint Eight only; we do not share your contact details with third parties for their own marketing.

Downloading a free resource does not subscribe you to marketing. When you download a lead-magnet resource (such as our time audit or delegation checklist), we collect your name, email, and industry solely to deliver that resource. These downloads do not include a marketing-consent checkbox and do not, on their own, sign you up for marketing communications.

We do not operate a separate newsletter or bulk-email marketing list, and there is no standalone newsletter-subscription form on the Site.

When you provide marketing consent, we record the consent language you agreed to, the version of that language, and the time and technical metadata of your agreement, so that we can demonstrate your consent if asked.

For United States recipients, marketing calls and texts are subject to the Telephone Consumer Protection Act (TCPA) and related rules. By providing your phone number and checking the consent box, you give your prior express consent to receive marketing calls and texts, including messages that may be sent using automated technology. Consent to receive marketing messages is not a condition of engaging the Services. Message and data rates may apply, and message frequency varies.

You can opt out at any time. You may reply STOP to any marketing text message, use the unsubscribe link in any marketing email, or — at any time and for any channel — email Loading contact… to be removed from our marketing outreach. We honor opt-out requests received through any of these methods. After you opt out, we may still send you non-marketing messages that are necessary to provide a service you requested or to respond to your inquiry.

7. Cookies and Similar Technologies

We use a limited set of cookies and similar storage technologies, most of which are strictly necessary to operate the Site. We do not use advertising cookies, cross-site tracking pixels, or third-party advertising tags.

First-party cookies.

• wp8_applicant_session — keeps an applicant signed in to the careers area.
• wp8_applicant_mfa_pending — manages the two-factor authentication step during sign-in.

Browser storage (not traditional cookies).

• sessionStorage: anonymous session identifiers for the ROI calculator, the assessment, and the workspace audit; the lead-scoring event buffer (wp8-session-events); and Cal.com prefill data after qualification.
• localStorage: your light/dark theme preference.

Third-party technologies.

• Cloudflare Web Analytics (static.cloudflareinsights.com/beacon.min.js), where enabled, collects aggregate, privacy-focused traffic metrics without building advertising profiles.
• Cloudflare Turnstile provides bot protection on our lead, contact, and ROI-download forms.
• Cal.com powers our inline scheduling embed and may set its own cookies and collect its own data when you book, governed by Cal.com's own privacy policy.

Because the cookies we set are either strictly necessary or privacy-preserving, the Site functions without an advertising-consent banner. You can control or delete cookies through your browser settings, though disabling strictly necessary cookies may prevent parts of the Site (such as the applicant area) from working.

8. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral or targeted advertising (see Section 9). We share personal information only in the limited circumstances below.

8.1 Service Providers Who Process Data on Our Behalf

We rely on a small number of vendors ("service providers" or, under the Philippine DPA, "Personal Information Processors") who process personal information solely to perform services for us under contract. They are not permitted to use your information for their own purposes.

Infrastructure and primary data storage.

• Cloudflare hosts the marketing Site (Cloudflare Pages), our admin Worker, our D1 database, KV cache, and R2 object storage (which holds applicant documents, voice recordings, and backups), and provides Turnstile bot protection and, where enabled, Web Analytics. Most visitor and applicant data resides within Cloudflare's infrastructure.

Communications and scheduling.

• Resend delivers our transactional and outreach emails, including contact and lead fallbacks, applicant verification, password resets, placement outreach, and deletion and export notices. Recipient names, email addresses, and message content pass through Resend. If email engagement tracking (such as link-click tracking on links.updates.waypointeight.com) is enabled on our sending domain, Resend may record opens and clicks for our own email-performance purposes. This is email-engagement measurement, not advertising retargeting.
• Pumble receives internal team alerts when a lead is submitted (for example, through the contact form, smart qualification, a workflow session, the ROI fallback, or simulation completion). These alerts include the lead's details, such as name, email, phone, inquiry content, and consent metadata.
• Cal.com provides the scheduling embed used in our discovery and placement flows. When you book, your name, email, and booking details are collected and processed within Cal.com, which may connect to calendars configured in our Cal.com account (for example, Google Calendar). Your use of the scheduler is also governed by Cal.com's own terms and privacy policy.

Payments and billing.

• Stripe and QuickBooks Payments process payments and billing for clients who enter a paid engagement. When you pay an invoice or set up recurring billing, your payment-card or bank-account details are provided to and processed by these processors under their own terms and privacy policies; we receive transaction confirmations and retain invoice and payment records for accounting, tax, and account-management purposes. We do not store full payment-card numbers ourselves. These processors are used for billing engaged clients and are not part of the public-facing Site, which has no checkout.

Backup and secondary storage.

• Namecheap (cPanel hosting) receives weekly encrypted backup archives — CSV exports of leads, applicants, and related records — for disaster recovery only. This environment is not used to serve the live Site.

Content and operations (limited or no visitor personal information).

• Tina Cloud and GitHub power the blog content-management system used by our operators at /blogadmin/. Blog content is stored and synced through these tools; they do not receive visitor or lead data.
• Frankfurter API is queried only for the public USD-to-PHP exchange rate. No personal information is sent to it.

Internal administrative access.

• Cloudflare Zero Trust Access protects our administrative subdomain (admin.waypointeight.com) and authenticates staff identities by email one-time passcode. It governs operator access, not public-visitor data.

Tools we do not use. For the avoidance of doubt, the public Site does not integrate an on-site checkout or e-commerce function (payment for engaged clients is handled by invoice through the processors named above, not collected on the Site), and we do not use CRM or marketing-automation platforms (such as HubSpot or Mailchimp), shipping or logistics tools, or any advertising networks, pixels, or tags (such as the Meta/Facebook Pixel or Google Analytics or Google Ads tags).

8.2 Other Disclosures

We may also disclose personal information:

• To comply with the law — in response to a lawful request by a public authority, subpoena, court order, or other legal process, or where disclosure is necessary to comply with a legal obligation.
• To protect rights and safety — where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a security incident.
• In a business transfer — in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be transferred as part of that transaction, subject to this Policy.
• With your direction or consent — when you ask us to share your information, such as presenting your candidate profile to a prospective client placement.

9. Sale of Information and Targeted Advertising

We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), and under other United States state privacy laws.

Specifically:

• We do not sell personal information to third parties.
• We do not disclose personal information to advertising platforms or data brokers for targeted or cross-context behavioral advertising. We do not use the Meta/Facebook Pixel, Google Ads tags, remarketing pixels, or similar technologies.
• The service providers listed in Section 8 receive personal information only to provide their contracted services to us — not for their own advertising.

In the interest of full transparency, please note that: when you book through Cal.com, you provide information directly to Cal.com under its own policies; if email-engagement tracking is enabled, Resend may record email opens and clicks for our internal email-performance measurement (not advertising); and Cloudflare Web Analytics, where enabled, collects only aggregate traffic metrics and is not an advertising tool. Our collection of your consent to receive first-party marketing from Waypoint Eight is outreach by us and is not a "sale" of your information.

Because we do not sell or share personal information for these purposes, there is no need to act on Global Privacy Control or similar opt-out preference signals to stop such activity; nonetheless, we honor recognized opt-out signals to the extent any future processing would require it.

10. International Data Transfers

Waypoint Eight operates across the United States and the Philippines, and our service providers may process data in the United States and other countries. As a result, your personal information may be transferred to, stored in, and processed in a country other than the one in which you reside, including the United States.

For individuals in the Philippines, this means your personal information may be transferred to and processed in the United States and other jurisdictions whose data-protection laws may differ from those of the Philippines. We remain accountable for personal information that is transferred to and processed by our service providers, and we use contractual and technical safeguards intended to protect it in accordance with the Philippine DPA.

By using the Site and providing your information, you understand that your information will be processed as described in this Policy, including these international transfers.

11. Data Retention

We keep personal information only for as long as necessary to fulfill the purposes described in this Policy, to provide the Services, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When personal information is no longer needed, we delete it or render it anonymous. The periods below describe how we approach retention for each category.

Client inquiry and lead information. We retain client inquiries and leads for as long as needed to respond to you and to pursue and manage the business relationship. As a general retention target, we aim to keep lead records for approximately twenty-four (24) months and ROI and interaction analytics for approximately twelve (12) months, after which they are reviewed for deletion. You may ask us to delete your information sooner, as described in Section 12.

Marketing consent and opt-out records. We retain records of marketing consent and of opt-out requests for as long as we conduct marketing and for a period afterward sufficient to demonstrate compliance. For United States marketing-message rules, this is generally at least four (4) years.

Applicant account and application information. Retention of applicant data depends on the status of the application:

• Applicant-requested deletion. When you request deletion of your applicant data, we place it in a quarantine state for seven (7) days and then permanently erase it.
• Rejected or inactive applicants. Rejected and inactive applicant profiles follow a scheduled deletion process, with advance warning emails sent before erasure (generally at thirty (30) days, then again shortly before deletion). Rejected profiles may be held for up to approximately one (1) year before scheduled deletion.
• Hired or engaged accounts. If you are hired or engaged, your account is retained for a longer period to support the working relationship and to meet record-keeping and legal obligations, and self-service deletion is not available for these accounts while the engagement is active.

This includes sensitive documents and voice recordings, which follow the same status-based schedule and are deleted when the applicable period ends.

Anonymous session and lead-scoring telemetry. This data is short-lived and is retained only as long as needed for its in-session and lead-scoring purpose.

Encrypted backup archives. Encrypted backups are retained on a rolling basis for disaster recovery. When personal information is deleted from our primary systems, residual copies may persist in encrypted backup storage for up to ninety (90) days before they are overwritten or deleted in the ordinary course of our backup cycle.

If you would like more specific information about how long we keep a particular category of data, please contact us at Loading contact….

12. Your Privacy Rights and How to Exercise Them

Depending on where you live, you have rights over your personal information. We honor the rights described below for the residents to whom they apply, and as a matter of practice we try to make these rights available to everyone who interacts with us.

12.1 Rights of United States Residents

If you are a resident of a United States state with a comprehensive privacy law — currently including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — you may have the right to:

• Know and access the personal information we have collected about you, and obtain a copy of it in a portable format;
• Correct inaccurate personal information;
• Delete the personal information we hold about you, subject to legal exceptions;
• Opt out of the sale of personal information, of targeted advertising, and of certain profiling — though, as explained in Section 9, we do not engage in these activities; and
• Be free from discrimination for exercising your rights.

Where we process sensitive data, applicable state laws may give you the right to limit that processing; we already restrict our use of sensitive information to the purposes described in this Policy.

For California residents specifically, in addition to the rights above, you have the right to request disclosure of the categories of personal information we collected, the sources, our business purposes for collecting it, and the categories of third parties to whom we disclose it — all of which are described in this Policy. California's "Shine the Light" law also permits California residents to request information about disclosures to third parties for their direct-marketing purposes; we do not make such disclosures.

12.2 Rights of Philippine Residents

If you are in the Philippines, the Data Privacy Act of 2012 gives you the right to:

• Be informed about how your personal data is processed;
• Access your personal data and obtain information about its processing;
• Object to processing, including processing for direct marketing;
• Rectify inaccurate or erroneous data;
• Erase or block your data under the circumstances allowed by law;
• Data portability, where applicable, to obtain and transfer your data in an accessible format;
• Withdraw consent at any time where processing is based on consent;
• Damages for violations of your rights under the DPA; and
• Lodge a complaint with the National Privacy Commission (see Section 16).

12.3 How to Make a Request

To exercise any of these rights, email us at Loading contact…, or, if you are an applicant, use the data-export or deletion options available through your account support flows. To protect your information, we will take reasonable steps to verify your identity before acting on your request — for example, by confirming control of the email address associated with your information. You may use an authorized agent to submit a request on your behalf where the law permits, subject to verification.

We will respond within the timeframe required by the applicable law. If we decline a request, we will explain why, and you may appeal our decision where the law provides an appeal right, by replying to our response. There is no fee for a reasonable request, although we may charge a reasonable fee or decline requests that are excessive, repetitive, or manifestly unfounded, as the law allows.

13. Children's Privacy

Our Site and Services are intended for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18 years of age.

Children under 13. Our Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in any part of the Site. If we learn that we have collected personal information from a child under 13 without the required parental consent, we will delete it as required by the United States Children's Online Privacy Protection Act ("COPPA") and its implementing rule. We note that COPPA, as recently amended, specifically treats biometric identifiers such as voiceprints, along with government-issued identifiers, phone numbers, and audio recordings, as children's personal information when collected from a child under 13 — categories our careers area would otherwise collect — which is one reason we restrict our careers area to adults, as described below.

The client side of the Site. Our marketing and inquiry pages are intended for adult business decision-makers. While these pages do not impose an age gate on contact or lead forms, the Services and the content of the Site are not directed to children.

The careers area (applicants). To register as a virtual assistant candidate, you must be at least 18 years old. Our system validates the date of birth you provide and will reject an application that indicates an age under 18. We do not knowingly permit minors to register as candidates, and we do not knowingly collect the application information described in Section 3.2 — including government-issued identification and voice recordings — from anyone under 18.

If you are a parent or guardian and believe that a person under 18 has provided us with personal information, please contact us at Loading contact… and we will review the matter and delete the information as required by law.

14. How We Protect Your Information

We maintain organizational, physical, and technical safeguards designed to protect personal information against unauthorized access, loss, misuse, and alteration. These measures include:

• Encryption of sensitive applicant data — including phone numbers, two-factor authentication secrets, government and identity documents, headshots, and voice recordings — in private storage, and encryption of our backup archives;
• Hashing of passwords and of the IP-address and user-agent data stored with consent records, so that they are not kept in plain readable form;
• Two-factor authentication available to applicant accounts;
• Access controls, including a Zero Trust gateway that restricts administrative access to authenticated staff; and
• Bot protection on our forms to deter automated abuse.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law, including the breach-notification requirements of the Philippine DPA and applicable United States state laws.

15. Third-Party Links and Embedded Services

The Site may contain links to, or embed components from, third-party websites and services (for example, the Cal.com scheduling embed). When you interact with these services, the third party may collect information from you under its own privacy policy, which we do not control. We encourage you to review the privacy policies of any third-party services you use. This Policy applies only to information collected by Waypoint Eight.

16. Filing a Complaint

If you have a concern about how we handle your personal information, please contact us first at Loading contact… so we can try to resolve it.

You also have the right to complain to a regulator:

• Philippines. You may lodge a complaint with the National Privacy Commission (NPC). Information about the complaints process is available at the NPC's official website, https://privacy.gov.ph.
• United States. You may contact the attorney general of your state. California residents may also contact the California Privacy Protection Agency, and consumers generally may contact the Federal Trade Commission at https://www.ftc.gov.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or the law. When we make material changes, we will revise the "Last Updated" date above and, where appropriate or required, provide a more prominent notice. We encourage you to review this Policy periodically. Your continued use of the Site after an updated Policy takes effect constitutes your acknowledgment of the changes, to the extent permitted by law.

18. How to Contact Us

If you have any questions, requests, or concerns about this Privacy Policy or our handling of your personal information, please contact us: