PRIVACY · CLOUD BETA 0.3.0

Your feedback,
shared deliberately.

Effective 15 October 2026. This policy covers the MarkupRelay website, browser extension, account service and agent connections, operated by Next Wave Technologies for software development, IT services and trade, Croatia, EU. Contact support@nwavecloud.com.

Local notes and explicit sharing

The extension stores notes in browser-local storage. It captures the page title and URL without query strings or fragments, your written request, selected element identifiers and locators, nearby text, bounded DOM excerpts, styles, bounds and viewport details. Optional screenshots capture the visible target. Form values and marked private subtrees are excluded where supported; surrounding page text and images may still contain personal or confidential information. Review everything before sharing.

Only when you choose Share with agents is that session uploaded over HTTPS to your MarkupRelay account on Next Wave hosting in Germany. Shared edits subsequently synchronize. Unshared notes are not uploaded. The service stores shared page evidence and agent implementation results, scoped to your account. We do not sell annotations, use them for advertising or intentionally send them for model training.

Agent connections

You authorize each coding-agent connection through account sign-in and an explicit permission screen. Authorized agents can list and read shared sessions and optional images and record results. They cannot access unshared browser notes. Your agent provider may process retrieved content under its own terms and settings. Stop sharing or revoking a connection cannot recall content already retrieved, exported or retained in an agent conversation.

Accounts, billing and service providers

Local Free notes and exports need no account. Cloud sharing and Pro require an email account. We store your email, account identifier, hashed session/login credentials, browser installation identifiers, hashed connection/refresh credentials, authorization grants, Stripe customer/subscription references and state, withdrawal requests and transactional email delivery records. OAuth client registration stores client names and callback URLs. Rate-limit hashes and infrastructure access/security records help operate and protect the service.

SMTP2GO processes recipient addresses and requested sign-in, purchase and withdrawal-confirmation emails for delivery. Stripe hosts Checkout and billing management, processing payment details, billing address, tax information and fraud signals under its privacy policy. We receive references and subscription/payment state, not full card numbers. Browser stores, agent providers and website hosting providers process their own installation/account/network information under their policies.

Retention and removal

Browser notes remain until removed or extension storage is cleared/uninstalled. Stop sharing removes the service’s active copy and results for that page. Shared sessions expire after 30 days without an update. Disconnecting a browser from your account removes its cloud shares. Revoking an agent immediately prevents further access. Exports and agent conversations must be removed separately.

Account cookies are Secure, HttpOnly and expire after seven days or sign-out. Sign-in and browser connection codes expire after ten minutes and are one-use. Browser connections last 30 days. Agent access tokens last one hour; rotating refresh tokens last up to 30 days. Revocation prevents refresh. A signed offline Pro license can remain valid for up to seven days. Connection and account records are retained while needed to provide and secure the service. Billing records may be retained for legal accounting, tax, fraud and dispute requirements.

Request account access/export/deletion at support@nwavecloud.com. Local browser data cannot be deleted remotely. Infrastructure backups and logs follow operational retention and are not public; a restore must reapply deletions and revocations before service resumes. Keep your own exports of important notes.

Website and support

No advertising, marketing cookies, third-party fonts or session-replay scripts are included. A language preference is saved in browser local storage. Hosting handles IP addresses, URLs, headers and access times to serve the site and secure it. We receive messages and files you intentionally send to support. Do not send tokens, sign-in codes or unnecessary private page captures.

Your rights

For personal data we process to operate accounts, sharing, billing and support, we act as controller. Where GDPR applies, processing relies on the requested service contract, applicable legal duties and legitimate interests in operating and securing the service. You may request access, correction, erasure, restriction, portability or objection, subject to applicable limits, at support@nwavecloud.com. You may complain to the Croatian Personal Data Protection Agency or your competent authority. International transfers for which we are responsible require applicable lawful safeguards.

The product is intended for adult developer and business use. You are responsible for authority to capture and share other people’s data. We do not make automated eligibility decisions about people. Material data-use changes will be reflected in this policy before launch.