Version dated October 28, 2026, in effect from November 27, 2026. Until then, the version dated October 27, 2026 applies.
Translation for convenience. If there is any difference, the Portuguese version prevails.
This policy explains how WaitScope processes personal data on the website, in the console, in the Android app and in contact emails: which data, for what purpose, on what legal basis, where they are kept, for how long and how you exercise your rights. The articles cited are from the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's General Data Protection Law, Lei nº 13.709/2018), unless otherwise stated.
The service is provided by WaitScope, based in São Paulo/SP, Brazil. The person responsible is the controller, that is, the person who decides for what purposes and how the personal data described in this policy are processed, except for the content of the traces (section 3). In this policy, “WaitScope” means the service and the person responsible for it.
jb-profiler.tail47afbc.ts.net, which works during a transition period and will be shut down. During the transition, waitscope.io stays on the same server: it serves the app's API and sends browsers to app.waitscope.com.WaitScope reads Oracle trace files (event 10046) uploaded by the customer and builds a response time report. It is a service for companies and professionals, in early access and free of charge. There is no public sign-up: access is requested by email, and the person responsible creates the account.
Links to third-party websites, such as the Oracle documentation cited in the reports, lead to services with their own policies.
WaitScope decides for what purposes and how it processes the data of those who visit the website, write to the contact address and use the console and the app. This processing is described in sections 4 to 8.
A trace may contain personal data in the SQL text and, sometimes, data about the customer's own patients, clients or users. For that content, the controller is the customer, that is, the company or professional who uploads the trace. WaitScope is the processor: it processes the content only to generate the report and never uses it for its own purposes, such as statistics or product improvement. The rules for this role are in section 8 of the Terms of Service.
*** on screen, in the app and in the reports downloaded as HTML and JSON. You can turn this option off in “My account”, in the console. The report stored on the server keeps the original text. CLIENT ID, module, action, host, file path and, for deadlocks, the database user, machine and program appear unmasked.To reduce the personal data in the trace, generate it without bind values and upload only the files of the operation you want to analyze.
The tables below show what WaitScope processes as controller. None of this processing depends on consent. WaitScope does not sell personal data and does not use them for advertising or for behavioral profiling.
The account data and the two-step verification data are a condition for using the console and the app: without them, there is no way to provide access to the service. Your rights over these data are in section 11.
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visit | IP address, browser, page requested, date and time. | Deliver the pages, redirect waitscope.com.br to the website and keep the website online securely. | Legitimate interest (art. 7, IX). |
| Network error report (NEL) | Page, type of failure, date and time. Whoever receives the report sees the IP address and the browser. | Diagnosis of network failures by Cloudflare, which includes this instruction in the website's responses. It is not a cookie. | Legitimate interest (art. 7, IX). |
| Contact emails | Name and email address of the sender, subject, text, attachments and technical headers of the message. | Reply, arrange early access, create the account and handle requests about personal data. When the account has no email address, the address used to request access receives the notices about the service. | Request for access to the service and notices about it: preliminary procedures related to a contract, at your request, and performance of a contract (art. 7, V). Request about your personal data: compliance with a legal obligation (art. 7, II). Other messages: legitimate interest (art. 7, IX). |
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | Username, password hash (Argon2id), email (optional), language, access role, access dates (creation, last login, password change and reset, end of access) and privacy choices (hiding quoted text and long numbers). | Create and maintain the account, authenticate, apply the access period, store your preferences and send notices about the service, such as changes to the Terms or to this policy, the end of early access and security incidents. | Performance of a contract (art. 7, V). |
| Two-step verification | Authenticator app secret (encrypted) and recovery codes (hash only). | Confirm that it is you signing in. | Performance of a contract (art. 7, V). |
| Sessions | Session token hash, IP address, browser (user agent) and, in the app, the phone model. | Keep you signed in and show where your account is open. | Performance of a contract (art. 7, V). For the IP address and the device, also legitimate interest in security (art. 7, IX). |
| Acceptance of the Terms of Service and acknowledgment of this policy | User, version of the documents, date and time. | Record the acceptance of the Terms and the acknowledgment of this policy, requested from console version 1.5.0 onward. | Performance of a contract and regular exercise of rights (art. 7, V and VI). |
| Login attempts | Username entered and IP address. | Temporarily block anyone who enters the wrong password many times in a row. | Legitimate interest (art. 7, IX). |
| Audit log | User (in a failed login attempt, only when the account exists), IP address, action, date, time and a short detail of the action, such as the number of files uploaded. | Security, investigation of incidents and proof of what was done in each account. | Legitimate interest (art. 7, IX). |
| Server logs | IP address, path accessed in the console and user. | Operate the service, diagnose failures and detect attacks. | Legitimate interest (art. 7, IX). |
| Backup | Daily copy of the database, with the data above and the reports. | Restore the service after a failure. | Legitimate interest (art. 7, IX). For the reports, the customer's instructions apply (section 3). |
If you use WaitScope on behalf of a company, the service is provided to that company. In that case, where the table says “performance of a contract”, the legal basis for your data is the legitimate interest in providing the company with the service it requested (art. 7, IX). The same applies to a request for access to the service made on behalf of a company.
The app stores on the phone only what it needs to keep you signed in, resume uploads and remember your preferences: the session token, encrypted with an Android Keystore key; the server address, the language, the biometric lock (on or off) and the last username; the state of the upload in progress (file names and sizes, how much has already been uploaded and the result); and, when the trace comes from another app, a copy of it in the app's private storage until the upload ends. The legal basis is performance of a contract (art. 7, V). The retention periods are in section 7.
Biometrics are verified by Android itself: the app stores only whether the lock is on and receives no biometric data. The app has no third-party libraries for usage analytics, advertising, crash reporting or notifications. The notice that an analysis is ready comes from the app's own query to the server. The reports you download remain on the phone after you sign out of the app: on Android 10 or later, in the Downloads/WaitScope folder, until you delete them; on Android 8 and 9, in the app's own downloads folder, until you delete them or uninstall the app.
Where the legal basis is legitimate interest, WaitScope weighs the necessity of the processing against its impact on you (balancing test):
You may object to this processing through the channel in section 1 (see section 11).
The console, the database and the backups are on a Magalu Cloud (Magazine Luiza S/A) virtual machine in Brazil, region br-se1. The connection to app.waitscope.com goes directly to that server, with a TLS certificate from Let's Encrypt: Cloudflare only operates the domain's DNS, and Tailscale is not in that path.
At the console's old address, the connection passes through relay servers of Tailscale Inc., a Canadian company. These servers are in the United States and see the IP address of whoever accesses it, but not the content, because the encryption (TLS) terminates at the server in Brazil.
The website is hosted on Cloudflare Pages, from Cloudflare, Inc. Messages to contato@waitscope.com pass through Cloudflare's email routing and arrive in a Gmail mailbox, from Google LLC. WaitScope's replies and notices are sent from that mailbox.
| Provider | Country | What it processes | Purpose |
|---|---|---|---|
| Magazine Luiza S/A (Magalu Cloud) | Brazil | Accounts, sessions, audit log, reports, trace files during the analysis, logs and backups. | Host and run the console. |
| Cloudflare, Inc. | United States | IP address, browser, page, date and time of whoever opens the website; network error reports (NEL); contact emails in transit. | Host the website, operate the DNS of all WaitScope domains and forward contact email. |
| Google LLC (Gmail) | United States | Contact emails: those received and those WaitScope sends from that mailbox, such as replies and notices about the service, with your address. | Receive, send and store the messages. |
| Tailscale Inc. | Canada, with relay servers in the United States | IP address of whoever accesses the console's old address, without the content. | Carry that connection to the server in Brazil during the transition. |
Apart from these providers, WaitScope discloses personal data to an authority only when the law requires it, such as to comply with a court order.
Part of the personal data described in this policy is processed outside Brazil, by three providers headquartered abroad. Sessions, analyses and reports are not handed over to them and remain on the server in Brazil. When WaitScope writes to you, the message and your email address are kept in the Gmail mailbox.
To learn more about these transfers, including which terms of each provider apply to them, write to contato@waitscope.com.
Do not send traces, reports or third-party data by email. The message passes through Cloudflare and is kept in a Gmail mailbox, in the United States.
| Data | Period |
|---|---|
| Uploaded trace file | Deleted as soon as the analysis ends, whether it completed or failed. |
| Upload interrupted before completion | Deleted after 24 hours without receiving data. |
| Analysis report | 7 days by default. WaitScope may set another period, from 1 to 365 days, with prior notice when it increases (section 3). You can delete it earlier. |
| Account and two-step verification data | For as long as the account exists. The account is deleted when you ask or, with 30 days' notice, at the end of early access. An account that is deactivated or whose access period has expired remains stored until it is deleted in one of these ways. |
| Record of acceptance of the Terms and acknowledgment of this policy | For as long as the account exists. The record is deleted with the account. |
| Console session | Until you sign out, for at most 12 hours. The server ends the session after 30 minutes without use. |
| App session | 90 days, or 30 days without use. When you sign out of the app, the token is deleted from the phone and, if there is a connection, the session is ended on the server; without a connection, it expires on its own. |
| Login attempts | 1 day. |
| Audit log | 180 days, even after the account is deleted. |
| Server logs | Until they give way to newer entries (size-based rotation). There is no fixed period in days. |
| Database backup | Up to 5 days. If the daily backup fails, the previous copies stay until the next complete backup. Whatever is deleted disappears from the backups when they are replaced. |
| Contact emails | For as long as they are needed for the reply and for up to 2 years after the last message. When the account has no email address, the access request is kept for as long as the account exists, because its address receives the notices about the service. |
| Website connection data and NEL reports | For the period set by Cloudflare. WaitScope keeps no record of its own of website visits. The NEL instruction stays in the browser for up to 7 days. |
| Preferences and upload state in the app | On the phone, until you uninstall the app or clear its data in the Android settings. They remain there after you sign out. |
| Copy of a trace received from another app | On the phone, until the upload ends. A leftover copy is deleted when the app is opened again, if it is more than 24 hours old. |
| Downloaded reports | On your computer or phone, until you delete them. On Android 8 and 9, they are also removed when you uninstall the app or clear its data. |
The cookie periods are in section 8.
The waitscope.com website sets no cookies. The console uses only four first-party cookies, all HttpOnly and SameSite=Strict. Three are necessary: __Host-latena_session (session, up to 12 hours or 30 minutes without use), __Host-latena_login (login form protection, 1 hour) and __Host-latena_codigo (two-step verification code, 10 minutes). The fourth, latena_idioma, stores the language for 365 days and is set only when you choose the language. There are no analytics, advertising or tracking cookies, the console does not use browser storage and the Android app does not use cookies.
The three necessary cookies do not depend on consent, and the language cookie is set only at your request. Their purposes, legal bases and how to delete them are in the Cookie Notice. The NEL and Report-To headers that Cloudflare includes in the website's responses are not cookies (section 4).
Security measures in use:
No measure eliminates all risk. Who has technical access to the reports is described in section 10.
The reports are stored in the database without encryption. Isolation between accounts is enforced by the application: through the console and the app, no other user and no administrator role sees another account's analyses. The server is operated by WaitScope itself, which has technical access to the database and the backups. It accesses the content only when necessary for support requested by the customer, to handle a security incident or because of a legal obligation.
Under the LGPD (art. 18), you may ask WaitScope for:
In “My account” (click your username at the top of the screen), you can see your data and the open sessions and change your password, language, privacy choices and two-step verification. You can also download reports as HTML or JSON and delete analyses whenever you want.
The account is deleted on request, through the channel above, until the console has an option for you to do it yourself. Deletion erases the account data, the sessions and the analyses. After it, only the following remain:
If you do not use WaitScope but your data appear in a trace uploaded by a customer, the controller is that customer (section 3). Make your request directly to them. If the request reaches WaitScope, the reply explains that WaitScope acts as processor and, when the customer can be identified, that the request has been forwarded to them.
You may also lodge a complaint with the ANPD, at gov.br/anpd, and with consumer protection bodies (art. 18, §§ 1 and 8).
WaitScope is a service for companies and adult professionals and is not intended for anyone under 18. If a trace contains data of children or adolescents, those data are the responsibility of the customer, who is the controller (section 3).
A security incident is unauthorized access to, or the leak, loss or alteration of, personal data.
If you notice anything unusual in your account, write to contato@waitscope.com.
This policy may change when the service or the law changes. Each version shows its date at the top of the page. A new version is announced by email with the same advance notice as changes to the Terms of Service.
From console version 1.5.0 onward, the first time you sign in, you accept the Terms of Service and confirm that you have read this Privacy Policy. This confirmation is not consent: it only records that you have received this information and does not change the legal bases in section 4. When the version of either document changes, the console shows the new version the next time you sign in and asks for a new confirmation. The console records the user, the version of the documents and the date and time.
If there is a translation of this policy, the Portuguese text prevails in case of any difference.