Terms of Service

Version dated October 27, 2026.

Translation for convenience. If there is any difference, the Portuguese version prevails.

During early access, these Terms of Service apply to the WaitScope console, at waitscope.io, and to the Android app. They set out what the service does, the rules of use and how WaitScope processes the content of the traces you upload. Read them together with the Privacy Policy and the Cookie Notice.

1. Who provides the service

WaitScope is provided by Johab Benicio de Oliveira, a natural person domiciled in Brazil. No company (CNPJ, Brazilian corporate taxpayer ID) has been incorporated for the service yet.

• Contact: contato@waitscope.com (section 16).
• The CPF (Brazilian individual taxpayer ID) and the postal address are provided to anyone who asks through that channel.

In these Terms, WaitScope means the service and also the person responsible for it. You means the person who uses the account and, when the account is used on behalf of a company, also that company.

2. Acceptance

The first time you sign in, you accept these Terms and confirm that you have read the Privacy Policy. The console records your user account, the version of the documents and the date and time. When the version of either document changes, the console asks for your acceptance again the next time you sign in (section 14).

If you accept on behalf of a company, you represent that you have the authority to do so. If you do not agree, do not use the service and request the closure of the account through the contact channel.

3. Who may use the service

• Companies and professionals, for use in their professional activity.
• Persons aged 18 or over.
• Customers established in Brazil or in another Latin American country. Access requests from outside this region are refused.

There is no public sign-up. Access is requested by email to contato@waitscope.com, and WaitScope creates the account. WaitScope may refuse a request for access.

4. What the service does and does not do

WaitScope reads the Oracle event 10046 trace files that you upload through the console or the app and builds a response time report: CPU, waits, SQL statements, plans and diagnosis. You open the report in the console or the app, may download it (HTML in the console and the app, JSON in the console) and may delete it.

WaitScope does not:

• monitor your environment: it does not stay connected to the database and does not collect anything continuously;
• access your database: there is no agent, connector or schema, and the service only sees the files you choose to upload;
• keep the trace after the analysis, nor is it meant for storing files long term;
• decide for you: the report is technical support, and the decisions about the SQL, the database and the application are yours.

5. Early access

• Early access is free of charge. No prices have been published.
• The service is provided as is. It may have faults, change and become unavailable. There is no service level agreement (SLA) and no guarantee of availability, analysis time or results.
• WaitScope may end early access or start charging, with 30 days' notice. Nothing is charged unless you first accept the new conditions.
• An account may have an access end date. The console warns you when that date is near. After it, you can no longer sign in with that account, but the account data remain stored until deletion, at your request or at the end of early access. To continue, write to the contact channel.

When early access ends, or if you do not accept the new conditions, the account is closed and its data and analyses are deleted (section 12). During the 30-day notice period, download the reports you want to keep.

6. Account and security

• The account is personal. Do not share the password, the authenticator app or the recovery codes.
• Use a password that you use only for WaitScope.
• Two-step verification is mandatory. Keep the recovery codes in a safe place.
• Check the open sessions and devices in “My account”. To open “My account”, click your username at the top of the screen.
• In the app, you can turn on the biometric lock.
• Notify the contact channel as soon as you suspect misuse of the account or the service, lose the device with the authenticator app or find a security flaw. Do not exploit the flaw.

You are responsible for whatever is done with your account, except when the misuse results from a failure on WaitScope's part.

The reports you download stay on your computer or phone. In the Android app, they go to the Downloads/WaitScope folder (on Android 8 and 9, to the app's own downloads folder) and remain there after you sign out of the account. Protecting and deleting these files is up to you.

7. Acceptable use

You agree to:

• upload only traces that you have the right to upload, from your own environment or from clients who have authorized the upload;
• upload the minimum amount of personal data. Prefer traces without bind values (with DBMS_MONITOR, turn waits on and leave binds off; with event 10046, use level 8) and, when possible, a test environment or masked data;
• comply with the law, in particular the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's General Data Protection Law, Lei nº 13.709/2018), regarding any personal data that the traces contain.

You may not:

• try to view data from another account or circumvent the isolation between accounts;
• overload the service or circumvent the account's usage limits;
• carry out port or vulnerability scanning, penetration testing or attacks against the service without written authorization;
• reverse engineer, decompile or disassemble the console or the app, except where the law permits;
• upload a file containing malicious code or crafted to exploit flaws in the service;
• upload unlawful content or use the service for an unlawful purpose, including with personal data obtained without a legal basis;
• resell access or transfer your account to another person.

Breach of this section may lead to suspension or closure of the account (section 12).

8. Processing of data in the uploaded content

This section is the data processing agreement between you and WaitScope regarding the content of the traces and reports, under art. 39 of the LGPD.

8.1 Roles

Traces may contain personal data: the SQL text and, sometimes, data about your own users, such as customers or patients. For these data, the controller is you or, when you use the account on behalf of a company, that company. WaitScope is the processor.

If you upload traces from a client of yours, for example as a consultant, you warrant that the client has authorized the upload to WaitScope. In that case, WaitScope acts as a sub-processor, under the same conditions set out in this section.

For your account data, such as username, email and access records, WaitScope is the controller. That processing is described in the Privacy Policy.

8.2 Instructions

WaitScope processes the content only for the purpose above. Your instructions are these Terms and the choices you make in the console, such as what to upload, the masking of literals and the deletion of analyses. You also instruct WaitScope to open the content identified in an abuse report, only as far as necessary to assess it (section 13). If an instruction of yours appears to be contrary to the LGPD, WaitScope informs you and may refrain from following it.

WaitScope does not use the content for its own purposes, such as statistics, advertising or product development. When you request support about an analysis, the content is used only to resolve your request. WaitScope does not sell the content or pass it on to third parties, except to the sub-processors in section 8.6 and when the law requires it.

8.3 What is kept and for how long

If the retention period increases, WaitScope notifies you by email with the advance notice set out in section 14, and the new period also applies to analyses already stored, counted from the upload date. If it decreases, it applies as soon as it is saved, and WaitScope notifies you. Before the period ends, you can download the report as HTML or JSON. If you upload the same file again, the console opens the existing analysis; if the same trace comes in another file, the new analysis, once ready, replaces the previous one.

On screen, in the app and in the reports downloaded as HTML and JSON, quoted text and numbers with 6 or more digits in the SQL appear as ***. Masking is on by default and can be turned off in “My account”. It does not change the stored report, which keeps the SQL as it appears in the trace. CLIENT ID, module, action, host, file path and, for deadlocks, the database user, machine and program appear unmasked.

8.4 Confidentiality and access to content

• Through the application, each account sees only its own analyses. No other user and no console administrator role can open them.
• The reports are stored in the database without encryption; isolation between accounts is enforced by the application. The person responsible for the service, who operates the server, has technical access to the database and the backups.
• The person responsible accesses the content only when you request support, to handle a security incident or when the law requires it.
• Anyone with access to the content must keep it confidential, including after the service ends.
• WaitScope discloses content to an authority only under a court order or when the law requires it, and notifies you, unless the law or the order prevents it.
• For support, do not send traces or reports by email, because WaitScope's email passes through companies in the United States. Describe the problem and identify the analysis.

8.5 Security measures

• HTTPS on all connections to the console and the app.
• Passwords stored with Argon2id.
• Mandatory two-step verification, with the authenticator app secret encrypted and the key kept outside the database.
• Per-user isolation: each analysis opens only for whoever uploaded it.
• Request limits per IP address and temporary login lockout after several wrong passwords.
• Administrator role without access to the content.
• Automatic security updates on the server.
• Administrative access to the server (SSH) only with a cryptographic key, without password login.
• Trace deleted at the end of the analysis.

No measure eliminates all risk.

8.6 Sub-processors

Through the address waitscope.io, the connection goes directly to the server in Brazil, without passing through Tailscale or Cloudflare. WaitScope's DNS, website and email providers do not receive the content uploaded to the console; they are listed in section 5 of the Privacy Policy.

Before adding or replacing a content sub-processor, WaitScope notifies you in the same way as for a change to these Terms (section 14). If you do not agree, you may close the account.

8.7 Data subject requests

If a data subject whose data are in a trace contacts WaitScope, WaitScope explains that the request is a matter for the controller and, when it can identify the customer, forwards the request to you. WaitScope does not respond about the content without your instruction.

You can delete an analysis yourself in the console at any time. For other help with a data subject request, write to the contact channel. On request, WaitScope provides the information you need to demonstrate compliance with the LGPD for this processing.

8.8 Security incidents

If WaitScope becomes aware of a security incident affecting the content you uploaded, it notifies you without undue delay. The maximum period is 48 hours, counted from when WaitScope becomes aware of the incident. The notice goes to the account email or, if the account has no email, to the email address from which access to the service was requested. It contains what is already known: what happened, which data may have been affected, the measures taken and what you can do. WaitScope sends whatever is missing as soon as it becomes known.

As controller, it is up to you to assess the incident and to notify the Agência Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Agency) and the data subjects, under Resolução CD/ANPD nº 15/2024 (the ANPD regulation on security incident reporting). WaitScope provides the information you need for this.

8.9 End of processing

The content is deleted within the periods in section 8.3. When the account is closed, any remaining analyses are deleted with it. Content is not returned: before the end, download the reports you want to keep. On request, WaitScope confirms the deletion in writing.

8.10 Your warranties as controller

• You have a legal basis to process the personal data in the traces and to upload them to WaitScope (LGPD, art. 7) and, if there are sensitive personal data, one of the grounds in art. 11.
• You have given the data subjects the information that the LGPD requires about this processing, including about the use of providers as processors.
• You upload only what is necessary and prefer traces without bind values.
• You respond to the data subjects and to the ANPD regarding these data.

If WaitScope has to compensate anyone for processing that followed your instructions and lacked a legal basis on your part, it may recover the amount paid from you (right of recourse, LGPD, art. 42, § 4).

9. Intellectual property

• The WaitScope console, app, website, brand and documentation belong to WaitScope or to whoever licensed them to it.
• During early access, WaitScope grants you a personal, free-of-charge, non-exclusive, non-transferable and revocable license to use the console and the app in accordance with these Terms. Nothing in these Terms transfers to you any rights in the software.
• The traces you upload and the reports generated from them are yours. You may keep, use and share the reports as you wish, in compliance with the law regarding any personal data they contain.
• You authorize WaitScope to process this content only to provide the service, as described in section 8.
• WaitScope may use the suggestions you send about the service, without any obligation to you. This does not include the content of your traces and reports.

10. Availability and changes to the service

• The service may stop for maintenance, for updates or because of failures, sometimes without notice.
• WaitScope may change, add or remove features. When a change significantly reduces what the service does, WaitScope gives notice beforehand, whenever possible.
• The backups are kept on the same server, for up to 5 days, and serve to restore the service. Keep the reports you need yourself.
• The console is at waitscope.io. The old address, jb-profiler.tail47afbc.ts.net, works for a transition period and will be shut down. Update your bookmarks and, in the app, the server address.

11. Limitation of liability

To the extent permitted by Brazilian law:

• WaitScope is not liable for indirect damages, such as lost profits, loss of business opportunity or business interruption;
• WaitScope is not liable for decisions made based on the report, or for the content you upload;
• WaitScope is not liable for failures caused by fortuitous events or force majeure (Código Civil, the Brazilian Civil Code, art. 393);
• while access is free of charge, WaitScope is liable only for damage caused by willful misconduct or gross negligence, the rule for gratuitous contracts (Código Civil, art. 392);
• once fees are charged, WaitScope's total liability to you, for all causes related to these Terms combined, is limited to the amount you paid WaitScope in the 12 months before the event that caused the damage.

These limits do not apply to damage caused by willful misconduct or gross negligence on WaitScope's part and do not exclude or reduce the rights of data subjects provided for in the LGPD. If your relationship with WaitScope is a consumer relationship, they also do not exclude the rights guaranteed by the Código de Defesa do Consumidor (Brazilian Consumer Protection Code), which no contract can exclude.

12. Suspension and termination

12.1 By you

You may stop using the service at any time. Until the console has an option to close the account, request the closure at contato@waitscope.com. WaitScope closes the account within 15 days.

12.2 By WaitScope

• Immediate suspension, in whole or in part, when there is a risk to the security of the service or of other users, evidence of a breach of section 7, a well-founded report (section 13) or an order from an authority.
• Termination at the end of early access, with 30 days' notice (section 5), if you do not accept new pricing conditions, for serious or repeated breach of these Terms or when the law requires it.

WaitScope states the reason, unless the law, an order from an authority or the security of the service prevents it. You may contest the decision through the contact channel, and WaitScope replies within 15 days.

12.3 What happens to the data

Closing the account is the same as deleting it: the account data and the analyses are erased. Only the records listed in the Privacy Policy remain, for the periods stated there, such as the audit log with user, IP address and action, for 180 days, and the backups, for up to 5 days. Sections 8.4, 8.8, 8.10, 9, 11 and 15 continue to apply after termination.

13. Reports and notices

WaitScope's reporting channel is permanent and is the email address contato@waitscope.com, as required by arts. 16-A, II, and 20-A of Decreto nº 8.771/2016 (Federal Decree No. 8,771/2016), added by Decreto nº 12.975/2026 (Federal Decree No. 12,975/2026). Anyone may use it, with or without an account. Use the subject line “Denúncia” (Portuguese for “report”).

13.1 What can be reported

• Criminal or unlawful content uploaded to the service, such as a trace with personal data obtained without authorization.
• Misuse of the service, such as an attack, an attempt to access data from another account or another breach of these Terms.
• A security flaw in the service.

13.2 What the notice must include

1. A description of the criminal or unlawful conduct, or conduct contrary to these Terms, or the court decision about it.
2. Information that allows the content or the account to be found, such as the username, the date and the file name, as far as you know them.
3. Your name and contact details and, where applicable, the grounds for your standing, for example as the data subject or as a representative of the affected company.

Without these elements, the notice cannot be assessed, and WaitScope asks for whatever is missing. The identity of the person giving notice is not disclosed to the affected user, unless the law requires it or that person authorizes it.

13.3 What happens next

1. WaitScope confirms receipt by email.
2. It assesses the notice. If necessary, it opens the content identified, only as far as necessary for the assessment, as provided for in section 8.2 and by the legal obligation to assess the notice (section 8.4).
3. Within 15 days of the complete notice, it informs the person who gave notice of the decision, with the specific reason and how to contest it.
4. If it takes action, such as deleting the analysis or suspending or closing the account, it also notifies the affected user, with the specific reason and how to contest it, unless the law or an order from an authority prevents the notice.

In serious and urgent cases, such as an ongoing attack, WaitScope may act before completing the assessment and gives notice afterward. When the law requires it, WaitScope forwards the criminal content and the information about it to the authorities.

13.4 Contesting the decision

The person who gave notice and the affected user may contest the decision by replying to the notice email, with their reasons and any documents they have. WaitScope reassesses the case and replies within 15 days. If it changes the decision, it informs both, with the reason. A deleted analysis is not restored: if the user's challenge is upheld, the user may upload the trace again.

13.5 Abuse of the channel

False notices, notices made in bad faith and repeated unfounded notices may be rejected, with the reason stated.

13.6 Transparency report

Every year, in January (the first edition comes out in January 2027), WaitScope publishes on the website a transparency report for the previous year. It includes the number of extrajudicial notices received, the measures taken and the response times, even when there have been no notices. The service has no ads or paid boosting, so the report does not cover those topics. The rules in this section are reviewed together with the report.

14. Changes to these Terms

• WaitScope may change these Terms when the service, the law or the way it operates changes.
• The new version is published on this page, with its date, and announced by email 30 days in advance. A change required by law or necessary for security may take effect sooner, with notice.
• The first time you sign in after the change, the console asks for a new acceptance and records the user, the version, the date and the time.
• If you do not agree, you may close the account, at no cost, before the new version takes effect.
• WaitScope keeps the previous versions and sends them to anyone who asks.

15. Governing law and jurisdiction

These Terms are governed by Brazilian law. The courts of the judicial district (comarca) of São Paulo/SP are chosen to settle disputes about them, without prejudice to the consumer's right to bring the action in the courts of their own domicile, where the law guarantees it.

The Portuguese text prevails over any translation. If any clause is held invalid, the other clauses remain in effect. Failure to enforce any provision of these Terms is not a waiver of it.

16. Contact and notices

• Channel: contato@waitscope.com, for questions, data subject requests, reports, security notices and account closure. WaitScope replies within 15 days.
• WaitScope is a small-scale processing agent (Resolução CD/ANPD nº 2/2022, the ANPD regulation for small-scale processing agents) and has not appointed a data protection officer (encarregado). That email address is the channel of communication with data subjects.
• Data subjects may also lodge a complaint with the ANPD.
• WaitScope's notices go to your account email or, if the account has no email, to the email address from which access was requested. Keep one of these addresses in use.
• To report an accessibility barrier, see the Accessibility Statement.

First version of these Terms, dated October 27, 2026.