1. About this notice
This Privacy Notice explains how Weaver collects and uses personal data when you visit www.weaverplatform.ai, contact us, sign up to try Weaver, or use a Weaver trial environment. Weaver is a business-to-business platform: AI agents run business processes for companies, and people review and approve the exceptions. Our products are Weaver Portal and Weaver Studio.
Our website and services are intended for businesses and the people who work for them. They are not intended for children and we do not knowingly collect personal data about children.
If your organisation becomes a paying customer, the way we handle personal data inside the Weaver platform on its behalf is also governed by the written agreement (including any data processing terms) between your organisation and us.
2. Who we are
Weaver is operated by Weaver Opco Limited, a company registered in Jersey under company number 165894, with its registered office at c/o Aztec Financial Services (Jersey) Limited, Aztec Group House, IFC6, The Esplanade, St Helier, Jersey, JE4 0QH ("Weaver", "we", "us", "our").
For the personal data described in this notice we act as the controller, except where section 7 says that we act on behalf of your organisation.
If you have any questions about this notice or about your personal data, please email privacy@weaverplatform.ai.
3. The personal data we collect
Information you give us
- Contact form: your name, work email address, company, the topic or industry you select and your message.
- Get started (sign-up): your name, work email address, company, role and country.
- Correspondence: anything you include when you email us or reply to our emails.
Information created when you sign up
- Email confirmation: when you sign up we send a confirmation link to your work email. The link is signed and expires after 24 hours. Opening it confirms that you control that address.
- Card verification (not yet available on our website): once it is, after confirming your email, you are asked to verify a payment card. Your card details are entered into a form provided by Stripe and go directly to Stripe; they never pass through or are stored on our servers. Stripe creates a customer record for you and returns to us a customer reference together with the card brand, the last four digits and the card's country of issue. Nothing is charged when you sign up.
Information collected automatically
- Server logs: when you use our website, our hosting provider records technical information such as your IP address, browser user agent, the page or service requested and the date and time of the request.
- Abuse prevention: we use your IP address to limit the number of requests that can be made in a short period, to protect the website and our forms from automated abuse.
- Stripe fraud prevention: once card verification is available, when its step loads, Stripe collects information about your device and browser, and sets cookies, to detect and prevent fraud. See our Cookie Policy for details.
- Visit statistics: we count visits to our website with Umami, which records the pages viewed, the referring website and campaign (utm_ tags), the buttons and links clicked, the type of browser, operating system and device, screen size, language and country. Umami does not use cookies, does not store your IP address and does not identify you. See our Cookie Policy for details.
We do not use advertising tools on our website, we do not set tracking cookies and we do not track you across other websites.
Information in a trial environment
If we set up a trial environment for your organisation, we create user accounts for the people your organisation invites (typically name, work email address and sign-in details) and record how the environment is used (for example, sign-in events, actions taken and system logs). Your organisation may also put its own business information into the environment, which may contain personal data. Section 7 explains how we handle that information.
Information from other sources
We may receive information about you from your colleagues (for example, when they invite you to a trial environment) and from Stripe (the card verification result).
4. Why we use your personal data and our lawful bases
We only use personal data where the law allows us to. The table below sets out what we use it for and the lawful basis we rely on under data protection law.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Replying to your enquiry and following up on it | Contact form details and correspondence | Our legitimate interests in responding to business enquiries and developing business relationships |
| Confirming your email address when you sign up | Sign-up details, confirmation link | Our legitimate interests in making sure that sign-ups are genuine and come from the person named |
| Verifying a payment card through Stripe | Sign-up details, Stripe customer reference, card brand, last four digits and country | Our legitimate interests in preventing abuse of free trials and confirming that a real business is signing up; taking steps at your organisation's request before entering into a contract |
| Setting up and running a trial environment | Sign-up details, user accounts, usage information | Taking steps at your organisation's request before entering into a contract and performing the trial terms; our legitimate interests in providing and supporting the trial |
| Keeping our website, forms and services secure, preventing fraud and abuse | Server logs, IP address, Stripe fraud signals | Our legitimate interests in protecting our website, services and users |
| Improving our website and services | Feedback and usage information from trial environments | Our legitimate interests in improving our products |
| Understanding how our website is used, in aggregate | Visit statistics (Umami) | Our legitimate interests in measuring and improving our website |
| Complying with the law and protecting our rights | Any of the above, where relevant | Compliance with a legal obligation; our legitimate interests in establishing, exercising or defending legal claims |
Where we rely on legitimate interests, we have considered that our interests are not overridden by your rights and interests. You can ask us for more information about this assessment and you can object to this processing (see section 10).
You do not have to give us your personal data, but if you do not provide the details marked as required on our forms we will not be able to respond to your enquiry or set up a trial.
5. Who we share your personal data with
We do not sell your personal data. We share it only with the service providers that help us run our website and services, who act on our instructions, and with others where described below.
| Recipient | What they do for us | Where data may be processed |
|---|---|---|
| Google Cloud Platform (Google) | Hosting of our website and services, server logs | United Kingdom (London); Google may also process data in other countries, including the United States |
| Google Workspace (Google) | Email delivery and our mailboxes, including the emails generated by the contact and sign-up forms | United Kingdom, European Economic Area, United States and other countries where Google operates |
| Stripe | Card verification and, if your organisation becomes a paying customer, payments; fraud prevention | United States, European Economic Area, United Kingdom and other countries where Stripe operates |
| Cloudflare | Domain name (DNS) services and bot protection on our forms (Cloudflare Turnstile) | United States and other countries where Cloudflare operates |
| Umami Software, Inc. (Umami Cloud) | Statistics on visits to our website | United States and other countries where Umami or its hosting providers operate |
| Auth0 (Okta) | Sign-in and identity management for trial environments | United Kingdom |
| Anthropic and OpenAI | AI model providers used by the Weaver platform in trial environments, accessed through our gateway, which masks personal data before it is sent to the model | United States |
Stripe also acts as an independent controller of some of the information it collects, for example to meet its own legal obligations and to prevent fraud across its network. Stripe's use of that information is described in its privacy notice at https://stripe.com/privacy.
We may also share personal data with our professional advisers (such as lawyers and accountants), with law enforcement or regulators where the law requires us to, and with a buyer or investor in connection with a sale, merger or reorganisation of our business, subject to appropriate confidentiality protections.
6. International transfers
Some of the providers listed in section 5 are based in, or process data in, countries outside the United Kingdom, Jersey and the European Economic Area, in particular the United States. Where we transfer personal data to such a country, we make sure it is protected by one of the safeguards recognised by data protection law, such as:
- a decision that the country provides an adequate level of protection, including, for the United States, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it;
- the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses for transfers from the United Kingdom; and
- the European Commission's Standard Contractual Clauses for transfers from the European Economic Area.
You can ask us for more information about the safeguards we use by emailing privacy@weaverplatform.ai.
7. Data your organisation puts into a trial environment
When your organisation uses a trial environment, we process the business information it puts into the environment on its behalf and on its instructions. For that information, your organisation is the controller and we act as its processor. If you have questions about how your organisation uses that information, please contact your organisation.
Trial environments are for evaluation. Unless we have agreed otherwise in writing, your organisation must not put special category data (for example, health information) or real personal data from its live operations into a trial environment; test or sample data should be used instead.
When the Weaver platform uses an AI model, requests are sent through our gateway, which masks personal data before it reaches the model provider.
8. How long we keep your personal data
We keep personal data only for as long as we need it for the purposes described in this notice, and then delete or anonymise it. Our retention periods are:
| Personal data | How long we keep it |
|---|---|
| Contact form enquiries and related correspondence | 180 days after our last contact with you |
| Sign-ups that do not become a trial or a paying customer, including the Stripe customer record | 180 days after the sign-up |
| Trial user accounts and usage information | For the duration of the trial and up to 30 days after it ends, unless your organisation becomes a customer |
| Server logs | Up to 30 days |
| Visit statistics (which do not identify you) | Up to 24 months |
| Information we need to keep for legal, tax or accounting reasons, or for a legal claim | For as long as the law requires or the claim is open |
If your organisation becomes a customer, we keep the relevant information for the duration of the contract and afterwards as set out in that contract.
9. How we protect your personal data
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls limited to staff who need access, signed and time-limited email confirmation links, rate limiting against automated abuse, and keeping card details out of our systems by using Stripe's hosted card form. No system is completely secure, but we work to keep the risk low and will notify you and the regulator of a personal data breach where the law requires us to.
10. Your rights
Depending on where you are, data protection law (including the UK GDPR, the EU GDPR and the Data Protection (Jersey) Law 2018) gives you the following rights over your personal data:
- Access: to ask for a copy of the personal data we hold about you.
- Rectification: to ask us to correct data that is inaccurate or incomplete.
- Erasure: to ask us to delete your data in certain circumstances.
- Restriction: to ask us to limit how we use your data in certain circumstances.
- Objection: to object to our use of your data where we rely on legitimate interests.
- Portability: to receive data you have given us in a structured, commonly used, machine-readable format, or to ask us to send it to another organisation, in certain circumstances.
- Withdrawing consent: where we rely on your consent, to withdraw it at any time, without affecting what we did before.
To exercise any of these rights, email privacy@weaverplatform.ai. We may need to confirm your identity before we respond. We will respond within one month, which may be extended where the law allows. There is normally no fee.
For data that your organisation put into a trial environment (section 7), please contact your organisation first; we will help it respond.
11. Complaints
If you have a concern about how we handle your personal data, please contact us first at privacy@weaverplatform.ai so that we can try to resolve it.
You also have the right to complain to a data protection regulator. In the United Kingdom this is the Information Commissioner's Office (ICO), https://ico.org.uk, telephone 0303 123 1113. You may also complain to the regulator in the country where you live or work.
12. Changes to this notice
We may update this notice from time to time, for example when we add a new service provider or change how our website works. The date at the top shows when it was last updated. If we make significant changes we will take reasonable steps to let you know.
13. Contact us
- Privacy questions and requests: privacy@weaverplatform.ai
- General and legal enquiries: office@weaverplatform.ai
- Post: Weaver Opco Limited, c/o Aztec Financial Services (Jersey) Limited, Aztec Group House, IFC6, The Esplanade, St Helier, Jersey, JE4 0QH