Privacy Policy

Last updated: June 3, 2026 · Effective: June 3, 2026

Weavo ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

1. Information We Collect

We collect information you provide directly to us:

Account data: email address, password (stored as a bcrypt hash — never in plaintext)
Workflow data: automation workflows, node configurations, execution history you create within the platform
API keys: third-party API credentials you optionally store in Settings (encrypted at rest)
Usage data: workflow execution logs, error messages, feature usage patterns

We also collect technical data automatically:

IP address, browser type, operating system (for security and rate limiting)
Log data: timestamps of login attempts and API calls

2. How We Use Your Information

To provide and operate the Weavo service
To authenticate you and secure your account (JWT tokens)
To execute workflows you configure and trigger
To enforce our rate limits and prevent abuse
To send transactional emails (password reset, critical security notices)
To improve and develop the platform

We do not sell your personal data. We do not use your data for advertising.

3. Data Storage and Security

Your data is stored on Railway infrastructure (cloud hosting). Passwords are hashed using bcrypt before storage. API keys you store are encrypted at rest. We use HTTPS for all data in transit.

JWT authentication tokens are short-lived (7 days) and stored in your browser's localStorage.

4. Third-Party Services

When you configure integrations (YouTube, Telegram, OpenAI, etc.), your API keys are used solely to perform the automation actions you define. We do not share your credentials with any party other than the integration service itself.

We use the following infrastructure providers:

Railway (hosting, database) — Railway Privacy Policy
Stripe (payments, if applicable) — Stripe Privacy Policy

5. Data Retention

We retain your account data for as long as your account is active. Execution logs are retained for 30 days. Upon account deletion, all personal data is permanently removed within 30 days.

6. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights:

Access: request a copy of your personal data
Rectification: correct inaccurate data
Erasure: request deletion of your account and data ("right to be forgotten")
Portability: receive your data in a machine-readable format
Objection: object to certain types of processing

To exercise these rights, email us at support@weavo.run.

7. California Privacy Rights (CCPA)

California residents have additional rights under CCPA, including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of sale (we do not sell data). To exercise these rights, contact us at the email above.

8. Cookies

Weavo does not use tracking cookies or advertising pixels. We use localStorage in your browser to store your session token (JWT). This is a functional requirement and does not require cookie consent under most regulations.

9. Children's Privacy

Our service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us to have it removed.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or by posting a notice on the platform. Continued use of the service after such notice constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions or to exercise your rights:

Email: support@weavo.run
Or via the in-app support link