This policy explains what Weaveflow LLC, a Wyoming (USA) limited liability company ("Weaveflow", "we"), collects when you use the dashboard at app.weaveflow.io and this website, how it is used, and the choices you have. Weaveflow LLC is the data controller for the personal data described here. The short version: we collect what the product needs to work, and we do not sell it.
1. What we collect
- Account data. Your email address and name — either entered directly with a password, or received from Google if you sign in with Google.
- Product data. The tickets you file, the agent's reports and event history, project and server metadata (names, domains, deployment records, logs surfaced in the dashboard), and your organization and team settings.
- Credentials you choose to give us. API keys and tokens for third-party services you connect, stored encrypted.
- Billing data. Handled by Stripe. We receive subscription status and invoice metadata; we never store card numbers.
- Usage data. Service usage and cost information, shown back to you in the product.
- Website analytics. We count visits and referrers to see how people find Weaveflow. Our analytics provider sets two first-party cookies in your browser, one identifying the browser and one identifying the visit. They are readable only on our own domain and are not used to follow you across other websites.
- Sign-up attribution. When you start a subscription we pass those two analytics identifiers to our billing system, so we can tell which visits lead to sign-ups. This connects a visit to your account. If your browser has no analytics cookie, the sign-up is simply unattributed and nothing is lost.
2. What we use it for
- Operating the Service: dispatching the agent, deploying to your server, showing you your own data.
- Sending you the emails the product generates — approval requests, deploy failures, uptime alerts — and account email like password resets.
- Billing and account management.
- Security, debugging and abuse prevention.
We do not sell personal data, and we do not use your code or your product data to train AI models. The agent runs under your own AI-provider subscription, on your own infrastructure. A small number of platform features — such as ticket summaries and database review — process the relevant content through AI providers under our account (OpenAI today; Anthropic may also be used). Under those providers' API terms, this data is not used to train their models.
3. Google user data
If you sign in with Google we receive your name, email address and profile picture, used only to create and identify your account. Weaveflow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who processes data for us
Weaveflow runs on a small set of subprocessors:
- Supabase — database and authentication.
- Cloudflare — hosting and DNS for this website.
- DataFast — website analytics, and the sign-up attribution described in section 1.
- Stripe — payments.
- Resend — transactional email.
- Hetzner — hosting for the Weaveflow control plane (EU).
- OpenAI, and potentially Anthropic — AI processing for platform features such as ticket summaries and database review.
- Google — sign-in, if you choose it.
Your application and the agent run on servers you supply — those machines and their providers are your own relationship, not our subprocessors.
5. Retention
Account and product data are kept while your account is active. If you close your account, we delete personal data within a reasonable period, except records we must keep (such as invoices). Your repositories and servers are yours and are unaffected.
6. Security
We use commercially reasonable technical and organizational safeguards, including encryption of stored credentials. No method of transmission or storage is completely secure, but we work to protect your data and to limit what we hold to what the Service needs.
7. Your rights
Depending on where you live (including under the GDPR), you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. Contact us and we will act on your request; you can also complain to your local data-protection authority.
8. International transfers
The Weaveflow control plane is hosted in the European Union. Our subprocessors may process data outside your country; where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by those providers.
9. Children
The Service is not directed to children under 16 and we do not knowingly collect their data.
10. Changes
We may update this policy; material changes will be announced on this page with an updated date.
11. Contact
Weaveflow LLC — privacy questions and requests: privacy@weaveflow.io.