Weaver - Privacy Policy (Updated)

Scope

This Policy explains how Weaver collects, uses, shares, and protects information when you use our Service or visit our sites. If you run Weaver on your own website, the practical companion to this Policy — the storage Weaver places in your visitors' browsers, how it treats your consent banner, and what you are responsible for — is on our data, storage and consent page.

What We Collect

From you, as a customer: your name, email address and billing details, the websites you add, what you do inside the dashboard, and anything you send us in support.

From visitors to a website that runs our tag, on behalf of that website: a visitor identifier we generate and keep in the visitor's browser; the IP address the request came from, shortened before it is stored (older records were shortened on 27 September 2026); the browser's user-agent string, language, time zone and screen size; the address of the page visited, including its query string, and the address of the page the visitor came from; campaign parameters already present in the link, including advertising click identifiers; and, where the website has switched those features on, the value and contents of an order, values captured from a form the visitor submitted, and the email address of a visitor the website has told us is signed in. We do not sell data and we do not use it to follow people across other companies' websites.

How We Use Data

We use data to provide, secure, and improve the Service, report analytics, handle billing, and detect fraud.

Legal Bases (GDPR)

We process data for contract performance, legitimate interests, consent, and legal obligations.

Data Ownership

You own all first-party data collected. Weaver acts as a processor under your instructions.

Where Data Is Stored and Transferred

Analytics data is stored in Israel, which the European Commission recognises as providing an adequate level of data protection. Some of the providers listed below operate in the United States; transfers to them rely on Standard Contractual Clauses or an equivalent safeguard.

Security

We encrypt data in transit and at rest, control access, and perform audits and backups.

Retention

Individual visit records are kept for three years and then removed automatically, and so is everything built from them: visitor records three years after the visitor's last visit, conversions, leads, orders and custom events three years after they happened. Copies of an order confirmation page, which we take only to read the order total, are removed after thirty days; the record of traffic we identified as automated is removed after ninety days. Your account and campaign totals are kept while your account is open. When a website is deleted, everything it recorded is deleted at the end of a seven-day grace period; the record of the privacy settings chosen for it is kept.

Third Parties / Sub-Processors

We use the following providers. Each one processes data under a written agreement and only for the purpose named here.

• Amazon Web Services — hosting, databases and file storage, in Israel. Email we send you is delivered through the same provider from the United States.
• xAI (United States) — the language model behind the dashboard's AI assistant and our monitoring features. When you ask the assistant a question, the question and the rows that answer it are sent to the model; if you ask about individual visitors, those rows are what gets sent.
• Sentry (United States) — error monitoring for our own software. Configured not to send visitor data.
• Creem — subscription billing. Receives your billing details, not your website data.
• Contentsquare/Hotjar and Cloudflare — used on our own marketing website only, for usage analysis and to tell humans from bots. They receive nothing about your website's visitors.
• Telegram — operational alerts to our own team, which can include your account's name and email address. Never your visitors' data.

Google APIs and Analytics Connections

We comply with the Google API Services User Data Policy, including 'Limited Use'.

Cookies & Similar Tech

We use cookies for essential operations and analytics where permitted by consent. On our own sites that means: a first-party visitor identifier set by our analytics tag and a session recording tool, both only after you accept them in our cookie banner (if you decline, visits are counted without any cookie or identifier, and your choice is kept in one small cookie); the sign-in cookies of the Weaver dashboard; and, once you have signed in, a small cookie on weaverall.com holding your display name and the names of the websites in your account, so this site can offer you your dashboard instead of a signup form. That last one carries no password, no access token and no email address, and it is removed when you sign out.

Your Rights

You may access, correct, delete, or export your data. Requests: privacy@weaverall.com. A website owner can download or erase what Weaver holds about one of their visitors from the Privacy page of their dashboard.

Children

Not intended for children under 16. Do not send data about minors without legal basis.

Changes

We may update this Policy; we'll post a new date and notify you of major changes.

Contact

privacy@weaverall.com