What we do with your data, in plain terms.

What this covers

WeaveAI Labs builds three products — Anchor, Cite and Ready — that run on one account. This policy covers all of them, and the marketing site at weaveai.dev.

Two kinds of data are involved and they are worth separating, because they are treated differently throughout. Account data is what identifies you: your email, your workspace, your subscription. Customer content is what you give a product to work on: the documents Anchor indexes, the sources Cite checks, the repositories Ready reads. We treat customer content as yours, not ours.

What we collect

Account data, when you sign up: your email address, the name you supply, and the workspace you belong to. Authentication is handled by Supabase; we never see or store your password.

Customer content, when you provide it: documents you upload, spaces or files you connect, and the questions you ask. Anchor extracts text from what you upload so it can be searched, and stores mathematical representations of that text — embeddings — so it can find the passages relevant to a question.

Operational data: request logs, error reports and usage counts against your plan's limits. These exist so the service can be run and billed, not to build a profile of you.

Payment details are collected by Dodo Payments, our merchant of record. Card numbers never reach our servers.

What we do not do

We do not train models on your content. Answers are generated by third-party models through Amazon Bedrock, which does not use inputs passed through it to train its models.

We do not sell your data, and we do not share it with advertisers.

We do not read your documents except where necessary to operate the service or where you ask us to help with a specific problem.

How your content is separated from other customers'

Each workspace has its own namespace in the vector store and its own scope in the database. A search issued for one workspace has no way to address another's data — the isolation is structural rather than a filter that could be forgotten.

Credentials for connected sources are encrypted before they are stored, using AES-256-GCM with a key held outside the database. Database access alone does not yield a usable credential.

How long we keep it

Conversation history is kept for a limited window that depends on your plan — 24 hours on Free, 7 days on Starter, 30 days on Enterprise — and is deleted automatically after that. This is a retention promise, not only a usage limit, which is why the window is stated in the product itself.

Uploaded files are deleted once their text has been extracted. The extracted text and its embeddings stay until you delete the source or close your account.

Credentials for a connected source are deleted when you disconnect it.

Account and billing records are kept while your account is open, and afterwards only as long as tax and accounting obligations require.

Google user data

When you connect Google Docs, Anchor requests read-only access to the documents you authorise — nothing else. It does not request access to your Drive listing, because it never needs to see what else you have.

Anchor's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: document content is used only to answer questions inside your own workspace, it is never sold, never transferred to anyone except the sub-processors listed below that are needed to run the service, never used for advertising, and never read by a human except with your explicit permission or where required by law.

Content from a connected Google account is not used to train any model. Disconnecting Google removes the stored credentials immediately, and deleting the source removes its text and embeddings.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Deleting a source removes its text and embeddings; closing your account removes the rest.

Write to hello@weaveai.dev and we will respond within 30 days. If you are in the UK or EU and are unhappy with our response, you have the right to complain to your data protection authority.

Where your data is processed

Our infrastructure runs in the United States. If you are outside the US, your data is transferred there to be processed.

Changes

If we change this policy in a way that materially affects how your data is handled, we will tell account holders by email rather than quietly updating the date at the top.

Who else processes your data

These are the services customer data reaches, and why. Atlassian and Google appear only if you choose to connect them.