Privacy Policy

This policy explains what personal data Weave collects, why we collect it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR. It is written to be readable by a 16-year-old. If anything is unclear, email tjong.willem@gmail.com and we will explain it.

Who is responsible for your data

Weave (contact: tjong.willem@gmail.com) is the data controller for the personal data described here. This is the address to use for any privacy question, request or complaint.

Minimum age

Weave is only for people aged 16 and over. This is the age at which a young person can consent to online services on their own under Article 8 GDPR in the EU. We ask you to confirm your age when you create an account, and we record that confirmation. If we learn that an account belongs to someone under 16, we delete the account and its data.

What we collect

• Account data: your name, email address, password (stored only as a secure hash), and your age and terms confirmation.
• Profile data you choose to add: school or university, course, year, company and job title, a short summary, interests, skills, goals and an optional LinkedIn link.
• Activity data: intro requests you send or receive, messages inside a conversation, availability you submit, meeting links, and notes or transcripts you choose to upload.
• Technical data: basic logs needed to run and secure the service.

We do not ask for and do not want special category data (health, religion, ethnicity, sexual orientation, political views) or financial information. Please do not put it in free-text fields.

Why we use it, and our legal basis

• To run your account and match you with mentors — performance of our contract with you.
• To send emails about intro requests, scheduling and reminders — performance of our contract; you can turn off non-essential emails at any time.
• To keep members safe, handle safety reports and prevent misuse — our legitimate interest in a safe service, and our duty of care towards younger members.
• To improve profile summaries with automated text processing — our legitimate interest in a useful service. No automated decision has a legal or similarly significant effect on you.
• Optional announcement emails — consent, withdrawable at any time.

Who can see your data

• Other signed-in members see your profile and, if you connect, your name and the messages you send them.
• Signed-out visitors only see a limited, anonymised preview of profiles: first name only, no email address, no LinkedIn link and no exact identifiers.
• Service providers who process data on our behalf under contract: our hosting and database provider, our email delivery provider, our video-meeting provider and an AI text provider used to tidy up profile summaries.
• We never sell your data and we do not use it for advertising.

International transfers

Some providers process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Account and profile data: until you delete your account.
• Conversation and scheduling records: up to 24 months after the conversation, then deleted.
• Safety reports: up to 3 years, because we may need them to protect other members.
• Email delivery records: up to 12 months.

Your rights

You can access, correct, delete, restrict or object to our use of your data, and ask for a copy in a portable format. You can do the two most important ones yourself, straight away, on your profile page: download everything we hold about you, and permanently delete your account. For anything else, email tjong.willem@gmail.com — we answer within 30 days. You also have the right to complain to your national data protection authority.

Security

Data is encrypted in transit, access to the database is restricted per member by row-level security rules, and administrative access is limited to the Weave operator. If a breach is likely to put you at risk, we notify you and the relevant authority within 72 hours.

Cookies

Weave only uses strictly necessary cookies and local storage to keep you signed in. We use no advertising or third-party tracking cookies, so no cookie consent banner is required.

This policy is provided in good faith and should be reviewed by a qualified lawyer before relying on it for a specific legal obligation.