Privacy Policy

This policy explains what personal data Weave collects, why we collect it, how long we keep it, and the rights you may have under the EU General Data Protection Regulation (GDPR), UK GDPR and applicable US state privacy laws. It is written to be readable by a 16-year-old. If anything is unclear, email tjong.willem@gmail.com and we will explain it.

Who is responsible for your data

Weave (contact: tjong.willem@gmail.com) is the data controller for the personal data described here. This is the address to use for any privacy question, request or complaint.

Minimum age

Weave is only for people aged 16 and over, regardless of the lower age that might apply under a local law. We ask you to confirm your age when you create an account and record that confirmation. We do not knowingly collect data from anyone under 16. If we learn that such an account exists, we disable it, investigate promptly and delete its personal data unless preservation is necessary to protect a child or comply with law.

What we collect

• Account data: your name, email address, password (stored only as a secure hash), and your age and terms confirmation.
• Profile data you choose to add: school or university, course, year, company and job title, a short summary, interests, skills, goals and an optional LinkedIn link.
• Activity data: intro requests you send or receive, messages inside a conversation, availability you submit, meeting links, and notes or transcripts you choose to upload.
• Technical data: basic logs needed to run and secure the service.

We do not ask for and do not want special category data (health, religion, ethnicity, sexual orientation, political views) or financial information. Please do not put it in free-text fields.

Why we use it, and our legal basis

• To run your account and match you with mentors — performance of our contract with you.
• To send emails about intro requests, scheduling and reminders — performance of our contract; you can turn off non-essential emails at any time.
• To keep members safe, handle safety reports and prevent misuse — our legitimate interest in a safe service, and our duty of care towards younger members.
• To improve profile summaries with automated text processing — our legitimate interest in a useful service. No automated decision has a legal or similarly significant effect on you.
• Optional announcement emails — consent, withdrawable at any time.

Who can see your data

• Other signed-in members see your profile and, if you connect, your name and the messages you send them.
• Signed-out visitors only see a limited, anonymised preview of profiles: first name only, no email address, no LinkedIn link and no exact identifiers.
• Service providers who process data on our behalf under contract: our hosting and database provider, our email delivery provider, our video-meeting provider and an AI text provider used to tidy up profile summaries.
• We never sell your data and we do not use it for advertising.

International transfers

Some providers process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Account and profile data: until you delete your account.
• Conversation and scheduling records: up to 24 months after the conversation, then deleted.
• Safety reports: up to 3 years, because we may need them to protect other members.
• Email delivery records: up to 12 months.

Your rights

You can access, correct, delete, restrict or object to our use of your data, and ask for a copy in a portable format. You can do the two most important ones yourself, straight away, on your profile page: download everything we hold about you, and permanently delete your account. For anything else, email tjong.willem@gmail.com — we answer within 30 days. You also have the right to complain to your national data protection authority.

Depending on where you live, including in certain US states, you may also have rights to know, correct or delete personal information, receive a portable copy, and opt out of sale, sharing or targeted advertising. We do not sell personal information and do not use it for targeted advertising. We do not discriminate against anyone for exercising a privacy right. A parent, guardian or authorised agent may contact us where local law permits them to act for you.

Security

Data is encrypted in transit, access to the database is restricted per member by row-level security rules, and administrative access is limited to the Weave operator. If a breach is likely to put you at risk, we notify you and the relevant authority within 72 hours.

Cookies

Weave only uses strictly necessary cookies and local storage to keep you signed in. We use no advertising or third-party tracking cookies, so no cookie consent banner is required.

This policy describes Weave's current practices; it is not a certification of compliance in every jurisdiction. It should be reviewed by a qualified privacy lawyer before relying on it for a specific legal obligation.