Privacy Policy

Last updated: 25 September 2026

This policy explains what personal data Impact Tech, a sole proprietorship registered in Mumbai, India that owns and operates Weaver ("Weaver", "we", "us"), collects, why we collect it, how long we keep it, who we share it with, and the choices you have. It covers our website at theweaverapp.com and demos.theweaverapp.com (the "Site") and the Weaver software service, including its web app, mobile app, and messaging integrations (the "Service").

1. Our two roles

We handle personal data in two different capacities, and your rights depend on which one applies.

As a controller. For visitors to the Site, people who book a demo or contact us, and the account holders and users of businesses that subscribe to the Service, we decide how and why data is processed. This policy applies directly.
As a processor. The records a subscribing business ("Customer") stores inside its Weaver app, such as its own leads, contacts, deals, tasks, files and messages ("Customer Content"), belong to that Customer. We process Customer Content only on the Customer's instructions under our agreement with them. If you are a contact or employee of a Customer and want to access, correct or delete data about you in their Weaver app, please ask that Customer. We will help them respond.

2. Data we collect on the Site

Demo requests and contact forms

When you book a demo we collect your name, company, work email address, phone or WhatsApp number, company size, an optional message, and the page and button you used to reach the form. Submissions are checked by Cloudflare Turnstile to block bots, which processes your IP address and browser signals for that purpose. We also check that your email domain accepts mail. Submissions are stored in a Google Sheet accessible only to the Weaver team and used to follow up with you.

WhatsApp and email

If you message us on WhatsApp or email us, we receive your phone number or email address, your name as shown by that service, and the content of your messages. WhatsApp messages are also handled under Meta's own privacy terms.

Usage and device data

When you browse the Site we collect standard technical data: IP address, browser and device type, operating system, referring page, pages viewed, time on page, clicks and scroll depth, approximate location derived from your IP address, and campaign parameters (UTM tags) in the URL you arrived on. This is collected through Google Analytics, Google Ads conversion tracking and PostHog. See Cookies and analytics.

Short links

Links of the form theweaverapp.com/r/… redirect to a page on the Site. The redirect itself does not log your click. Once you land on the Site, normal analytics apply.

3. Data we collect in the Service

Account data

To create and run a Customer's Weaver app we hold the name, email address, phone number, role and login details of each user the Customer invites, plus the Customer's business name, plan and billing contact.

Customer Content

Whatever the Customer's team enters into their app: records, notes, attachments, comments, voice notes, and messages sent to or from the app through WhatsApp, Slack, Microsoft Teams or email. We process this as a processor, as described in section 1.

Connected services

When a Customer connects another system to Weaver (an existing CRM, a messaging platform, an email account, a webhook), we store the credentials or tokens needed for that connection, encrypted, and exchange data with that system as configured by the Customer.

Service logs

We keep technical logs of requests to the Service, including IP address, user id, timestamp, the action performed and any errors, to run, secure and debug the Service. We also keep an audit trail of changes to records so that Customers can see who changed what.

4. How we use data

To respond to demo requests and enquiries, and to tell you about Weaver if you asked us to.
To provide, operate, secure and support the Service, including sending transactional emails and messages such as invites, notifications and alerts.
To run the AI features described in section 6.
To understand how the Site and Service are used so we can improve them.
To measure marketing campaigns and, where you have consented, to show relevant ads.
To detect and prevent abuse, fraud and security incidents.
To comply with law and enforce our terms.

We do not sell personal data. We do not use Customer Content to train AI models.

5. Legal bases

Where the EU or UK GDPR applies, we rely on: contract to provide the Service to Customers and their users; legitimate interests to run and secure the Site and Service, follow up on business enquiries, and measure how the Site is used; consent for non-essential cookies, advertising measurement and marketing messages, which you can withdraw at any time; and legal obligation where the law requires us to keep or disclose data.

Where India's Digital Personal Data Protection Act 2023 applies, we process personal data for the purposes you have consented to or for the legitimate uses the Act allows, such as fulfilling a service you have asked for.

6. AI features

Weaver includes AI features such as answering questions about your data in plain language, turning voice notes into record updates, drafting messages and running automations. To do this, the relevant parts of your prompt and Customer Content are sent to a large language model.

Models run through Amazon Bedrock inside our AWS account. Under AWS's terms, prompts and outputs are not stored by the model provider and are not used to train or improve any model.
Voice notes are transcribed and then processed in the same way as typed text.
We keep the AI conversation history inside the Customer's app so users can review it, subject to the retention rules in section 9.
AI output can be wrong. Customers remain responsible for decisions made using it.

We share personal data only with service providers that process it on our behalf, and only as needed to run the Site and Service:

Amazon Web Services — hosting, databases, file storage, transactional email and AI models.
Cloudflare — content delivery, DNS, bot protection (Turnstile), hosting of the Site and the app front end, and email routing for our own addresses.
Google — Google Analytics and Google Ads measurement on the Site, Google Sheets for storing demo requests, and Google Fonts.
PostHog — product analytics on the Site.
Meta (WhatsApp Business Platform), Slack and Microsoft — when you or a Customer chooses to use Weaver through those platforms, messages pass through them under their own terms.
Services a Customer connects — data flows to and from any system the Customer integrates, under that Customer's instructions.

We may also disclose data where required by law, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the data transferred.

8. Cookies and analytics

The Site uses cookies and similar technologies for:

Essential — security (Cloudflare, Turnstile) and remembering form state. These cannot be turned off.
Analytics — Google Analytics and PostHog, to understand traffic and page behaviour.
Advertising measurement — Google Ads conversion tracking, to know when a demo booking came from an ad. If you submit the demo form, a hashed version of your email and phone number may be sent to Google to improve conversion matching.

You can block or delete cookies in your browser settings. You can opt out of Google Analytics with the browser add-on and manage Google ad settings at adssettings.google.com. The Service itself uses only the cookies and local storage needed to keep you signed in and remember your preferences.

9. How long we keep data

Demo requests and enquiries — up to 24 months after our last contact, unless you become a Customer.
Site analytics — Google Analytics data is retained for 14 months; PostHog data for up to 12 months.
Account data and Customer Content — for as long as the Customer's subscription is active, then deleted or returned within 90 days of termination unless the law requires longer. Customers can delete records at any time inside their app.
Service logs — up to 12 months.
Backups — encrypted backups are rotated within 35 days of deletion from live systems.

10. Security

Data is encrypted in transit (TLS) and at rest. Each Customer's data is logically isolated within our multi-tenant runtime. Access to production systems is limited to named team members using multi-factor authentication, and integration credentials are stored encrypted. We keep audit logs of changes to Customer records. No system is completely secure, and if we become aware of a breach affecting your data we will notify you and any regulator as the law requires.

11. Where data is stored

The Service runs on AWS data centres in the United States and India, and the Site and app front end are served through Cloudflare's global network. Our service providers may process data in other countries. Where data leaves the EU, UK or another jurisdiction with transfer rules, we rely on the providers' standard contractual clauses or equivalent safeguards.

12. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent. To exercise any of these, email us at [email protected]. We will respond within 30 days. You can also complain to your local data protection authority.

If your data sits inside a Customer's Weaver app, we will pass your request to that Customer and assist them, since they control that data.

To unsubscribe from marketing messages, use the link in the message or reply "stop" on WhatsApp.

13. Children

The Site and Service are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service changes. We will post the new version here with a new "last updated" date, and for material changes we will notify Customers by email or inside the app before they take effect.

15. Contact

Impact Tech (proprietor: Sagar Jagdeep Sodah)
Mumbai, Maharashtra, India
GSTIN: 27ENDPS5256Q1Z2
Email: [email protected]