Last updated: July 24, 2026
This is Weavay's Privacy Policy. See also the Terms of Service.
1. Controller
Jakob Pütz, operating Weavay, Germany ("Weavay", "we") is the controller responsible for your data under the General Data Protection Regulation (GDPR). Contact: [email protected].
2. What we collect
- Account data: name, email address, and profile fields you give us.
- Mailbox data: messages, headers, attachments, and folder state once you connect a mailbox or domain.
- Graph data: the people, threads, documents, and edges Weavay derives from your mailbox, plus any AI-derived facts.
- Billing data: your plan and payment references, handled by our payment processor (Stripe). We never see or store full card numbers.
- Usage and device data: IP address, browser, and basic diagnostics we need to run and secure the service.
3. Why we process it, and on what basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing your inbox, sync, and graph | Art. 6(1)(b) – performance of a contract |
| Optional AI summaries, smart replies, writing checks, and fact extraction | Art. 6(1)(a) – consent, where you enable them |
| Billing Pro and Max subscriptions | Art. 6(1)(b) – performance of a contract |
| Fraud prevention, abuse detection, security logging | Art. 6(1)(f) – legitimate interest |
| Legal and tax record-keeping | Art. 6(1)(c) – legal obligation |
We do not sell your data, and we do not use your mail content to train general-purpose AI models.
4. AI features
AI summaries, smart replies, writing checks, and fact extraction run only when you ask for them on a plan that allows it, and stay source-linked to the messages they came from — we don't generate or invent facts about you. Inbox sorting is rule-based and never uses AI. You can disable AI features at any time in Settings; disabling stops new processing but does not retroactively delete facts already derived, which you can remove individually.
5. Sharing and processors
We share personal data only with processors who help us run the product under a data processing agreement — infrastructure and email hosting, authentication, transactional email delivery, and payments — or when required by law. Where a processor is located outside the EU/EEA, we rely on Standard Contractual Clauses or an equivalent safeguard. We do not sell personal data or share it with data brokers.
6. International transfers
Some processors we use (for example, U.S.-based infrastructure or payment providers) may process data outside the EU/EEA. Where that happens, we ensure an adequate level of protection through Standard Contractual Clauses (Art. 46 GDPR) or a recognized adequacy decision.
7. Retention
We retain account and mailbox data for as long as your account is active. If you disconnect a mailbox or delete your account, we delete the associated mail and graph data within 30 days, except where we must retain records to meet a legal obligation (for example, invoices for tax purposes).
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15).
- Rectify inaccurate data (Art. 16).
- Erase your data ("right to be forgotten") (Art. 17).
- Restrict or object to processing (Art. 18, 21).
- Port your data to another provider in a structured, machine-readable format (Art. 20).
- Withdraw consent at any time, without affecting processing carried out before withdrawal.
- Lodge a complaint with a supervisory authority — in Germany, the data protection authority of the state where we're established, or your own EU/EEA member state's authority.
Most of these you can exercise directly from Settings (export, disconnect, delete). For anything else, email [email protected] and we'll respond within 30 days.
9. Cookies and similar technologies
We use strictly necessary cookies for authentication and session state, and no third-party advertising or tracking cookies. Where we introduce optional analytics cookies in the future, we'll ask for consent first.
10. Children
Weavay is not directed at children under 16. We do not knowingly collect personal data from children under that age.
11. Changes to this policy
We'll post material changes here and update the "Last updated" date above. Continued use after a change takes effect constitutes acceptance of the update.
12. Contact
Questions or requests: [email protected].
Weavay Legal