Last updated: July 24, 2026

This is Weavay's Privacy Policy. See also the Terms of Service in this inbox.

1. Controller

Jakob Pütz, operating Weavay, Germany ("Weavay", "we") is the controller responsible for your data under the General Data Protection Regulation (GDPR). Contact: [email protected].

2. What we collect

• Account data: name, email address, and profile fields you give us.
• Mailbox data: messages, headers, attachments, and folder state once you connect a mailbox or domain.
• Graph data: the people, threads, documents, and edges Weavay derives from your mailbox, plus any AI-derived facts.
• Billing data: your plan and payment references, handled by our payment processor (Stripe). We never see or store full card numbers.
• Usage and device data: IP address, browser, and basic diagnostics we need to run and secure the service.

3. Why we process it, and on what basis

We do not sell your data, and we do not use your mail content to train general-purpose AI models.

4. AI features

AI sorting, summaries, smart replies, writing checks, and fact extraction run only when your plan and settings allow it, and stay source-linked to the messages they came from — we don't generate or invent facts about you. You can disable AI features at any time in Settings; disabling stops new processing but does not retroactively delete facts already derived, which you can remove individually.

5. Sharing and processors

We share personal data only with processors who help us run the product under a data processing agreement — infrastructure and email hosting, authentication, transactional email delivery, and payments — or when required by law. Where a processor is located outside the EU/EEA, we rely on Standard Contractual Clauses or an equivalent safeguard. We do not sell personal data or share it with data brokers.

6. International transfers

Some processors we use (for example, U.S.-based infrastructure or payment providers) may process data outside the EU/EEA. Where that happens, we ensure an adequate level of protection through Standard Contractual Clauses (Art. 46 GDPR) or a recognized adequacy decision.

7. Retention

We retain account and mailbox data for as long as your account is active. If you disconnect a mailbox or delete your account, we delete the associated mail and graph data within 30 days, except where we must retain records to meet a legal obligation (for example, invoices for tax purposes).

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data ("right to be forgotten") (Art. 17).
• Restrict or object to processing (Art. 18, 21).
• Port your data to another provider in a structured, machine-readable format (Art. 20).
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint with a supervisory authority — in Germany, the data protection authority of the state where we're established, or your own EU/EEA member state's authority.

Most of these you can exercise directly from Settings (export, disconnect, delete). For anything else, email [email protected] and we'll respond within 30 days.

9. Cookies and similar technologies

We use strictly necessary cookies for authentication and session state, and no third-party advertising or tracking cookies. Where we introduce optional analytics cookies in the future, we'll ask for consent first.

10. Children

Weavay is not directed at children under 16. We do not knowingly collect personal data from children under that age.

11. Changes to this policy

We'll post material changes here and update the "Last updated" date above. Continued use after a change takes effect constitutes acceptance of the update.

12. Contact

Questions or requests: [email protected], or reply to this message.

Weavay Legal