Privacy Policy

1. Who we are

Weave is operated by Anterra Ltd, a company registered in England and Wales (company number [TO CONFIRM: company number]), whose registered office is at [TO CONFIRM: registered office address] ("Anterra", "we", "us"). We are registered with the UK Information Commissioner's Office (ICO) under registration number [TO CONFIRM: ICO data protection fee registration number].

This policy covers the web platform at www.weave.directory, the hosted Weave server at api.weave.directory, and the parts of the Weave CLI that talk to them (together, the "Service"). We have not appointed a data protection officer; questions go to our privacy contact at privacy@weave.directory.

EU representative. Where the EU GDPR requires it, our representative in the EU is [TO CONFIRM: name and address of EU Article 27 representative, or confirm one is not required].

2. Our role: controller and processor

Data protection law treats us differently depending on the data:

• We are the controller for account and profile data, sign-in and security data, billing records, messages you send us, newsletter subscriptions, and the server logs we keep to run and protect the Service. This policy describes that processing.
• We are a processor for Customer Content: the code and other files in your repositories, and the workstreams, stitches, suggestions, change requests, decision records, symbol threads and operation-log entries created in them. The organisation or account that owns a repository ("the customer") is the controller of any personal data inside it, such as names and email addresses in code, comments or commit messages. We process that data only to provide the Service and on the customer's instructions. If your personal data appears in a repository someone else controls, please contact that organisation first; we will help them respond.

Data Processing Addendum. Business customers can request our Data Processing Addendum, which sets out the Article 28 UK GDPR / EU GDPR terms for Customer Content, by emailing privacy@weave.directory.

3. Personal data we collect

What we do not collect. We do not use analytics, advertising or tracking scripts on the platform, and the Weave CLI does not send usage telemetry to us. We do not ask for special category data (such as health or ethnicity) and you should not put it in your profile.

Drafts on your device. Changes in your local draft lane stay on your machine until you stitch them, with one exception: when you run indexing, or the Weave watcher re-indexes files you save, the CLI sends the symbol names, docstrings and decision-thread text from those files to the Weave server for search (see section 5). The full source of a draft is not uploaded until you stitch it.

Public information. Your name, avatar, bio, location and website appear on your public profile. If a repository is public, anyone can read its content, history and the names of people who contributed to it.

4. How we use personal data and our lawful bases

Where we rely on legitimate interests you can object (section 10). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI features produce suggestions for you and your team to review; they do not decide anything about you.

5. AI processing

Weave uses AI in three ways. Only the first two involve us.

1. Embeddings for search (OpenAI). When you index a repository, the Weave server sends the text of each symbol — its name, docstring and any decision-thread text — to OpenAI to create an embedding, and stores the text and embedding in our database so you can search by meaning. Search queries, resolve intents and impact-prediction intents are also sent to OpenAI to be embedded. Full source files are not sent for embeddings.
2. Resolve (OpenAI chat). When you ask Weave to resolve an intent into a plan, the server sends your intent together with the most relevant indexed symbol text (identifiers, docstrings, decision threads, visibility and the symbols they call) to an OpenAI chat model and returns its answer to you.
3. weave enrich (your own provider). The CLI's enrich command sends the source code of the symbols you select from your machine directly to the AI provider you configure (Anthropic, OpenAI or Google Gemini) using your own API key. That data does not pass through Anterra, and your use of that provider is governed by your agreement with them.

OpenAI processes this data as our subprocessor in the United States. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models unless the customer opts in, and we have not opted in. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring [TO CONFIRM: current OpenAI API data-retention and training terms, and whether a DPA / zero-data-retention arrangement is in place with OpenAI]. We do not use your code or Customer Content to train AI models.

The Weave server can be configured to use Google Gemini or Anthropic instead of OpenAI. If we change the provider used by the hosted service, we will update the subprocessor list and give notice as described there. AI output can be wrong; see the Terms.

6. Who we share personal data with

• Our service providers (processors), who host and run the Service for us under written contracts: Vercel, Google Cloud, Prisma (database hosting), Resend (email), OpenAI (AI features) and, when paid features are enabled, Stripe. The full list, with locations and transfer safeguards, is on our Subprocessors page.
• Other users, as the Service is designed: members of your organisations, teams and repositories see your name, avatar and the work you do there; anyone can see public profiles and public repositories.
• Independent controllers you choose to use: GitHub or Google if you sign in with them; Stripe for its own fraud-prevention and regulatory obligations when you pay; and any webhook URL or AI provider you configure.
• Professional advisers, authorities and courts where required by law or to establish, exercise or defend legal claims.
• A buyer or successor if our business or assets are sold or reorganised, subject to this policy.

We do not sell personal data or share it for advertising.

7. International transfers

The Weave server and its database run on Google Cloud in the United States (region us-central1, Iowa); repository files and images are stored in Google Cloud Storage in the EU (multi-region) but are processed by the server in the United States. Our web hosting, email and AI providers also process data in the United States. The platform database is hosted by Prisma in [TO CONFIRM: Prisma Postgres region]. Transfers of personal data from the UK or EU to these providers are protected by one or more of:

• the UK Extension to the EU–US Data Privacy Framework (UK–US "data bridge") and the EU–US Data Privacy Framework, where the recipient is certified;
• the EU Standard Contractual Clauses (Commission Decision 2021/914) with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement, in the provider's data processing terms.

The mechanism used for each provider is listed on the Subprocessors page. You can ask for a copy of the relevant safeguards at privacy@weave.directory.

8. How long we keep data

9. Security

We use TLS for all traffic to the platform and API; hash passwords (bcrypt) and access tokens (SHA-256); encrypt 2FA secrets and repository secrets (AES-256-GCM); keep infrastructure secrets in Google Secret Manager; restrict service accounts to the permissions they need; rate-limit sign-in and other sensitive actions; and keep backups. Our providers encrypt data at rest. More detail is on our Security page.

Personal data breaches. If a breach is likely to result in a risk to people's rights and freedoms, we will notify the ICO (and any other competent supervisory authority) without undue delay and, where feasible, within 72 hours of becoming aware of it. If it is likely to result in a high risk to you, we will tell you directly without undue delay. For Customer Content, we will notify the affected customer without undue delay so they can meet their own obligations. To report a security issue, email security@weave.directory.

10. Your rights

Under UK GDPR and EU GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• object to processing based on legitimate interests, and to direct marketing at any time;
• receive data you gave us in a portable, machine-readable format;
• withdraw consent where we rely on it, without affecting earlier processing.

How to exercise them

• Correct your profile in your account settings.
• Export your account data as JSON from your account settings. For a fuller copy (including organisation memberships, billing and usage records), email privacy@weave.directory.
• Delete your account from your account settings. If you are the only owner of an organisation, you will need to transfer ownership or delete the organisation first.
• Unsubscribe from the newsletter using the link in any newsletter email or by emailing privacy@weave.directory. You can switch off notification emails in your notification settings.
• For anything else, email privacy@weave.directory.

We will respond within one month (extendable by two months for complex requests, in which case we will tell you why). We may need to verify your identity first. There is normally no fee. Requests about Customer Content should go to the organisation that controls the repository; we will pass them on and help.

11. Children

Weave is a professional software development tool and is not directed at children. You must be at least 16 to create an account. If you believe a child under 16 has given us personal data, contact privacy@weave.directory and we will delete it.

12. Complaints

Please contact us first at privacy@weave.directory so we can try to put things right. You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are in the EU/EEA you can complain to the supervisory authority where you live or work.

13. Cookies

We only use cookies that are strictly necessary to sign you in and keep your session secure. See our Cookie Policy.

14. Changes to this policy

We will update this policy when our processing changes. We will show the new effective date at the top and, for material changes, tell account holders by email or in the platform before the change takes effect.

15. Contact

Anterra Ltd, [TO CONFIRM: registered office address]. Email: privacy@weave.directory.