Data processing at Weaver.

You are the controller. You decide why and how personal data is processed in your applications. We are the processor: Wvr Tech Sweden AB, org nr 559610-1443, Vanadisplan 8, 113 31 Stockholm. We process that data only to provide the platform to you, and only on your instructions.

Your people design and configure the apps they build on Weaver. So you are responsible for each app’s purpose, the personal data it collects and its legal basis, its access settings, how long the app keeps data, and what you tell the people concerned. We are responsible for the platform and its hosting.

Purpose: operating the platform, including hosting and running your apps, support, security monitoring, and usage and cost reporting.

People concerned: your employees and contractors who use the platform, and the end users of your apps, who may include your clients and other external users.

Data:

• Content: app source code and configuration, data in your apps’ databases and file storage, uploaded files, and AI prompts and chat transcripts.
• Identity: names, email addresses, avatars, roles, organisation memberships and sessions, including data from your identity provider.
• Metadata and logs: identifiers, timestamps, audit and access logs, and operational telemetry.

Our technical and organisational measures are listed on our security page. They include a zero-trust gate in front of every app, no public ingress, single sign-on, separation per application, central secret management, hardened workloads and continuous scanning. Everyone at Weaver with access to personal data is bound by confidentiality.

If your agreement places production in your own Kubernetes cluster, you are responsible for that infrastructure and we remain responsible for the platform that builds and manages your apps.

We use the companies below, each bound in writing to data protection obligations equivalent to ours. We tell you before we add or replace one, as your agreement sets out. Your own configuration decides which AI models are enabled. Status as of 15 October 2026.

Where a sub-processor handles data outside the EU/EEA, the transfer rests on a European Commission adequacy decision, such as the EU–US Data Privacy Framework, or on its Standard Contractual Clauses. GitHub, Inc. hosts the source code of the Weaver platform itself, and Google Cloud stores our encryption keys and credentials in the EU. Neither holds your content or your apps’ data.

AI requests pass through our gateway, which sends them to the model providers enabled for you. IT chooses which models apps may use, and you can route requests to your own model endpoints, for example in Azure AI Foundry. For those endpoints, your agreement with that provider applies.

We do not use your content to train models, and the providers we use do not train on it under their terms.

The data processing agreement you sign with us holds the binding terms: how long data is kept, how we notify you of a personal data breach, how we help you answer requests from the people concerned, audits, and the return and deletion of your data when the agreement ends. Where it differs from this page, the agreement applies.

You can export your data at any time: clone the Git repositories, export databases and download stored files.