In short
- We collect what we need to run the app and bill you. Nothing is sold, ever.
- Your data is stored in the EU. The AI features send text to OpenAI in the United States.
- Your content is never used to train anyone's AI models.
- Ask for a copy of your data, or for its deletion, at any time.
Who is responsible
The controller of your personal data is Cattaneo Lorenzo, P.IVA IT01677710194, Italy, operating as weacon. Write to contact@weacon.io about anything on this page.
For account, billing and website data we are the controller — we decide what is collected and why. For the content inside a workspace, the organisation that created it is the controller and weacon is the processor, handling that content on its instructions; the terms of service and this policy together form the agreement required by Article 28 of the GDPR.
What we collect
| Category | What it includes |
|---|---|
| Account | Your name and email address, your sign-in credentials, and your workspace membership and settings. |
| Workspace content | Whatever you and your team put into a workspace — notes, documents, plans, tasks, files, comments and their history — including any personal data it contains. |
| Billing | Your billing email and the subscription records Paddle sends us. Card details are handled by Paddle and never reach us. |
| Technical | Your IP address and browser, stored with each sign-in and used to rate-limit abuse. |
If you email us, we keep the correspondence.
Why, and on what basis
AI processing
When you use a feature that turns notes into plans or proposes a documentation update, the relevant text is sent to OpenAI, which acts as our processor and handles it in the United States. That transfer is covered by our data processing agreement with OpenAI, which incorporates the European Commission's standard contractual clauses. Under that agreement your content is not used to train its models. Only the content needed for the request is sent, and AI features run only when a member invokes them. Workspace text is also turned into embeddings — numerical representations used for search and for linking related material — by the same service, and those are stored back in our own database in the EU alongside your content.
How long we keep it
| Workspace content and account | deleted straight away |
|---|---|
| Backups and payment records | up to 30 days |
| Text sent to the AI features | held by OpenAI up to 30 days |
Deleting your account deletes it and its files immediately; the backups and payment records above age out within 30 days. Paddle keeps the invoices themselves under its own retention policy, because it is the seller of record — we do not hold them.
The text the AI features send to OpenAI is kept by OpenAI for up to 30 days so it can check for abuse, then deleted. It is never used to train its models, and we keep no separate copy of it — only the embeddings described above, which live in our own database. Deleting your content here does not reach a copy still inside that 30-day window, so it can outlive the deletion by up to a month.
How it is protected
Traffic is encrypted with TLS and data is encrypted at rest. Passwords are stored as one-way hashes, and an account can use a passkey instead. Access to production systems is limited to the operator, and backups are automated. If a breach affects your personal data we will notify the Garante per la protezione dei dati personali within 72 hours where required, and tell affected users directly.
Your rights
Under the GDPR you can ask us for a copy of your data, or to correct it, delete it, restrict or object to how we use it, port it elsewhere, or withdraw consent where consent is what we relied on. Write to contact@weacon.io and we will respond within 30 days.
If your account belongs to an organisation's workspace, we will pass the request to its administrators, since the content is theirs to decide on. Deleting your account deletes any workspace where you are the only administrator, along with its content, and strips your name and email address from the account record — so the work you contributed to shared workspaces keeps its history without being attributable to you.
Contact and complaints
When this policy changes, the version and date at the top change with it. Changes that affect how your data is used are emailed to account holders 30 days before they take effect.