Privacy Policy

Last updated: October 24, 2026

Who is responsible for your data

WEAVAWORX LTD is the controller for the personal data we use to run our website, accounts, subscriptions, billing, support, security and marketing. We are registered in England and Wales with company number 17002654 and registered office at 72 Hazel Way, London, United Kingdom, E4 8RP. Contact us at support@weavaworx.com.

WeavaWorx is used by businesses. When a business, or someone on its team, enters personal data about its own customers, staff, installers, suppliers or site contacts, that business is the controller of that data and we process it on the business’s behalf to provide the service. This includes what the business’s customers do on the online estimate, invoice and payment pages. Our Terms of Service set out how we process that data for businesses.

When a business takes card payments from its customers, it does so through its own Stripe account. Stripe handles those payments for the business, under Stripe’s own terms and privacy notice.

Personal data we collect

• Account: your name, email address, password (stored by our sign-in provider as a one-way hash, never readable by us), Google account identifier if you sign in with Google, profile picture, language, currency and app settings.
• Business: business name, logo, address, contact details, tax and numbering settings, bank or payment details you choose to show on documents, email templates, document terms and cancellation wording.
• Team: the people in a business, their roles, invitations, which devices they are signed in on, and a record of important team actions (such as invites, role changes and devices signed out).
• Jobs and customers: customer and site contact names, addresses, phone numbers and emails, notes, rooms and measurements, floor plans, cutting plans, staircases, products and prices, photos and attachments, estimates, invoices, credit notes, job sheets, bookings, payment records, installer pay and installer invoices.
• Job locations: the map pin for a job site (latitude, longitude and address) and a small map picture of it.
• Subscriptions and billing: plan, currency, billing period, trial dates, subscription status, invoices and payment status, and the identifiers Stripe, Google Play and RevenueCat use for your purchase. Full card details are handled by Stripe or Google, not by us.
• Card payments from your customers: for each payment taken through a business’s Stripe account, the amount, Stripe’s fee, the method (card or Pay by Bank), the payer’s name and email as Stripe reports them, and refund and dispute status.
• Online estimate and invoice pages: when the page was viewed and how many times; and, if the customer accepts or declines online or asks a question, the name they typed, their signature if they drew one, what they chose, the date and time, their device’s internet address (IP address) and browser details.
• Voice: the words spoken when you use Measure by voice, which are turned into text (see “Measure by voice” below).
• Devices and diagnostics: device name and type, app version, when each device was last used, notification registrations, and error reports.
• Support and website: messages you send us, chat conversations, and the website data described under “Our website”.

Where data comes from

Most data comes directly from you and your team when you use WeavaWorx. We also receive data from Google (if you sign in with Google or pay through Google Play), Stripe and RevenueCat (subscription and payment status), Stripe for card payments taken by a business, a business’s customers when they use its online pages, and our security and error-reporting tools.

How the app uses your data

Signing in and security

You sign in with an email address and password or with Google. We may add Sign in with Apple later. On the web, sign-in, sign-up and password reset include a Cloudflare Turnstile security check, which looks at technical information about your browser and connection to tell people from bots. You can be signed in on up to 3 devices, and we keep a list of them so you can see and sign them out. Logging out, or being signed out, removes the account’s data from that device.

Subscriptions

Website plans are paid by card through Stripe. Android plans are paid through Google Play, and we use RevenueCat to check Google Play purchases. Website subscriptions are also recorded in RevenueCat, so there is one record of your plan wherever you paid. We send subscription emails, such as trial reminders, payment problems and cancellation confirmations.

To allow one free trial per person, we keep a one-way code made from your email address with a secret key (a keyed hash), together with the trial dates. We keep this even after your account is deleted, until 12 months after the trial ends, when it no longer stops a new trial. It does not include your email address, name or account.

Which link brought you to us

When you sign up, we keep which link brought you to us: for example an ad’s campaign name (the utm tags in the web address), Facebook’s or Google’s click ID if the link had one, and the first page you opened. Until you sign up, the app keeps this on your device for up to 90 days, so a sign-up a few days later still counts. We use it only to see which ads work, which is our legitimate interest. It is kept with your account, is never sold or shared, and is deleted when your account is deleted.

Team accounts

On the Team plan, the people in a business can see the business’s data according to their roles. The Owner can see who is in the business, their roles and devices, and can sign a member’s device out. If you belong to more than one business, each business sees only its own data and your role in it.

Online estimates and invoices

When a business sends an estimate or invoice, the app can create a private online page for its customer. The link contains a long random code; we store only a fingerprint (hash) of it. The page uses no cookies and no advertising or analytics trackers, and is not shown to search engines. We count a view after the page has been open for about 2 seconds, leaving out bots and the business’s own people, and use a short-lived fingerprint of the visitor’s IP address and browser to avoid counting the same visit twice.

If the customer accepts, we keep an acceptance record for the business: the name typed, the signature if drawn, the choices made, the terms and cancellation wording shown, the date and time, the IP address and browser details, the addresses the link was sent to and fingerprints of the document. For estimates in US dollars or US English, the record also shows the customer’s agreement to sign electronically. A PDF of the record is emailed to the customer and the business. Records can’t be changed after they are made. Questions asked on a page are emailed to the business and kept on the record in the app.

Card payments

When a business takes a payment, its customer pays on a Stripe-hosted page and enters card or bank details only there. Stripe tells us the result so the app can mark the record paid and keep the payment details listed above. WeavaWorx doesn’t take a fee and doesn’t hold the money.

Emails

We send emails through Resend: sign-in and account emails, subscription emails, team invitations, app notifications sent by email, and the emails businesses send their customers (estimates, invoices, job sheets, plans, photos and attachments, receipts, credit notes, payment reminders, estimate follow-ups, booking emails with a calendar invite, and acceptance confirmations). Emails businesses send show the business’s name and reply-to address. Resend tells us whether each email was delivered, delayed, bounced or marked as spam, so the app can show whether it arrived. Our systems don’t record whether emails are opened or links clicked. We keep a copy of an email’s content and attachments for up to 3 days so it can be sent again if it bounces, and a history of sent emails in the account. Resend keeps its own copy of each email and its delivery log for 30 days.

Calendar feed

You can subscribe to your bookings in another calendar app with a private link. Our sync server builds the feed when your calendar app asks for it. It includes bookings from 90 days ago to 2 years ahead, with the customer’s name, address and phone numbers, the job, who is assigned and booking notes. Your calendar provider (for example Google, Apple or Microsoft) receives this data under its own terms. We store only a fingerprint of the link, and you can reset or turn it off at any time.

Measure by voice

When you measure by voice, the app records only while someone is talking and sends short pieces of audio, through our servers, to Deepgram, which turns speech into text. We ask Deepgram not to keep the audio or text or use it to improve its models (its “model improvement program” opt-out). Deepgram then keeps only technical details of each request, such as its length, not the audio or the text. We don’t store the audio. If there’s no signal, pieces of audio waiting to be sent are kept on your device and deleted once they have been turned into text, or after 7 days. We also send Deepgram words from your own business (such as product and room names) to help it recognize them.

The text is then sent to Anthropic’s Claude AI to turn it into rooms and measurements, with your room names and product names (not prices). You check the result before anything is added. The text is saved in the job’s notes, like other job data. We log only usage (such as talking time, word counts and cost) to count voice minutes, never the audio or the words, and delete these logs after 13 months. Anthropic doesn’t use what we send to train its AI models. It deletes it within 30 days, unless it needs to keep it longer to investigate misuse of its service or the law requires it.

When the speech service can’t be reached, for example with no signal, the app uses the phone’s own speech recognition instead. On most Android phones that is Google’s speech service, which works on the phone where an offline language pack is installed.

Supplier price lists

On Pro Plus and Team, the app can read a supplier’s PDF price list. Your device takes the text out of the PDF (or, for a scanned list, pictures of its pages) and sends it through our servers to Anthropic’s Claude AI, which returns the products and prices for you to check. We don’t keep the text, the pictures or the AI’s answer; we log only a fingerprint of the file and usage, and delete these logs after 13 months. Anthropic doesn’t use the price list to train its AI models, and deletes it within 30 days on the same terms as for Measure by voice.

Location and maps

You can drop a pin for a job site. If you tap “Use where I am now”, the app asks for permission and reads your device’s location once; it is saved only if you then tap Save. The app does not track your location in the background.

Maps are drawn with map tiles from OpenFreeMap, which uses OpenStreetMap data. Your device downloads the tiles directly, so OpenFreeMap sees your IP address and the area being shown. When you search for an address, the search goes through our sync server to Nominatim, the OpenStreetMap Foundation’s address search; Nominatim sees the search text but not your IP address, and our server keeps recent results in memory for up to 30 days without logging the search. Opening directions or a map link opens Google Maps, which then receives that address under Google’s terms. Booking messages you share with your installers through your phone can include a map link.

Notifications

If you allow notifications, we send them through Firebase Cloud Messaging on Android and through your browser’s push service on the web. The notification’s title and text pass through that service.

Photos, files, offline and sync

Photos, attachments, logos and PDFs are stored in private storage. Files open through links that last a limited time (usually an hour; 7 days for files sent to customers as links). To work without signal, the app keeps your business’s data on your device, in the app’s own storage or your browser’s storage, with a cache of recently used files (up to 30 days and 2 GB). That data is protected by your device’s own security; keep your device locked. Changes sync through our sync server over an encrypted connection when you’re online. Logging out removes the account’s data from the device, including Measure by voice recordings waiting to be sent and voice results waiting to be checked. Voice results are kept on the device for up to 30 days. Android’s automatic app backup is turned off for WeavaWorx.

Crash and error reporting

We use Sentry to find and fix errors in the app, the sync server and the online estimate and invoice pages. Reports include technical details such as the device, browser, app version and what went wrong. We don’t send names, emails, IP addresses, request contents or cookies: reports carry only your account’s internal ID, and addresses, IDs and messages are cleaned before they are sent. We also measure the speed of about 1 in 10 app sessions (not on the customer pages). Sentry does not record screen replays of your sessions.

Our website

Contact form

When you use the contact form, we collect your name, email, reason and message, and optionally your phone number and business name. The message is stored in our website’s database and emailed to our support inbox through Resend. A Cloudflare Turnstile security check runs on the form, which sends Cloudflare your IP address and technical information about your browser to block spam. We keep a temporary note of a fingerprint of your IP address for 15 minutes to limit repeated sending. We keep contact messages for 24 months after we receive them, then delete them. Resend keeps its copy of the email for 30 days.

“Tell me when it’s out” list

On the Get the app page you can leave your email address to hear when the app is on Google Play or the App Store. We keep the address, the store you picked and the website language in our website’s database. The same Cloudflare Turnstile check and 15-minute fingerprint of your IP address as on the contact form apply. When the app is in that store, we send you one email through Resend, and we use your address for nothing else. Every email has a link that deletes your address straight away. Otherwise we delete it once the emails for the stores you picked have been sent, and at the latest 12 months after you left it. We do this because you asked us to (consent). You can withdraw it at any time with that link or by emailing support@weavaworx.com.

Chat assistant

The website’s chat assistant is provided by Botpress. It only loads if you allow support chat in the cookie banner or click “Start a chat” (which we take as your choice to load it). What you type goes to Botpress, which stores chats in the United States and keeps conversations for 90 days. Please don’t share sensitive details in the chat. The chat also keeps your conversation details in your browser; see the Cookie Policy.

Analytics

We use Koko Analytics, which runs on our own website, to count visits. It doesn’t set cookies and doesn’t send data to anyone else. To count unique visitors without cookies, it makes a temporary one-way fingerprint from your IP address and browser details, which is cleared daily. We set it to cookieless mode and to delete visit counts, which don’t identify anyone, after 24 months.

The website also keeps daily totals of clicks on some buttons and links (such as “Start free trial”) and of Help Center search words, with no IP address or other identifier. We use these statistics only to improve the website, as UK law allows when we tell you and you can object; you can turn visit counting off in your browser on the Cookie Policy page. If you allow analytics in the cookie banner, we also use Google Analytics 4 (Google Ireland Limited, as our processor) to see how visitors find and use the website, including device type, country and city, and new or returning visits. It sets the _ga cookies for 13 months, keeps the data for 14 months, and doesn’t store your IP address. We don’t use its advertising features or Google signals, and we send it no names, email addresses or form contents. Google Analytics doesn’t load if your browser sends a Global Privacy Control or Do Not Track signal, and you can withdraw consent at any time under “Cookie settings”.

If you came to the website from an ad, the website passes the same tags on to the app when you go to sign up or sign in. It remembers them for the rest of your visit, in your browser’s session storage, only if you allow analytics.

Fonts, hosting and backups

The website’s fonts are hosted on our own website, so no font service sees your visit. The website is hosted by IONOS in data centers in the UK or the European Economic Area. Its servers log technical details of requests (such as IP address) for security and operation, and IONOS keeps these logs for up to 8 weeks. A firewall on the website may also log requests it blocks. Website backups are stored in Google Drive: we keep the last 14 daily copies of the website’s database and the last 4 weekly copies of its files, and older copies are deleted.

Why we use personal data and our lawful bases

We use personal data to create and manage accounts, provide app features, sync and store records, process subscriptions, send service emails, provide support, keep the service secure, prevent abuse, improve reliability, comply with legal obligations, and manage our business. Our lawful bases are:

• Contract: where processing is needed to provide WeavaWorx to you, including sign-in, sync, storage, subscriptions, emails you ask us to send, Measure by voice and price list reading.
• Legitimate interests: running, securing, improving and supporting the service and the website, for example security checks, error reports, the device limit, preventing trial misuse, cookieless website analytics and answering contact form messages.
• Legal obligation: where we must keep records (for example for tax) or respond to lawful requests.
• Consent: for optional cookies, the website chat assistant, device location and notifications (which you can turn off in your device settings), and direct marketing where the law requires consent.

Where we process data for a business as its processor, the business decides the lawful basis.

Who we share data with

We share personal data only where needed to provide WeavaWorx, with the providers below, and with professional advisers and authorities where the law requires. We don’t sell personal data. Each provider processes data on our instructions or, where noted, under its own terms.

Provider	What it does	Where
Supabase	Database, sign-in, file storage and server functions for the app	London, United Kingdom
Railway	Our sync server: keeps devices in step, sends emails, runs address search and calendar feeds	Amsterdam, Netherlands (EU)
Vercel	Hosts the web app at app.weavaworx.com and the online estimate, invoice and payment pages	Vercel’s global network, from the location nearest you; Vercel’s own records are kept in the United States
Resend	Sends emails from the app and the website	United States
Stripe	Website subscriptions. Also, under each business’s own Stripe account, card and Pay by Bank payments from its customers	Stripe Payments Europe (Ireland), with processing in the United States and other countries where Stripe operates
RevenueCat	Keeps one record of subscriptions from Google Play and the website	United States
Google	Google sign-in, Google Play billing (under Google’s terms), Firebase Cloud Messaging for Android notifications, website backups in Google Drive, and Google Analytics on the website (only if you allow analytics)	Google’s data centers worldwide, including the United States
Deepgram	Turns speech into text for Measure by voice	United States
Anthropic	Claude AI: turns voice text into measurements and reads supplier price lists	United States; the AI may run in other countries where Anthropic operates
Sentry	Error reports for the app, the sync server and the customer pages	Frankfurt, Germany (EU); Sentry’s account settings are kept in the United States
Cloudflare	Turnstile security check on web sign-in and the website contact form	Cloudflare’s global network, from the location nearest you; Cloudflare stores data mainly in the United States and the EU
OpenFreeMap	Map tiles, downloaded directly by your device	Run from Hungary (EU), with tiles delivered through Cloudflare’s global network
OpenStreetMap Foundation	Nominatim address search, through our sync server	A UK organization; its search servers are in the Netherlands, Ireland and the United States, reached through Fastly’s global network
IONOS	Hosts the website weavaworx.com	United Kingdom or the European Economic Area
Botpress	The website’s chat assistant, only after you choose to use it	United States

If we sell or reorganize our business, data may pass to the new owner under this policy.

International transfers

Our main app data is stored in London. Our sync server runs in Amsterdam, error reports are stored in Frankfurt, and the website is hosted in the UK or the European Economic Area, which UK law recognizes as giving adequate protection. Some providers process data in the United States or other countries. Where they do, we rely on:

• The UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) for providers certified under it: Google, Stripe, Vercel, Railway, Resend, Sentry and Cloudflare. Most of their data processing terms also include the EU Standard Contractual Clauses with the UK Addendum as a back-up.
• The EU Standard Contractual Clauses with the UK Addendum in the data processing terms of Supabase, RevenueCat, Anthropic, Deepgram and Botpress.
• The provider’s own terms where it acts for itself rather than for us: Google for Google sign-in and Google Play purchases, Stripe for a business’s own Stripe account, and the OpenStreetMap Foundation and OpenFreeMap, which handle requests under their own privacy policies.

You can ask us for more information about these safeguards at support@weavaworx.com.

How long we keep data

We keep personal data only as long as needed for the purposes in this policy.

Data	How long
Your account and your business’s data	While the account and business exist. Deleting your account deletes it straight away. A closed business’s data is deleted 30 days after closing.
After a plan ends	Kept read-only for 12 months. If the plan isn’t renewed, the business is then closed and its data deleted 30 days later.
Accounts not used	Deleted after 2 years without use (1 year if never signed in to), after emails 90, 60, 30 and 7 days before. Not applied while the business has an active plan.
Deleted jobs and documents	Removed from our servers within about 30 days. Their photos and files are deleted when the job is deleted, or by a daily check after 7 days. A short marker is kept so an old offline copy can’t bring them back.
Online page records (views, acceptances, signatures, declines, questions)	Kept for the business while it exists, as its record of the agreement, even if the job is later deleted (the files sent with it are removed within 7 days of the job being deleted). Deleted when the business or account is deleted.
Emails	Content and attachments kept for up to 3 days for resending. The sent-email history is kept while the business exists. Subscription emails sent to you: 30 days. Resend keeps its copy and delivery log for 30 days.
Account and security logs	Account events 180 days (30 days after an account is deleted). Sign-in audit log 90 days.
Messages to our support team	Your messages, our replies and any rating you give: 2 years after the last message, then deleted automatically; 90 days after you delete your account.
Voice	Audio is not kept by us; on your device for up to 7 days only if waiting to be sent. The text is kept with the job. Voice results waiting to be checked: up to 30 days on your device. Usage logs (no audio or words): 13 months. A team member’s logs stay with the business for that time even if they delete their own account, because they count the business’s minutes. For Deepgram and Anthropic, see “Measure by voice” above.
Supplier price lists	Not kept by us, apart from a fingerprint of the file and usage logs, which are deleted after 13 months. Anthropic deletes what we send within 30 days.
Which link brought you to us	Kept with your account and deleted when your account is deleted. Before you sign up, on your device for up to 90 days.
Free trial marker	A keyed one-way code of your email and the trial dates, kept after account deletion to stop repeat trials. Deleted 12 months after the trial ends.
Billing records	Stripe and Google keep their own payment and invoice records, including for tax. We keep billing records as long as tax law requires.
Backups	App database backups: 7 days, then replaced. Website backups: the last 14 daily database copies and the last 4 weekly file copies. Deleted data can remain in backups until they are replaced.
Website contact messages	24 months, then deleted automatically.
Website chat	Botpress keeps conversations for 90 days.
Website server logs	Up to 8 weeks (IONOS).
Website analytics	Visit counts and daily click totals that don’t identify anyone: up to 24 months. Google Analytics (only with your consent): 14 months.
Cookie choices	12 months in a cookie; see the Cookie Policy.

When you delete your account, we also cancel website subscriptions, delete your customer record at Stripe and your RevenueCat record, and delete your files. Google Play subscriptions must be canceled in Google Play. See Delete your account.

Your rights

Depending on the lawful basis and circumstances, you may have rights to access, correct, erase, restrict, object to, or receive a copy of your personal data. Where we rely on consent, you can withdraw it at any time. You also have the right to object to processing based on legitimate interests. You can export your data as PDFs and CSV files in the app, and delete your account in Settings. To exercise other rights, contact support@weavaworx.com.

If a business uses WeavaWorx to deal with you

If you are a customer of a flooring business that uses WeavaWorx, that business controls your data and decides how it is used, and we process it for them. Please contact the business first; if you contact us, we will pass your request to the business. The online estimate, invoice and payment pages don’t use cookies or advertising or analytics trackers. The business can see when its page was viewed, and payments are handled by Stripe for the business.

Complaints

You can complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. We ask that you contact us first so we can try to resolve the issue.

Cookies and similar technologies

Our website uses a cookie to remember your privacy choices, and optional cookies for your language and currency only after you agree. The chat assistant loads only after you choose it. Our own website statistics don’t use cookies; Google Analytics sets cookies only if you allow analytics. The app stores your sign-in and offline data on your device so it can work. See our Cookie Policy for details.

Security

We protect personal data with access controls (including database rules that limit each person to the data their business and role allow), private file storage, encryption in transit (HTTPS and secure WebSocket connections), security checks on web sign-in, the 3-device limit with new sign-in notices, scrubbed error reports, monitoring and backups. We don’t offer two-step sign-in at the moment. No online service can guarantee absolute security, so keep your password and devices safe and tell us promptly about suspected unauthorized access.

Children

WeavaWorx is for businesses and is not intended for children. Do not use WeavaWorx if you are not old enough to enter a binding contract or use business software in your country.

Automated decision-making

We do not use personal data to make solely automated decisions that have legal or similarly significant effects on individuals. The AI in Measure by voice and price list reading suggests rooms, measurements and prices for you to check; it doesn’t make decisions about people.

Changes to this policy

We may update this policy when the service, providers, or legal requirements change. We will publish the updated version on this page and update the date above.