Privacy Policy

Last updated: October 10, 2026. In effect for new accounts from that date, and for subscriptions started before it from October 24, 2026.

WeavyAudio ("we", "us") is committed to protecting your personal data. This policy explains what we collect, why, and your rights under GDPR (EU) and applicable US state privacy laws.

1. Data We Collect

• Account data: business name, email address, hashed password, account status.
• Location data: name of your venue/location (as you enter it).
• Billing data: Stripe handles card details directly. We store your Stripe customer ID and subscription status only.
• Usage data: play events (track ID, timestamp, location and zone, how long the track was heard, which player it came from, and the country it was played in) for licensing audit purposes.
• Website statistics: the pages you visit, the site and campaign link that brought you, your device, browser and operating-system type, language, screen-size range and approximate location (country, region, city) — collected without cookies, see section 7.
• Technical data: IP address, device type, app version, for security and debugging.

2. How We Use Data

• Providing and improving the Service (contract performance).
• Processing payments and managing your subscription (contract performance).
• Generating your license certificate (contract performance).
• Maintaining play logs for licensing compliance (legitimate interest).
• Sending transactional emails — receipts, renewal reminders, service alerts (contract performance).
• Security monitoring and fraud prevention (legitimate interest).

We do not sell your personal data. We do not use your data for advertising.

3. Data Retention

Account data is retained for the duration of your subscription plus 3 years (legal/audit obligations). Play event logs are retained for 7 years. Website statistics are kept for 400 days; the daily key used to count visitors is deleted after two days. You may request deletion of your account at any time; deletion removes your personal data subject to legal retention requirements.

4. Third-Party Processors

• Stripe — payment processing. Subject to Stripe's privacy policy.
• Our own servers — account, subscription and playback data is stored on servers we operate in the United States.

5. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Request deletion ("right to be forgotten"), subject to legal obligations.
• Restrict or object to processing.
• Data portability (receive your data in a machine-readable format).
• Lodge a complaint with your national supervisory authority.

To exercise any right, email privacy@weavyaudio.com. We respond within 30 days.

6. Data Security

Passwords are hashed with bcrypt (cost factor 12). Data in transit is encrypted with TLS. Streaming URLs are signed and time-limited. Database access is restricted to application-layer credentials. We conduct periodic security reviews.

7. Cookies

We use one essential cookie (HttpOnly, Secure, SameSite=Lax) for authentication; it is required for the Service to work and needs no consent. With your consent we also use Google Analytics, which sets analytics cookies (e.g. _ga) to measure traffic — these load only after you accept our cookie banner, and never for advertising. You can decline analytics in the banner, or withdraw consent later by clearing the “wv-cookie-consent” entry in your browser storage. We do not use advertising or cross-site tracking cookies.

Website statistics without cookies (added October 11, 2026). Separately from Google Analytics, we count visits to our website ourselves, without cookies and without storing anything on your device. When a page loads, your browser tells our server which page it is, which site sent you there and any campaign tags in the link. From the request our server works out your device, browser and operating-system type, your language and your approximate location — country, region and city, looked up in a copy of the DB-IP database kept on our own server (IP Geolocation by DB-IP). Your IP address and your browser’s full identification are never stored. To tell visitors apart, we combine them with a random key that changes every day and keep only a short one-way code made from the result; each day’s key is deleted after two days, after which nobody — us included — can link that code to you, and the same person visiting on two days counts as two visitors. These statistics are never shared with anyone and never used for advertising; visits by our own staff are left out. We rely on our legitimate interest in understanding how our website is used (GDPR Art. 6(1)(f)); you can object at privacy@weavyaudio.com.

8. Children

The Service is not directed at individuals under 18. We do not knowingly collect data from minors.

9. Updates

We may update this policy. We will notify you by email at least 14 days before material changes take effect.

10. Contact

Data controller: WeavyAudio LLC, 120 N Pacific Ave, San Pedro, CA 90731, USA (contact privacy@weavyaudio.com).