Privacy notice
How Weft Labs websites, accounts, APIs, MCP tools, and connected apps collect and use personal information.
Who this notice covers
This notice explains how Weft Labs GmbH processes personal information when you visit weftlabs.com, contact us, submit a beta-access request, use Weft Account or the Weft API at weft.network, or connect to Weft through hosted MCP tools, ChatGPT, or another compatible client.
A third-party service that you connect to Weft or select through a Weft result can process information under its own privacy notice. This notice describes Weft Labs processing, not the independent processing of those third parties.
Information we collect
We collect information you choose to provide, such as the email address you submit with a beta-access request and the contents of messages you send us.
When you create or use a Weft Account, we process account and authentication information, service settings, spending policies, connected-app permissions, credential identifiers, connection status, and security events. A connected app can provide its client identifier, requested scopes, redirect information, and request metadata during authorization.
When you search or fetch through Weft, we process the query, filters, selected operation, request parameters, response or saved-result reference, timestamps, usage measurements, and error information needed to perform and support the request. Search activity can update account activation and usage records.
For wallet and paid actions, we process wallet addresses, balances, funding and spending policies, price quotes, payment status, transaction references, receipts, and related audit records. We do not ask you to send passwords, private keys, or wallet recovery phrases through a support request.
When website analytics is enabled, we collect pseudonymous page views, a small set of named interactions, and session replay when a visit matches the recording rules configured in PostHog. PostHog assigns a random identifier held only in memory for the current browser page session; we do not write that analytics identifier to cookies, local storage, or session storage. Event data can include the page origin and path, allowlisted campaign parameters, the referring host, the website version, the type of action, and, while a site test runs, the name of the design version you see (see the cookie notice). We remove URL fragments and query parameters other than allowlisted campaign fields before capture.
Session replay captures the public page structure and changes that occur while you use the website, such as pointer and navigation activity. Visible public-page text can appear in a replay. We configure PostHog to mask all form inputs in the browser, refuse replay capture of network request and response bodies or headers, disable console-log recording, and sanitize captured page URLs.
Before your browser follows a create-account link to weft.network/signup, the website can place the temporary PostHog distinct identifier and session identifier in the URL fragment. The fragment is available to the destination app in your browser and is not sent to its web server as part of the HTTP request. This handoff lets analytics connect a website visit with the related account-signup journey.
Our hosting, security, analytics, and product infrastructure providers may also process standard request and device information, such as an IP address, browser type, operating system, request time, and diagnostic records, when they deliver, monitor, or protect a service.
How we use information
We use personal information to create and secure accounts; authorize connected apps; search for services; carry out selected requests and payments; apply wallet and spending controls; return and preserve results and receipts; provide support; prevent abuse; measure service reliability and use; maintain the beta list; improve our services and communications; comply with law; and protect our rights and users.
We do not use the marketing website analytics stream for automatic event capture, heatmaps, performance recording, exception capture, cross-site advertising, or advertising profiles.
Legal bases for European users
Where European data-protection law applies, we rely on performance of a contract to provide an account and carry out requests you authorize; steps requested before entering a contract when you register or contact us about a service; legitimate interests to operate, secure, measure, and improve the services and prevent abuse; and legal obligations where processing is required by law.
You can cancel a beta-access request at any time by contacting us.
International transfers
PostHog receives analytics through its EU ingestion service. Resend and service-infrastructure providers may process information in other countries as described in their privacy notices. A third-party service selected for a request can also operate in another country. Contact us if you want information about safeguards relevant to your information.
Retention
We keep beta-list information until you unsubscribe, ask us to delete it, or it is no longer needed for the beta programme. We keep account, connection, search, result, payment, analytics, security, and operational records only while needed for the purposes in this notice. Payment, fraud-prevention, and audit records can be kept longer when needed to meet legal, accounting, security, or dispute requirements. We determine each period from the record type, sensitivity, service needs, provider settings, and legal duties. We then delete or de-identify information unless law requires longer retention.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information, object to certain processing, or complain to a data-protection authority. These rights can be limited by law.
You can ask us to remove your email from the beta list, revoke a connected app in your Weft Account, and use browser or network-level blocking tools to block marketing-site analytics requests as described in our cookie notice. Account deletion can be subject to wallet settlement, security, legal, and audit requirements.
Children and security
The services are not directed to people under 18, and we do not knowingly collect their personal information.
We use technical and organizational safeguards designed to protect information. No internet service is completely secure, so we cannot guarantee absolute security.
Changes and contact
We may update this notice as our website or legal obligations change. We will post the revised notice here and change the effective date.
Weft Labs GmbH is responsible for the processing described in this notice. Send questions or rights requests to patrick at weftlabs.com.