Who we are
Weave AI Sdn. Bhd. (no. 202601036289 (1698384-K)). Registered office: 7-2, Plaza Danau 2, Jalan 2/109F, Taman Danau Desa, 58200 Kuala Lumpur. Business address: 23-2, Jalan Radin Bagus 3, Bandar Baru Sri Petaling, 57000 Kuala Lumpur. We build an AI answer and decision layer for businesses that sell and support customers over WhatsApp and other messaging channels.
For anything to do with personal data, write to legal@weavey.ai.
We work under the Personal Data Protection Act 2010, as amended in 2024 ("the PDPA"). Where the UK or EU GDPR applies to you — because you are in the UK or EEA when we process your data — we honour the rights it gives you.
Where you fit
| You are | Our role |
|---|---|
| A visitor, a business contact, or a console user | Data controller. We decide. |
| A customer of a business that uses Weavey | Data processor. They decide; we act on their instructions. Skip ahead. |
The website
We run no analytics, no session recording and no advertising trackers on weavey.ai. The only cookies are the ones that keep you logged in and keep the site secure. There is nothing to opt out of.
Our host processes standard request data — IP address, page requested, browser — because that is what delivers a page. We use Google Search Console to see how the site performs in search; it collects nothing about you as a visitor. The site has a WhatsApp button; use it and you leave for WhatsApp, where Meta's terms apply.
When you contact us
We receive what you send: usually your name, email or phone number, your employer, and your message. It is voluntary, and you choose what to include.
We use it to answer you and to keep a record if a working relationship follows — under the PDPA on your consent and on the need to take steps before entering an agreement, and under the GDPR on our legitimate interest in answering enquiries.
A person reads your message. No automated system makes decisions about you. We hold our own contact records and use no third-party CRM.
Please do not send customer lists or conversation exports by email or WhatsApp. Neither is secure. Tell us what you need to share and we will arrange a safer route.
If we write to you about what we build, you can stop it at any time — reply and say so, or write to legal@weavey.ai. We do not ask for a reason, and we do not pass your details to anyone else to market to you.
If you use the console
We hold your name, work email, job title, and login and usage records — which suggestions you opened, approved, edited or dismissed, plus IP and browser data for security.
Your employer can see your activity. That is normal for a workplace tool. We report it as workload, not as a score against you.
Who else touches it
Amazon Web Services (Singapore) hosts weavey.ai and our systems. Google provides our company email. Beyond those two, we disclose personal data only where it is needed: to our lawyers, accountants, auditors and insurers; to a regulator, court or law enforcement body where the law requires it; and to a buyer, investor or successor if all or part of our business is sold, financed or restructured, who must then keep to this policy. We do not sell personal data.
Our infrastructure is in Singapore, so data we hold is processed outside Malaysia as a matter of routine. We transfer only on a basis the PDPA permits, and we keep a record of it.
How long we keep it
| Business contacts and correspondence | 24 months from last substantive contact | Long enough to restart a conversation that went quiet; short enough that we are not holding a list we have no reason for |
| Console account and profile | Life of the account, then 90 days | Covers offboarding and any billing question |
| Login and security logs | 12 months | Incidents surface late; past a year the value falls below the cost of holding it |
| Console usage records | 12 months, then aggregated | One contract year of reporting without keeping individual records indefinitely |
| Billing and accounting | 7 years | Required by Malaysian tax and companies law, and it outlasts the six-year limitation period |
Ask us to delete sooner and we will, unless we are required to keep it — and we will say so.
Inside a client's deployment
You contacted a business — a shop, a clinic, a distributor, an agency — and they use our software to help answer you and follow up. They decide what enters the system and why, and their privacy notice governs. We act on their instructions under our Data Processing Addendum.
What we handle
Your messages, phone number and display name, from their messaging platform. Your activity on their website — pages, clicks, referring site, IP, device — from a tracking script on their site. A pseudonymous code linking the two. Advertising and attribution data from Meta and Google where they have authorised it. Records of what was suggested, approved and changed.
Depending on who you contacted, your messages may contain health information, or education and immigration details. We handle it as part of the conversation, on their instructions.
The tracking code
If you clicked a "WhatsApp us" button, your message may start with a code in brackets, like [abc001]. It is not an error and not malicious — it tells the business which page you came from. Delete it before sending if you prefer; the message still arrives. A link containing ?chInfo= works the same way.
Neither contains your name, number or anything about you. They are random identifiers stored in your browser.
To stop the tracking: the script runs on the business's website, so their cookie settings control it. Decline non-essential cookies there and no identifier is set.
To stop messages: ask the business, in the conversation. You can also ask them to delete what they hold, or unlink your visit from your conversation. They instruct us and we act.
AI is involved
Replies may be generated or assisted by AI, within limits:
- By default AI sends nothing. It drafts with sources attached; a person reviews and sends.
- For simple factual questions — opening hours, delivery times, locations — a business may have allowed automatic replies, unlocked one question type at a time after an accuracy record and written sign-off.
- Medical questions, and visa or immigration questions, are never answered automatically. They always go to a person. We do not offer this as a setting.
- Where the system is not confident it says so and passes you to a person.
We do not claim it is free from error. A source shown against an answer tells you where it came from; it is not a guarantee it is right.
Where it goes
AWS hosts the application and database. Model providers generate the drafts. Meta carries the messages. Meta and Google Ads supply attribution where authorised.
Read this part. To draft a reply, your conversation is sent to a large language model provider and processed outside Malaysia — principally OpenAI and Anthropic, and others where a deployment requires them. These are paid enterprise services, on terms under which content submitted through the API is not used to train their general models.
That is not a promise of zero retention. Limited caching, abuse monitoring and safety processing can still occur under a provider's own terms. We would rather say so than imply a guarantee we do not control.
Region. We deploy into the region a business chooses, recorded in our agreement with them; our default is AWS Singapore, and a Malaysian region is available. But choosing a region does not confine AI inference to it — model endpoints run where they run.
How long
Held for as long as the business is our client: conversation content, website activity and tracking identifiers, advertising and attribution data, and draft and review records.
When our agreement with them ends, we export their data to them, then erase it from live systems within 30 days. Encrypted backups still holding a copy clear within a further 14 days, and are isolated from live systems in the meantime.
Your rights here
Requests go to the business first — a copy of your data, correction, deletion, withdrawal of consent, or stopping messages. They instruct us and we act. If you cannot reach them, write to legal@weavey.ai and we will pass it on. We cannot act without their instruction.
Your rights
Ask us for a copy of your data, a correction, deletion, or to stop contacting you. Under the PDPA you may also ask for it in portable form where feasible, and withdraw consent.
Under the GDPR you may additionally object to processing based on legitimate interests, ask us to restrict processing during a dispute, and complain to your supervisory authority. We answer within one month, extendable by two for complex requests, and we will tell you if we need it.
Data you sent through Meta. If you messaged a business on WhatsApp, Facebook Messenger or Instagram and want what was received through that channel deleted, ask the business, or email legal@weavey.ai with the subject line "Data Deletion Request", your handle or number, and the business you contacted where you know it. We pass it to the business for instruction and confirm to you when it is done.
Write to legal@weavey.ai, or by post to our business address above. We may confirm your identity first. If our answer does not satisfy you, complain to the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi), Ministry of Digital — or to your own supervisory authority where the GDPR applies.
Security
Traffic encrypted in transit, data encrypted at rest. Access limited to those who need it and reviewed regularly. Multi-factor authentication on administrative and infrastructure access. Client data separated by tenant. Administrative access and exports logged. Backups tested. Providers assessed before engagement. A documented incident procedure.
We organise these around the areas ISO/IEC 27001 Annex A covers. We are not certified to ISO/IEC 27001 and do not claim to be — using the standard as a framework is not the same as holding a certificate. If your procurement requires certification, tell us early. No system is completely secure and we do not pretend otherwise.
If something goes wrong
We notify the Commissioner within 72 hours where required, and affected individuals within 7 days where a breach is likely to cause significant harm. Where the GDPR applies, the 72-hour notice goes to the relevant supervisory authority. As a processor, we tell the business without undue delay so they can meet their own obligations.
Young people
Our product is for businesses and weavey.ai is not directed at children. Where a business we work for deals with applicants under 18, we handle that data on their instructions, and obtaining any consent the law requires — including from a parent or guardian — is their responsibility.
Changes
If we change this policy the effective date changes with it. Where a change materially affects you, we describe it rather than quietly amend the text.
Published in English; any translation is for convenience, and the English version prevails.