Privacy Policy

Weightedly ([legal entity name], [registered address]) is a service that reads publicly available community discussion and raises the threads that matter to the brands who subscribe. This policy covers three kinds of people: visitors to this website, customers (the teams with Weightedly workspaces), and community authors (people whose public posts and comments appear in the sources we read). For website, account, billing, and community-content data, Weightedly acts as the data controller. For material a customer brings into their own workspace (notes, voice profiles, edits), the customer is the controller and we process it on their behalf.

• Account data. When you sign in with Google we receive your name, email address, and avatar. We never see your password.
• Billing data. Payments run through Stripe. We keep subscription status and invoices; card numbers live with Stripe, never on our systems.
• Product telemetry. Error-level diagnostics via Sentry (what broke, not what you typed), and operational logs needed to run the service.
• Marketing-site analytics. This site loads a self-hosted, cookie-less analytics script (Umami, running on Artomai’s own infrastructure; Weightedly is an Artomai product, see 06). It sets no cookies, stores no personal data, and cannot identify a visitor. It counts pageviews and a short list of named events: that a signup form was accepted, for instance, not who submitted it.
• Newsletter signup. If you submit your email address with the consent box ticked, we store that address on Artomai’s marketing platform together with the evidence of your consent: the time, the page and form where you ticked the box, your IP address, and your browser’s user agent. We use it to send you the emails you asked for, and for nothing else. Every one of those emails carries an unsubscribe link that takes effect immediately. The consent record is kept as evidence under Canada’s anti-spam law (CASL). See 08.
• Demo booking. If you book a demo, we store your name, email address, timezone, the time you chose, and any notes you type on Artomai’s marketing platform, and we place the call on our Google Calendar as a Google Meet event with you as the guest. We use that to hold the call and to send you the confirmation, a calendar invitation, one reminder, and a cancellation notice if either side cancels. Those emails are about your booking only. The booking form carries a separate, unticked box for our occasional notes; ticking it is the same consent as the newsletter signup above, recorded the same way.
• Cookies. The application uses session cookies for sign-in only. This marketing site sets none, including for the analytics above. We use no advertising trackers anywhere, and we do not sell or share personal information for advertising.

The heart of the service is reading public conversation: posts, comments, and articles from forums, subreddits, video comment sections, and blogs. That content sometimes includes personal data: most commonly a username and whatever the author chose to say in public. Our lawful basis for this processing is legitimate interest (GDPR art. 6(1)(f)): helping brands understand and honestly answer public conversation about their products, using only what the authors made public, in ways they would reasonably expect public posts to be read.

We hold ourselves to lines that are narrower than the law requires:

• public sources only: no private messages, no logged-in-only content, no circumvention of platform protections;
• no profiling of individuals: the unit of analysis is the conversation, never the person;
• no deanonymization, and no enrichment of usernames with outside data;
• no sale of personal data, to anyone, for anything;
• no training of AI models on community content or customer data;
• content deleted at the source is dropped from our indexes when the source is refreshed.

If you wrote something in public and want it out of Weightedly, email [privacy contact email] with a link to the post. We will remove it from our indexes and from future briefs within 30 days. No account required, no questions that assume you owe us an explanation.

To run the service (classify and score conversations, generate briefs and drafts for the customer who subscribed), to operate accounts and billing, to secure the platform, to fix what breaks, to talk to customers about the service, and to send the emails people asked for when they ticked the consent box (02). That’s the list. We do not use your data for advertising, and we do not use it to train models (see 03 and 05).

Briefs and drafts are generated with large language models from our AI providers (currently Anthropic and OpenAI; the current list is in 06). Conversation excerpts and workspace context are sent to those providers to produce each brief; our agreements with them bar the use of that data for model training. Every AI-generated brief and draft is working material reviewed by humans on the customer’s team; the service makes no automated decisions with legal or similarly significant effects about anyone.

We share personal data only with the vendors it takes to run the service:

• Supabase: database, authentication, storage
• Hetzner: application hosting
• Anthropic: brief/draft generation (LLM)
• OpenAI: embeddings for search and clustering
• Stripe: payments
• Google: sign-in
• Sentry: error monitoring
• Google Calendar and Google Meet: the demo event and video call, if you book one
• Artomai marketing platform: marketing contacts, consent records, and demo bookings; our own system, running on the Supabase infrastructure above
• Umami: marketing-site analytics, self-hosted on Artomai infrastructure

Each outside vendor is bound by a data-processing agreement. The last two are not outside vendors: Weightedly is an Artomai product, and both the marketing platform and the analytics server are Artomai’s own systems. No third party receives your analytics or subscriber data. Beyond the infrastructure listed here: we disclose data if the law compels us to (and will tell you unless legally barred), and in a merger or acquisition your data moves with the service under this policy. There is no other sharing.

Our infrastructure is in [EU/US: confirm regions]; some subprocessors are in the United States. Where personal data leaves the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (and the UK addendum) with the receiving vendor.

• Account and workspace data: for the life of the account, deleted within 30 days of account deletion (backups age out within 90).
• Community content: a rolling window refreshed from the source; posts deleted at the source drop out on refresh, and removal requests (03) are honored within 30 days.
• Subscriber records: the email address is kept while your subscription to our emails is active, and removed when you unsubscribe or ask us to delete it. The minimal consent and unsubscribe audit trail (time, source, IP, user agent) is kept after that as the legal evidence CASL requires us to be able to produce.
• Demo bookings: the booking record and the calendar event are kept [confirm with Artomai: retention of demo bookings after the call]; the consent evidence for a ticked notes box follows the subscriber rule above.
• Billing records: as long as tax law requires (typically 7 years).
• Error diagnostics: 90 days.

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar state laws), you can ask for access to, correction of, deletion of, or a copy of your personal data; object to or restrict processing based on legitimate interest; and complain to your supervisory authority. Community authors’ removal path is in 03 and does not require an account. We do not discriminate against anyone for exercising a privacy right, and we honor verifiable requests within 30 days at [privacy contact email]. For CCPA purposes: we do not sell or share personal information, and we collect only the categories described in 02 and 03.

Data is encrypted in transit and at rest. Workspaces are isolated with row-level security so no customer can reach another’s data. Access to production is limited and logged. If a breach affects your personal data, we will notify you and the relevant authorities within the timelines the law sets.

Weightedly is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16, and workspace accounts require you to be at least 16.

When this policy changes materially we will email workspace owners at least 30 days before the change takes effect and note the change history here. The current version always lives at this address.

Privacy questions and requests: [privacy contact email]. Postal: [legal entity name], [registered address]. [If required: EU/UK representative details here.]