Wefta Privacy Policy and Data Practices

Who is responsible for your data

Wefta is operated by Felipe Venturini Apoio Administrativo, registered in Brazil under CNPJ 32.096.840/0001-96, with its registered office at Rua São Lourenço 331, Vila Alpina, São Paulo, SP, 03211-050, Brazil. That entity is the controller for the processing described in this policy, except where this policy says otherwise.

Privacy requests of any kind go to privacy@wefta.ai or through our support page. We answer within the period required by the law that applies to you: 15 days under the LGPD, one month under the GDPR (extendable by two months for complex requests), and 45 days under the CCPA (extendable once by another 45 days).

When we are the controller, and when we are the processor

This distinction decides who answers for what, and it is not cosmetic. The same company can occupy both roles over different sets of data, and Wefta does.

• Your workspace content — everything you or your team capture into Spaces, Groups and Topics, including any personal data about your own clients and staff: you are the controller, and Wefta is the processor. We act on your documented instructions and never for our own purposes.
• Your account, billing, security and support records — who signed up, payment administration, access logs, fraud prevention, messages you send us: Wefta is the controller, because we decide why and how those are processed.
• Visits to wefta.ai — analytics and consent records: Wefta is the controller.
• As the controller of your workspace content, you decide who in your organisation has access and at what level, and you are responsible for the lawfulness of the instructions you give us and of the data you upload. Exposure caused on your side — shared or leaked credentials, access left in place after someone leaves, an integration you authorised — is yours to answer for, and we will help you investigate it.

Information we collect

We collect what you give us directly, what the service necessarily generates while it runs, and what your consent choices allow.

• Account information: name, email, and password, which is stored hashed and never in readable form.
• Workspace content: Spaces, Groups, Topics, and anything you capture into them, including files and text your team writes.
• Usage and security records: access logs, timestamps, IP address, device and browser type, and the records that prove which terms you accepted and when.
• Anti-abuse signals: Cloudflare Turnstile inspects the IP address and browser behaviour of anyone submitting a form on this site, to tell a person from an automated script. This processing is covered by Cloudflare's Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/
• Billing information: handled by Stripe. Wefta receives the transaction status and invoice data, never the complete card number.
• Optional analytics: only after you accept them in the cookie banner.

Purpose, legal basis and retention, by category

Each category below states the purpose that justifies it, the legal basis we rely on, and how long it survives. When the purpose ends, the data is deleted or anonymised, unless a legal, tax, security or dispute obligation requires us to keep it longer.

• Identity and contact details — to create and administer your account and to answer sales and support requests. Basis: performance of the contract (GDPR art. 6(1)(b), LGPD art. 7, V). Kept while the relationship lasts, then for the period the law requires.
• Workspace content — to provide the service. Basis: performance of the contract, and, for content about third parties, the instructions of the customer who is the controller. Kept until you delete it or close the account, subject to backup cycles, which expire 7 days after deletion.
• Usage and security records — to keep the service available, investigate abuse and prove acceptance of terms. Basis: legitimate interest in operating a secure service (GDPR art. 6(1)(f), LGPD art. 7, IX). Kept for 7 days, except where an open security investigation or a legal obligation requires longer.
• Anti-abuse signals — to stop automated abuse of public forms. Basis: legitimate interest. Kept only as long as the check requires.
• Billing and transaction records — to run subscriptions, prevent fraud and meet tax and accounting duties. Basis: legal obligation (GDPR art. 6(1)(c), LGPD art. 7, II). Kept for the statutory accounting period.
• Optional analytics and consent records — to measure and improve the site and product. Basis: your consent (GDPR art. 6(1)(a), LGPD art. 7, I). Withdrawn at any time; the record of the choice itself is kept as proof that we honoured it.

Cookies and similar technologies

We separate cookies by what they do, because only one of the two groups can lawfully be set before you decide.

Strictly necessary technologies — session authentication, security, load balancing and the anti-abuse check on our forms — run without consent, because the service cannot be delivered without them. Everything else is optional and inactive until you accept it.

Optional analytics are Google Analytics through Google Tag Manager, and Microsoft Clarity. They stay off until you accept them in the banner, and they switch off again the moment you change your mind through the "Cookie settings" link in the footer. We do not use cookies for advertising, retargeting or profile building.

Who processes data on our behalf

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not license it to anyone. We use the following processors, each under a contract that carries our obligations down to them, and each limited to the purpose listed.

• Cloudflare — hosting, edge delivery, Worker execution, the key-value store that de-duplicates form submissions, and Turnstile anti-abuse checks.
• Stripe — payment processing, invoicing, refunds and payment fraud checks.
• Attio — the CRM that receives sales and support requests submitted through this site.
• Google (Tag Manager and Analytics) — site measurement, active only after consent.
• Microsoft Clarity — product and site analytics, active only after consent.

Changes to this list of processors

Business customers are notified at least 30 days before a new processor starts handling their data, and may object on documented compliance grounds. If the objection cannot be resolved, the customer may terminate the affected service without penalty. The full mechanism is in our Data Processing Addendum.

International data transfers

Wefta runs on a global network, so data crosses borders by design and we will not pretend otherwise. What matters is the safeguard attached to each transfer.

For transfers out of Brazil we rely on ANPD Resolution CD/ANPD nº 19 of 23 August 2024: an adequacy decision where one exists, and otherwise the Standard Contractual Clauses issued by the ANPD, annexed to our Data Processing Addendum. For transfers out of the European Economic Area and the United Kingdom we rely on an adequacy decision where one exists, and otherwise the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer impact assessment.

We do not represent that data stays in any single country. Storage and processing location varies by provider, service and configuration.

Security

We apply technical and organisational measures proportionate to the risk: encryption in transit, access limited to the people whose duties require it, multi-factor authentication on administrative access, logging, reviewed backups, and incident response procedures.

Wefta is multi-tenant, which means separate customers share the same infrastructure with logical isolation between them. The characteristic failure of that architecture is one tenant reaching another tenant's data through a missing authorisation check. We treat authorisation at object level as a first-class requirement, not an afterthought, and test for it.

If something goes wrong

If a security incident affects personal data, we notify the supervisory authority within 72 hours of becoming aware of it where the GDPR requires, and the ANPD and affected people within a reasonable period where the LGPD requires. When Wefta is the processor, we notify the customer who is the controller within 24 hours of confirming the incident, so that they have time to make their own report.

Your rights

Wherever you are, you can ask us to confirm what we hold about you, to correct it, to delete it, to give you a portable copy, and to stop a use you object to. Under the GDPR and LGPD you can also restrict processing, withdraw consent at any time without affecting what was lawful before, and object to processing based on legitimate interest. Exercising a right never costs you a worse price or a degraded service.

You can complain to a supervisory authority: the ANPD in Brazil, your national data protection authority in the EU, or the Information Commissioner's Office in the UK. We would rather you came to us first, but the right is yours either way.

California residents

In the last 12 months we collected the categories described above: identifiers, commercial information, internet activity, and the contents of what you choose to store. We collected them from you, from your use of the service, and from our processors. We use them for the purposes stated in this policy.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We do not use or disclose sensitive personal information beyond the purposes permitted without a right to limit.

You may request to know, delete or correct, and you may use an authorised agent. We will not discriminate against you for exercising these rights. Requests go to privacy@wefta.ai.

Automated decisions and AI features

Wefta does not make decisions about you by automated means that produce legal effects or similarly significant effects. Where an automated evaluation is ever introduced, you will be able to ask for a review by a person, as GDPR art. 22 and LGPD art. 20 require.

Your content is never used to train our models or any third party's models. Prompts, workspace content and outputs are not mined, retained for model improvement, or passed to a provider for that purpose. This obligation is carried down to every processor we use.

Data protection officer

Felipe Venturini is Wefta's data protection officer, reachable at privacy@wefta.ai. You can raise any question about this policy, any request over your data, or any complaint through that address.

Children

Wefta is not directed at children and we do not knowingly collect their data. The minimum age is 16 in the European Union, unless a member state has set it lower, 13 in the United Kingdom, and 18 in Brazil for account holders, with parental consent required below that.

Changes to this policy

We may update this policy as the product or the law changes. The date at the top always reflects the current version, and for material changes we make a reasonable effort to tell you directly before they take effect.