Privacy policy
This privacy policy explains how Weesify ("Weesify", "we", "us") collects, uses, shares and protects personal data, and the rights you have. We have written it to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA (CCPA) and other US state privacy laws, Nigeria's Data Protection Act 2023 (NDPA) and the NDPR, the UAE Federal Decree-Law No. 45 of 2021 (PDPL), South Africa's Protection of Personal Information Act (POPIA), and similar laws elsewhere.
1. Who this policy covers and our role
1.1. Weesify as controller. We are the controller for personal data about our account holders and their team members, visitors to weesify.com, people who contact us, and job applicants.
1.2. Weesify as processor. When creators use Weesify to collect data from their visitors, subscribers, buyers, students, members, attendees or affiliates, the creator is the controller and we process that data on their behalf under our Data processing addendum. If you are a creator's audience member, please read the creator's own privacy notice and contact them first; we will help them answer your request.
1.3. Payments. When you pay a creator, the creator and their payment provider process your payment details. We receive limited order information to run checkout, prevent fraud and calculate fees.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account and profile | Name, email, password (stored only as a secure hash), profile photo, language, time zone | You |
| Workspace and business | Business name, address, tax ID, team members and roles, plan | You |
| Content | Pages, links, media, products, courses, emails, messages you write | You |
| Billing | Plan, invoices, the last four digits and expiry of your card, billing address | You and our payment providers |
| Payouts (sellers) | Bank or payout account details, identity verification results | You and our payment providers |
| Orders (buyers) | Name, email, items bought, amount, currency, country, refund requests | You and the creator |
| Support and communications | Emails, chat messages, survey answers | You |
| Security and device | IP address, browser and device type, sign-in times, security events | Automatically |
| Visitor analytics | Page views, referrers, country, device type, counted without cookies using a daily-rotating, salted, one-way fingerprint that cannot identify you or follow you between days or sites | Automatically |
| Marketing preferences | Whether you agreed to receive our product news | You |
We do not knowingly collect special-category data (such as health or religious beliefs) about our account holders. Creators must not use Weesify to collect such data from their audience unless they have a lawful basis and the explicit consent the law requires.
3. Why we use it and our lawful bases
| Purpose | Lawful basis (GDPR / UK GDPR) |
|---|---|
| Create and run your account and provide the Service | Contract |
| Take payments, calculate platform fees, pay out sellers, issue invoices | Contract; legal obligation (tax and accounting) |
| Send service emails (receipts, security alerts, policy changes) | Contract; legitimate interests |
| Keep the Service secure, prevent fraud, spam and abuse, enforce our policies | Legitimate interests; legal obligation |
| Count visits and improve the product with cookieless, aggregated analytics | Legitimate interests |
| Provide support and respond to requests | Contract; legitimate interests |
| Send product news and offers | Consent (you can withdraw at any time), or legitimate interests where the law allows for existing customers |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details and you can object (see section 8). Under the NDPA, PDPL and POPIA we rely on the equivalent grounds: performance of a contract, legal obligation, legitimate interests and consent.
4. What we do not do
- We do not sell personal data and we do not share it for cross-context behavioural advertising (as those terms are defined in the CCPA).
- We do not use advertising or third-party tracking cookies on Weesify.
- We do not use your private workspace content to train third-party AI models.
- We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated fraud and spam checks may flag activity for human review.
5. Who we share it with
5.1. Service providers (sub-processors) that help us run Weesify, under contracts that limit their use of the data to our instructions: hosting and storage, email delivery, payment processing, fraud prevention, AI model providers, error monitoring and customer support. The categories and current list are in our Data processing addendum.
5.2. Payment providers. Payments are handled by licensed providers such as Stripe, Paystack, Flutterwave and PayPal. They receive the data they need to process payments, verify identities and prevent fraud, and act as independent controllers for some of it under their own privacy policies. We never see or store full card numbers.
5.3. Email delivery. Emails sent by Weesify or by creators through Weesify are delivered through email delivery providers, which process recipient addresses, message content and delivery events.
5.4. Creators. When you buy from, subscribe to or register with a creator, the creator receives the data you give them.
5.5. Authorities and legal process when the law requires it, or to protect the rights, property or safety of our users, the public or Weesify. We review requests and push back on those that are too broad.
5.6. Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may transfer to the new owner, who will be bound by this policy.
6. International transfers
We and our providers may process data outside the country where you live, including in the European Economic Area, the United Kingdom and the United States. When personal data from the EEA, UK, Switzerland, Nigeria, the UAE, South Africa or another country with transfer rules leaves that country, we protect it with an adequacy decision, the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or another safeguard recognised by the relevant law, together with additional security measures. You can ask privacy@weesify.com for a copy of the safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and workspace content | For as long as your account is open. After you delete it, we remove it from live systems within 30 days and from backups within a further 35 days. |
| Invoices, orders and payment records | As long as tax and accounting law requires (usually 6 to 10 years). |
| Legal acceptances and consent records | For as long as the account exists plus the period in which a claim could be brought. |
| Security and access logs | Up to 12 months. |
| Cookieless analytics | Aggregated counts are kept for the life of the workspace; the daily fingerprint salt is discarded every day. |
| Support conversations | Up to 3 years after the conversation ends. |
| Marketing preferences | Until you withdraw consent or unsubscribe, then a suppression record so we do not email you again. |
8. Your rights
Depending on where you live, you have some or all of these rights:
- Access a copy of your personal data and information about how we use it.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Port your data in a machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Restrict processing in certain cases.
- Withdraw consent at any time, without affecting earlier processing.
- Opt out of sale, sharing and targeted advertising (we do not do these), and limit the use of sensitive personal information (CCPA).
- Not be discriminated against for exercising your rights.
- Complain to a supervisory authority, for example your EU data protection authority, the UK Information Commissioner's Office, the California Privacy Protection Agency, the Nigeria Data Protection Commission, the UAE Data Office or South Africa's Information Regulator.
How to exercise them. Most can be done yourself in your account (profile, export and delete). Otherwise email privacy@weesify.com. We will verify your identity, then reply within one month (GDPR, UK GDPR, NDPA, PDPL, POPIA) or 45 days (CCPA), extendable where the law allows. You may use an authorised agent; we will ask for proof of their authority. If we decline a request, we will explain why and how you can appeal.
9. Children
Weesify is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, email privacy@weesify.com and we will delete it. Creators whose courses, communities or events are aimed at children must obtain the consent of a parent or guardian as the law requires.
10. Security
We protect personal data with encryption in transit (TLS) and at rest, hashed passwords, two-factor authentication, role-based access with least privilege, workspace isolation, audit logs, rate limiting, regular backups, dependency and vulnerability management, and staff confidentiality obligations. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires. To report a vulnerability, see our Security page.
11. Cookies
We only use strictly necessary cookies by default, and our analytics do not use cookies. See our Cookie policy.
12. Changes
We will post any changes here and update the date at the top. For material changes we will notify you by email or in the app before they take effect.
13. Contact and data protection officer
The controller is Weesify, the address shown on your invoice. You can reach our data protection officer and privacy team at privacy@weesify.com. Where the law requires us to have a representative in the EU or UK, their details are available on request from the same address.