Who this notice covers
This draft describes the weezyPWA website and team workspace. The operator’s legal identity and privacy contact must be completed before public launch; see Operator details and contacts.
For account administration, the service operator determines the purposes of processing. When processing visitor events for a customer’s PWA on that customer’s instructions, Weezy is intended to act as a processor. The actual roles depend on the operation and the agreement. A PWA owner must provide its visitors with its own privacy information.
Data used by the service
Information comes from you, your team administrators, your browser and integrations configured by the workspace owner.
- Google sign-in, when enabled: Google account identifier, email and name; we also record the version, language, time and method of registration-document acknowledgement. We do not store your Google password or Google access/refresh tokens.
- Account: name, email, password hash, language, workspace membership, roles and settings.
- Security: IP address, browser information, session timestamps, authentication and administrative events.
- Workspace content: app configuration, domains, uploaded media, messages and integration settings.
- Customer PWA data: device and click identifiers, subid/clickid values, referral and campaign information, country, browser/platform, installation and interaction events, and registration or deposit events supplied by configured trackers.
- Push: subscription endpoint and encryption keys, device association, message content and delivery/click records. These identifiers can be personal data even when a person’s name is absent.
Purposes and legal bases
The service uses account information to provide access, manage workspaces and send operational messages. Security information supports session management, abuse prevention and incident investigation. Customer PWA events support the reports, attribution and messaging configured by that customer.
The final notice must assign a valid legal basis to each operator-controlled purpose: performance of a contract where necessary, a documented legitimate-interest assessment for relevant security operations, legal obligations where applicable, and consent where required. This draft does not treat registration as blanket consent to analytics or marketing.
Recipients and integrations
Hosting, storage, email and analytics infrastructure can process data to deliver the service. See the service-provider inventory for the current technical integrations and outstanding contract/region checks.
Customer-configured trackers and Meta Conversions API may receive conversion and attribution data. Browser push services deliver notifications. These recipients and their roles must be disclosed for the relevant PWA. A server-to-server integration is not exempt from privacy obligations.
Cross-border destinations and applicable transfer safeguards must be confirmed before public launch. This draft makes no promise that all data remains in the EU.
Retention and deletion
The analytics schema sets expiry rules for raw data: IP/browser columns after 30 days, PWA events after 180 days, conversions after 365 days, and outbound pixel/postback delivery logs after 90 days. Background database cleanup is asynchronous.
These rules do not cover every copy of the data. Aggregate reports, first-deposit history, delivery receipts, push subscriptions, account/security records and backups have separate lifecycles. The complete retention schedule and a verified deletion procedure are launch requirements. No universal automatic deletion deadline is promised here.
Your choices and rights
Depending on applicable law, you may request access, correction, erasure, restriction, portability or object to processing. Consent, where used, can be withdrawn without affecting prior lawful processing. You may complain to the competent data protection authority.
Account settings let you update profile details, change your password, manage sessions and notification preferences. These controls do not replace a data-access or erasure request. The privacy contact and identity-verification procedure must be published before launch.
For activity inside a customer’s PWA, contact that PWA’s operator first. A processor request should be coordinated with the controller. Browser settings let you revoke permission for future push notifications; that does not itself delete historical events.
Updates
The version and review date identify this draft. Material changes to purposes, recipients or legal terms require an updated notice and, where applicable, a new choice or agreement before the changed processing begins.