Privacy Policy

1. Overview

This Privacy Policy describes how Woven Web Tech ("we", "us", or "our") collects, uses, and protects information associated with your use of Woven AI Chat (the "Service"). We are committed to transparency and minimal data collection. This policy explains exactly what we collect, what we don't, and how your data is handled.

2. Information We Collect

To provide and maintain the Service, we collect the following account and usage data:

Data Type	Examples	Purpose
Account Info	Email, name, company name	Account creation and identification
Usage Data	Response count, plan tier, login timestamps	Plan limits, billing, analytics
Billing Data	Subscription status, payment method token	Subscription management via Stripe
Technical Data	IP address, browser type, device info	Security, abuse prevention, debugging

3. What We Do NOT Collect

Specifically, we do not collect or store:

• Your chat conversations or AI prompts/responses on our servers.
• Your uploaded documents beyond the temporary processing window (see Section 7).
• Your payment card numbers, CVV, or full card details (handled by Stripe).
• Biometric, health, or other sensitive personal data.
• Data from third-party analytics, advertising, or tracking SDKs — we don't use them.

4. How We Use Your Data

We use the limited data we collect solely to operate and maintain the Service:

• Account Management: Creating and managing your account, authentication, and profile.
• Usage Tracking: Counting AI responses against your plan limits and displaying usage dashboards.
• Billing: Processing subscription payments and managing plan upgrades/downgrades through Stripe.
• Security & Abuse Prevention: Monitoring for suspicious activity, rate-limiting, and preventing misuse.
• Service Improvement: Aggregated, anonymized metrics to improve reliability and performance.

5. Payment Processing

We use Stripe as our third-party payment processor. When you subscribe to a paid plan, your payment information is handled entirely by Stripe. We receive a tokenized reference to your payment method but never see or store your full card details. Stripe's compliance and security practices are governed by their own privacy policy and PCI-DSS certification.

6. AI Model & Data Processing

The Service uses Ollama with open-source models (Gemma 4) for AI inference. When you send a message to the AI:

• Your prompt is sent to the AI model for processing.
• The model generates a response and returns it to you.
• The prompt and response are not stored on our servers after the inference is complete.
• Conversation history is retained in your browser's localStorage — you can clear it at any time from your browser settings or the in-app "Clear Chat" button.

We do not train AI models on your data. The models used are pre-trained, open-source models running on our infrastructure.

7. Document Uploads

If you upload documents (e.g., PDFs, text files) for AI-assisted analysis:

• Uploaded documents are stored temporarily for processing only.
• All uploaded documents are automatically deleted after 24 hours.
• Documents are not used for model training or any purpose beyond your immediate session.
• Document content is not shared with third parties.

8. Data Sharing

We do not sell your data. We do not share your personal information with third parties for advertising or marketing purposes. We share data only with:

• Stripe — for payment processing (account email and subscription status).
• Service providers — only as necessary to operate the Service (e.g., hosting infrastructure).
• Legal authorities — only if required by law, court order, or to protect our legal rights.

9. Data Security

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS), secure authentication, and regular security reviews. However, no system is perfectly secure, and we cannot guarantee absolute security of your data.

10. Your Rights

You have the following rights regarding your data:

• Access: You can view your account data and usage statistics at any time from your dashboard.
• Delete: You can request deletion of your account and associated data by emailing us. Account deletion is permanent and irreversible.
• Export: You can export your account information (name, email, company, usage summary) in JSON format upon request.
• Withdraw Consent: You can stop using the Service and delete your browser localStorage at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. Children's Privacy

The Service is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it immediately.

12. Policy Updates

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

13. Contact