This policy explains how Weflayr SAS handles personal data for which we are responsible: the data of people who visit our website, who use our platform, who pay for it, who we contact about our product, and who apply to work with us.
It does not cover the data your application sends us through our SDK or through our AI Gateway. For that data you are the controller and we act as your processor, on the terms of our Data Processing Agreement.
Who we are. Weflayr SAS, a société par actions simplifiée registered at 12 place Henri Bergson, 75008 Paris, France. RCS Paris 103 332 649.
Who to contact. privacy@weflayr.com. We have assessed the criteria of Article 37 of the GDPR and are not required to appoint a Data Protection Officer. We have designated a Data Protection Lead, who is the point of contact for any question about this policy.
What we collect, and why
If you visit our website
We collect limited technical data needed to serve the site securely, including your IP address, browser type and the pages you view.
We use PostHog, hosted in the European Union, to understand how the site is used. This includes session analytics that record page interactions (clicks, scrolling and navigation) so we can diagnose usability problems; it is configured to mask text entered into forms. PostHog runs only if you accept analytics cookies, and you can withdraw consent at any time from the "Cookie preferences" link in the footer.
With your consent, PostHog stores a small number of first-party cookies and local-storage entries to recognise your browser across pages and visits. They last no more than 13 months. If you decline, none are set.
Legal basis. Legitimate interest in operating and securing our website. Consent for non-essential analytics, session recording and cookies, which you can give or withhold in our cookie banner and change at any time.
If you use the Weflayr platform
We collect your name, business email address, your role and organisation, your authentication events, the API keys you create and their usage, and records of your activity in the product, including the models you approve, the routing rules you configure and your Credit balance and consumption. We also collect support requests you send us.
Legal basis. Performance of the contract with you or your employer, and our legitimate interest in securing the Service, preventing abuse and billing accurately.
If you buy Credits or are a billing contact
When your organisation buys Credits, we collect the name and email address of the person making the purchase, the billing name, address and VAT number of your organisation, the amount, currency and date of each payment, and the last four digits, brand, expiry date and country of the card used, together with the receipts and invoices we issue.
Payments are handled by Stripe. Card details are entered in a payment form served by Stripe Payments Europe, Ltd. and go directly to Stripe. We never receive or store your full card number or security code. Stripe acts as our processor to take the payment, to store your card for future and automatic top-ups where you enable them, and to issue receipts. Stripe also acts as an independent controller for its own purposes, in particular fraud prevention, security and compliance with the financial regulations that apply to it. That processing is described in Stripe's privacy policy at stripe.com/privacy.
Paying in your own currency. Where you choose to pay in the currency of your card, Stripe determines and displays the exchange rate before you confirm. We receive the amount in your currency and the US dollar amount credited to your organisation.
Legal basis. Performance of the contract, compliance with our accounting and tax obligations, and our legitimate interest in preventing payment fraud and recovering amounts due.
If we contact you about Weflayr
We collect business contact information, being your name, business email address, job title, employer and publicly available professional information. We obtain it from you directly, from your employer's website, from professional networks and from business data providers.
Legal basis. Legitimate interest in promoting a product relevant to your professional role. You can object at any time, and every message we send contains an unsubscribe link. Where the law of your country requires consent for such contact, we obtain it first.
If you apply for a role with us
We collect the information in your application and any notes we make during the process.
Legal basis. Steps taken at your request before entering into a contract, and our legitimate interest in assessing candidates.
Where your data is processed
Our platform, our analytical store and our internal systems are hosted in the European Union.
Some of the providers we use to run our own business are established outside the European Economic Area, or process part of the data there. This is the case of Stripe, which processes payment data in the European Union and in the United States. Where that is the case, transfers are governed by an adequacy decision, including the EU-US Data Privacy Framework for providers certified under it, or by the Standard Contractual Clauses adopted by the European Commission. A copy of the relevant clauses is available on request.
Who we share it with
We share personal data only with the providers we use to operate our business and our Service, and only to the extent they need it. They are listed, with their location and role, at trust.weflayr.com. Stripe receives the billing information described above and nothing about your use of the platform beyond the amounts you pay.
We do not sell personal data, and we do not share it for advertising purposes.
We may disclose personal data where the law requires it, to our accountants and auditors under confidentiality, or to establish, exercise or defend legal claims, including to recover unpaid amounts or to contest a payment dispute.
How long we keep it
| Data | Retention |
|---|---|
| Website technical and analytics data | 13 months at most |
| Account and product usage data | For as long as the account is open, then 30 days |
| Support correspondence | 3 years from the last exchange |
| Prospect and marketing contact data | 3 years from the last contact with you |
| Job applications, where you are not hired | 2 years, unless you agree to a longer period |
| Credit purchases, payment receipts, invoices and accounting documents | 10 years, as required by article L123-22 of the French Commercial Code |
| Card details stored for future top-ups | Held by Stripe until you remove the card or close your account; we hold only the last four digits, brand and expiry date |
| Security and access logs | 12 months |
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent.
To exercise any of these, write to privacy@weflayr.com. We usually respond within a few days, and always within the one month required by law.
If you are unsatisfied with our response, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris, or with the supervisory authority of your country of residence.
Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means alone. Stripe applies automated fraud screening to card payments under its own responsibility; where a payment is declined for that reason, you can contact us at support@weflayr.com and we will look into it with Stripe.
Security
We maintain an information security management system aligned with ISO/IEC 27001. Our current security posture and certification status are published at trust.weflayr.com. Payment pages are served by Stripe, which is certified PCI DSS Level 1.
Changes to this policy
We may update this policy. Where a change materially affects you, we will say so at the top of this page and, where we hold your contact details and the change concerns you, we will tell you directly.
Contact
Weflayr SAS, 12 place Henri Bergson, 75008 Paris, France.