1. Who we are and what this policy covers
The controller of the processing described in this policy is WEEKI, a single-member simplified joint-stock company (SASU) with share capital of EUR 30,000, registered with the Lille Trade and Companies Register under number 899 960 587, whose registered office is at 2 Avenue Léon Jouhaux, 59000 Lille, France ("Weeki", "we").
This policy covers the personal data we process when you visit https://weeki.io and when you use the Weeki platform (sign-up, sign-in, use of the boards, the assistant and the agents, the Store, billing and support).
When our clients import data about other people into the platform (for example their customers or colleagues), the client is the controller of that data and Weeki processes it on the client's behalf, under the data processing terms of Appendix 2 of our General Terms and Conditions. Requests about that data should be sent to the client concerned.
Weeki has not appointed a data protection officer. For any question about your personal data, write to contact@weeki.io.
2. Data we process, why, on what legal basis and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating and managing your account, signing you in | Name, email address, password (stored as a hash), Google or single sign-on identifiers, organisation and role | Performance of the contract | For the life of the account, then deleted within 30 days (except backups, at most 400 days) |
| Providing the platform | Content you create or import, conversations with the assistant and their results, profile (job, language, assistant instructions) | Performance of the contract | For the life of the account, then deleted within 30 days (except backups, at most 400 days) |
| Counting and billing consumption (Credits) | Consumption logs | Performance of the contract | 12 months |
| Billing and accounting | Company details, invoices, payment history (card data are handled by our payment provider and are not stored by Weeki) | Performance of the contract; legal obligation | 10 years (French accounting rules) |
| Securing the platform | IP address and sign-in attempts (rate limiting only) | Legitimate interest (security of the service and of accounts) | Duration of the limitation window (15 to 60 minutes) |
| Support | Your requests and, if you choose to attach them, screenshots and technical logs of your browser | Performance of the contract | For the life of the contract, then 1 year |
| Service emails (account, security, billing, notifications) | Email address; log of the emails sent (address, subject, time, outcome) | Performance of the contract; legitimate interest | Email log: 12 months |
| Newsletter and product news | Email address, language, date and proof of consent | Consent (confirmed by email), which you can withdraw at any time with the unsubscribe link | Until you unsubscribe |
| Contact form and sales relationship | Name, email address, company, job, your message; for prospects: professional data from public sources and from data enrichment providers (see section 3), of which we inform you within one month | Legitimate interest (answering you and developing our business) or pre-contractual measures | 3 years after the last contact |
| Audience measurement of the website | Pages viewed, browser information, identifiers stored by cookies | Consent | 13 months for cookies; 25 months for the measurement data |
| Verifying student status (Student Plan) | Proof of School enrolment (student card or certificate) | Performance of the contract | Deleted immediately after processing |
We do not sell your personal data. We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, solely on the basis of automated processing.
3. Who receives your data
Your data are accessible to the members of the Weeki team who need them for their tasks (support, billing, security). Access by our support to the content of a client's private workspace only takes place within a support window opened by the client's account owner, for a limited time, or where strictly necessary for security, and is recorded in the organisation's access log.
We use the following service providers, which process data on our instructions:
- Google Cloud (Google Cloud France SARL) — hosting of the platform and of the website, France (Paris region);
- Amazon Web Services EMEA SARL — file storage and sending of the platform's emails, France (Paris region);
- OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) — processing of your instructions and generation of results by the assistant and the agents, and analysis of the proofs of enrolment submitted for the Student Plan, United States;
- Stripe Payments Europe, Ltd. — payments and invoicing, Ireland and United States;
- Cloudflare, Inc. — protection of the sign-up and sign-in forms against bots (Turnstile), United States and global network;
- Google Ireland Limited — sign-in with a Google account, if you choose it; audience measurement of the website (Google Analytics), with your consent;
- Piwik PRO (Piwik PRO SA, Poland) — audience measurement of the website and management of your cookie consent, with your consent; data hosted in the European Union;
- Twilio SendGrid — sending of newsletters and event invitations;
- Sentry — error monitoring of our customer relationship tool, United States;
- Lusha and Bright Data — enrichment of the professional contact data of prospects, United States and Israel;
- Tavily — web search for our marketing content, United States;
- Pexels — stock photos, United States.
Where you connect third-party services to the platform (Google Workspace, Notion, Slack, GitHub, HubSpot, Dropbox, Salesforce…), we store the access tokens and retrieve data only on your instructions; those services are chosen and managed by you. Weeki's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We may also disclose data to judicial or administrative authorities when the law requires it.
4. Transfers outside the European Union
The platform and its data are hosted in France. Some providers listed above (OpenAI, Stripe, Cloudflare, Google, SendGrid, Sentry, Lusha, Bright Data, Tavily, Pexels) may process data in the United States. These transfers are governed by the European Commission's Standard Contractual Clauses and/or by the provider's certification under the EU-U.S. Data Privacy Framework. You can obtain a copy of the safeguards by writing to us.
5. Artificial intelligence
When you use the assistant or the agents, your instructions and the data needed to answer them are sent to our AI provider to generate a result. Weeki does not use your data, your instructions or the results to train artificial intelligence models without your prior express consent. Our AI provider keeps the data sent to it for up to 30 days for abuse monitoring, then deletes it. Content generated by artificial intelligence is identified as such in the assistant. Results may be inaccurate: check them before relying on them.
6. Security
The security measures we apply are described on our Security page.
7. Cookies
Weeki uses the following cookies and similar trackers on https://weeki.io and on the platform:
- strictly necessary cookies, which keep you signed in, secure access to your account and remember your cookie choices; they cannot be refused, as the website and the platform cannot work without them;
- only with your consent, audience measurement cookies from Piwik PRO and Google Analytics (loaded through Google Tag Manager), which allow us to produce visit statistics (number of visits, pages viewed, journeys) in order to improve the website. These cookies are not necessary for the website to work.
You can accept all cookies, refuse all of them or choose by category, through the consent banner displayed on your first visit; refusing is as easy as accepting, and no optional cookie is placed before your choice. You can change your choice at any time through the cookie settings link at the bottom of each page, and delete cookies through your browser settings.
Cookies are kept for a maximum of thirteen (13) months, after which your consent is requested again.
8. Your rights
You have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to the portability of the data you provided, and to withdraw your consent at any time when the processing is based on it. You can also give instructions on what happens to your data after your death.
To exercise these rights, write to contact@weeki.io or use our contact form. We answer within one month. We may ask you to prove your identity if we have a reasonable doubt. You can also export your organisation's data at any time from the account settings.
You may lodge a complaint with the French data protection authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
9. Minors
The platform is not intended for children under the age of 15.
10. Changes to this policy
We may update this policy. The date of the current version appears at the top of the page, and the previous versions remain available. If a change significantly affects how we process your data, we will inform you by email or in the platform before it applies.
11. Contact
For any question about this policy or your personal data: contact@weeki.io — WEEKI, 2 Avenue Léon Jouhaux, 59000 Lille, France.