Last updated
Who we are
Weeveo is a website analytics service operated from India for customers around the world. This policy explains how we handle information when you use our service and when a website uses Weeveo for analytics. For privacy questions, contact sayan@weeveo.com.
Analytics on weeveo.com
We use Weeveo on our own public website. Depending on the configured mode, measurement starts after permission or runs as basic cookieless statistics without a consent popup. Basic mode respects saved refusals, Global Privacy Control and Do Not Track. It helps us understand visits, pageviews and session activity. Our homepage displays aggregate statistics for weeveo.com, including a live visitor count and activity charts. It does not publish individual visitor records, IP addresses or account details. Session recordings and identified visitor profiles are disabled for this setup. You can stop measurement on this browser using the control below. Basic measurement uses daily pseudonymous visitor estimates and approximate location, not an exact street address. Raw IP addresses are not stored in analytics events; infrastructure security logs are handled separately.
Accounts and service operation
We use your account email, name, hashed credentials, verification records, passkeys where added, preferences and session security information to provide and protect the service. Transactional email providers deliver verification and password-reset messages. Workspace members can see relevant membership information. Weeveo is responsible for its own account administration, billing and service security.
We use this information to provide the service you request, protect accounts and infrastructure, respond to support requests and meet applicable legal obligations. Features that require visitor consent are described below.
Website analytics
Website owners choose the purpose and act as controllers for their visitor analytics. Weeveo processes that information on their instructions. Basic measurement starts without a consent dialog and limits collection to traffic measurements and the supported conversion names. Consent based modes wait for a visitor choice. It measures page paths, traffic-source domains, selected campaign labels, conversion names, approximate country, region and city and browser/device categories. Query strings, form values and free-form event properties are excluded from ordinary analytics. Optional identified profiles accept only an account identifier and email after a separate opt-in. Obvious identifiers in paths are redacted; site owners must exclude any remaining sensitive paths and avoid personal information in event or campaign names.
Identifiers and choices
Daily mode uses a rotating pseudonymous network-based identifier; it is not a guarantee of anonymity. Optional first-party identifiers expire after 30 days. Raw IP addresses are used transiently for location and abuse prevention, rather than written into analytics events. Hosting and security providers may handle network logs separately. A necessary preference remembers the built-in analytics choice for up to 180 days. In consent based modes, “Privacy choices” lets visitors refuse or withdraw; an external consent manager must provide equivalent controls. In basic mode, site owners must provide an opt out through their privacy page. Choosing basic mode is not a guarantee that the setup qualifies for a consent exception in every jurisdiction. The updated tracker also honors Do Not Track and Global Privacy Control.
Features and sharing
Session replay, click/scroll heatmaps and visitor profiles are available. Recording is off by default and requires a separate visitor choice. All text and inputs are masked, sensitive paths are excluded, and withdrawal stops capture. Identified profiles require another separate choice and must be enabled by the site owner. Questions and report summaries submitted to the built-in assistant are sent to Amazon Web Services (Amazon Bedrock, using Kimi K2.5 in the US East / Northern Virginia region) when Bedrock is configured, or to Anthropic on installations using that provider. Only read-only reports for the selected website are available to the assistant; individual customer-journey tools are excluded. Conversations are saved to your Weeveo account, private to your user and website, so you can reopen and search them. You can delete a conversation and its saved messages from chat history; deleting your account or the website also removes these conversations. Provider logs and backups follow their separate retention arrangements. Avoid including personal or sensitive information in questions. Customer-created public links can disclose summary analytics to anyone holding the link until revoked. MCP and API connections let authorized third-party tools retrieve report summaries; customers must assess those recipients before connecting them. Optional payment integrations handle customer and transaction information separately from browser analytics.
Payments and service providers
Weeveo subscriptions and event packs are processed through Dodo Payments. We use payment references, subscription status, invoices and usage records to manage your plan, prevent billing abuse and assess refund requests. Payment details entered at checkout are handled by the payment provider; Weeveo does not store full card numbers.
Hosting, databases, email delivery, payment processing and configured AI providers help us operate the service. Information may be processed outside your country, including in India and the regions used by those providers. Authorized providers handle information for the service they supply, subject to their applicable terms and privacy arrangements.
History, retention and deletion
The analytics history available in your workspace follows your plan: six months on Free, two years on Pro and five years on Scale. Heatmaps and session replays have a separate 30-day history and are available on paid plans. These reporting windows do not describe every operational record or backup.
Account, billing, support, security and backup records may follow different retention periods where needed to operate the service, resolve disputes or meet legal obligations. Deleting an account, website, visitor record or conversation starts the applicable deletion process; backup expiry and legally required records can follow separate schedules.
Requests and complaints
Visitors should contact the website owner named in that website’s notice for access, correction, erasure, restriction, objection, portability or withdrawal requests, where applicable. Weeveo assists its customers with scoped analytics export and erasure. Some records cannot be located from an email alone; we do not ask owners to create new identification solely to find a visitor. Account holders can manage their details and delete their account. Contact Weeveo for service-related privacy requests. You may also complain to the competent data protection authority. Requests, identity verification and any legally required retention are assessed individually.