Privacy Policy.
Weave helps engineering teams diff, review and merge Boomi integrations. This policy explains what we collect, why, and the choices you have. We keep it short and specific on purpose.
01 Overview & scope
This policy applies to the Weave web application, APIs and websites operated by Weave, Inc. ("Weave", "we", "us"). It covers personal information we handle as a controller — your account details and how you use the product.
When you connect a Boomi environment, the integration metadata we process on your behalf is Customer Data. For that data your organization is the controller and we act as a processor under your agreement with us.
02 Information we collect
Account & identity
- Profile — name, work email, and (via SSO) the directory attributes your identity provider sends, such as workspace and role.
- Workspace settings — team name, members, and the review rules and policies you configure.
Usage & device
- Product activity — pages viewed, diffs opened, reviews and merges performed, and timestamps, used to operate and improve the service.
- Technical data — IP address, browser and device type, and diagnostic logs.
We do not sell personal information, and we do not use Customer Data to train machine-learning models without your explicit opt-in.
03 Your Boomi data
To produce diffs and reviews, Weave reads process and component definitions from the Boomi environments you connect — the structure of your integrations, not the records flowing through them.
- We never read or store the business data processed by your integrations at runtime (documents, messages, payloads).
- Connection credentials are encrypted with per-workspace keys and are only decrypted in memory to perform a sync you requested.
- Component definitions are cached only as long as needed to render diffs and history; you can purge a connection's cache at any time.
04 How we use information
- Provide the service — authenticate you, render diffs, run reviews, and record merge history.
- Secure it — detect abuse, troubleshoot, and maintain an audit trail of sign-ins and merges.
- Improve it — understand which features are used, in aggregate.
- Communicate — send service notices and, only with consent, product updates.
06 Data retention
- Account data is kept while your workspace is active and deleted within 30 days of closure.
- Diff & merge history follows the retention window you set per workspace.
- Logs are retained for up to 90 days, then deleted or anonymized.
07 Security
We maintain a SOC 2 Type II program. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is least-privilege and logged, and we test our systems regularly. No system is perfectly secure, but we work hard to keep yours safe and to notify you promptly if something goes wrong.
08 Your rights & choices
Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us or ask your workspace admin. We respond within the timeframes required by applicable law.
09 International transfers
We operate in the United States and the EU. Where we transfer personal information across borders, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent mechanisms.
10 Changes & contact
We'll update this policy as the product evolves and post the new effective date here. Material changes will be announced in-product or by email.
Questions or requests? Email our team at privacy@vegha.ai.