NodeWeave
Privacy notice
Effective 16 September 2026 · Personal Data Protection Act 2012 (Singapore)
What we collect
Account data (email, name, sign-in provider), store data you enter (people, contacts, documents, notes, calendar, channel settings), usage and billing records, concierge conversations, and technical data (device, approximate location from IP, logs). We hash IP addresses where we keep them for audit.
Why
To run your store and desk, deliver messages you or your loops send, sign documents, bill you, keep the service secure, and improve it. We rely on consent, contract performance and legitimate interests as permitted under the PDPA.
Where it lives
Data is stored with Supabase in Tokyo (ap-northeast-1) and served via Vercel and Cloudflare. Secrets are held in an encrypted vault. Some processors (Stripe for payments; Meta for WhatsApp; Google for Gmail connections; Anthropic/OpenAI for the concierge and search) receive the minimum data needed for their function.
Your customers' data
When you use NodeWeave to handle your own customers' personal data, you are the organisation responsible under the PDPA and NodeWeave is your data intermediary. We process it on your instructions and protect it with the controls described here.
Automated decisions
Loops schedule, remind and escalate automatically. The concierge answers from your published content. No decisions with legal effect on individuals are made without a person in the loop.
Retention
Account and store data for as long as your store exists and 30 days after closure; billing records as required by law (typically 5 years); concierge logs 12 months; hashed audit data with the signed document.
Your rights
You may access, correct or withdraw consent for your personal data by contacting us; withdrawal may limit what we can provide. Data Protection Officer: dpo@nodeweave.ai.
Security
Row-level security on every table, least-privilege service access, encrypted secrets with rotation, signed sessions, rate limits, and a locked-down mode for incidents. No system is perfectly secure; we notify affected parties of notifiable breaches as the PDPA requires.
Cookies
Session cookies for sign-in and preferences; no third-party advertising cookies.
Changes
We may update this notice; material changes are announced on the status page and by email to store owners.