Privacy

Weave is operated by Ple Consulting AB, Sweden. It is used by the companies that have been given access to it, and is not offered to the public.

Weave synchronises warehouse events between a warehouse management system and Microsoft Dynamics 365 Business Central. Almost everything it holds is operational business data rather than personal data:

• goods movements, with article numbers, quantities, batch and serial numbers, and the time and place of each receipt
• purchase order, return order and customer order references
• the identifiers Weave needs to talk to each system, and an audit log of every request it made and the response it received

Two categories concern people. Signing in stores the name, email address and Microsoft account identifier that Microsoft returns, plus a session. And a warehouse event may carry the identifier of the warehouse operator who handled it, because the warehouse system records who scanned what.

A company that connects Weave to Slack gives it a channel to post to. Weave stores the workspace and channel names, who connected it and when, and the access token and webhook Slack issues, encrypted like every other credential. The messages it posts summarise errors and may name order numbers. The app is also permitted to look up workspace members by email address, so that it can mention the person responsible for a stalled document. When someone snoozes a Backlog message or marks it handled, Weave stores their Slack user name and id with it, and until when. It does not read channels, messages or files.

It does not read email, files, calendars or contacts. It does not profile anyone, make automated decisions about anyone, or use any data for advertising or model training. It is not sold or shared with third parties.

In a PostgreSQL database hosted by Neon in the EU (Frankfurt, eu-central-1), and on Vercel’s infrastructure for the application itself. Credentials for the connected systems are encrypted at rest with AES-256-GCM; the key that opens them is held separately from the database.

Only people an administrator has explicitly added to a specific customer. Signing in with a Microsoft account is not sufficient on its own: without membership of a customer, a signed-in person sees nothing. Each customer’s data is isolated, and every query is restricted to one customer at the data-access layer rather than by convention.

Ple Consulting AB staff operating and supporting Weave can access the data in the course of doing so.

Warehouse events and the audit log are kept for as long as the customer uses Weave, because they are the record that proves what was posted to the accounting system and why. A customer can ask for their data to be exported or deleted, and it will be, except where accounting law requires a record to be retained.

Under the GDPR you may ask what is held about you, ask for it to be corrected or deleted, object to processing, or complain to your supervisory authority (in Sweden, Integritetsskyddsmyndigheten).

Write to hello@weavebc.com.