Contact
Privacy requests
WeaveCycle uses privacy@weavecycle.ai for privacy, security, and data protection requests until a dedicated legal contact is published.
Email a privacy requestPrivacy Policy
Privacy notice for WeaveCycle merchants and workspace users.
This policy explains how WeaveCycle handles account, Shopify, return workflow, and analytics data. It is a transparent legal-review draft dated October 28, 2026.
Controller and processor roles
WeaveCycle acts as a controller for direct site, account, support, security, and product analytics data. For Shopify merchant data and customer-related return workflow data processed inside a merchant workspace, WeaveCycle generally acts as a processor on the merchant's instructions.
This notice is not a signed data processing agreement. Merchants that need a DPA, final subprocessor terms, or legal entity details should contact WeaveCycle before sending live production data.
Data we process
Workspace and account data
Work email, name, job title, organization name, workspace name, role, invitation status, notification preferences, and sign-in timestamps.
Shopify and return workflow data
Store domain, Shopify scopes, product records, order records, return reasons, routing decisions, recovery values, and sync status. Protected customer data is limited to customer name and email (used to verify shoppers in the returns portal and identify the order owner). We do not collect customer phone, street address, or payment data.
Operational and audit data
Audit log actions, product events, sync runs, import summaries, webhook events, routing overrides, export records, and support context.
Analytics and device data
Public pageviews only after consent, signed-in product events, browser metadata, timestamps, referrer, and high-level usage properties.
Purposes and lawful bases
We process data to run the service, secure it, and make return recovery measurable.
Providing the WeaveCycle workspace
Contract or pre-contractual steps with the merchant, and legitimate interests in operating the service.
Processing Shopify return, order, product, and customer-related data
Processor activity performed on merchant instructions, plus contract performance for the workspace.
Security, auditability, abuse prevention, and service integrity
Legitimate interests and legal obligations where applicable.
Public marketing analytics
Consent. Public PostHog analytics is not initialized until analytics consent is accepted.
Product analytics inside signed-in workspaces
Legitimate interests in running and improving the B2B service, with disclosures and privacy request channels available.
Cookies and analytics
Supabase and WeaveCycle use essential auth cookies for sign-in and session continuity. Public PostHog analytics uses local storage and cookies only after consent. The default analytics host is the EU PostHog endpoint.
Retention
Workspace data is retained while the workspace is active and for a reasonable period needed for audit, security, legal, and backup purposes. Protected Shopify customer data (name and email) is erased on request: we honor Shopify's customer redaction and shop redaction webhooks programmatically, and respond to customer data requests within 30 days. Pilot merchants can also request deletion or export review by email.
Automated decisions
WeaveCycle routing, forecasting, and listing tools are workflow aids. The current product does not make solely automated legal or similarly significant decisions about individuals.
Your GDPR rights
We aim to respond within one month.
The response period may depend on identity verification, merchant instructions, and lawful exceptions.
Access the personal data WeaveCycle holds about you.
Correct inaccurate or incomplete personal data.
Delete personal data where GDPR grounds apply.
Restrict or object to processing where GDPR grounds apply.
Request portability for data you provided where the right applies.
Withdraw consent for public analytics at any time by clearing the analytics consent choice or contacting WeaveCycle.
Complain to your local data protection authority: in the EU or EEA, or the ICO in the UK.
Recipients and subprocessors
WeaveCycle uses infrastructure, auth, analytics, and commerce services to run the product. See the subprocessor page for the current list.
International transfers
Core data is hosted in the EU: the database runs on Supabase in Ireland, with Render Frankfurt, EU PostHog, and Vercel route execution preferred in Frankfurt where applicable. AI photo inspection (OpenRouter) and email delivery (Resend) are US-based providers, and some support, CDN delivery, or account administration may also involve processing outside the EEA, supported by provider DPAs and Standard Contractual Clauses where needed.
People we contact for business
If you received an email from us, this section explains how we handled your details.
Who we are. weavecycle, run by Taimoor ul Hassan as a sole trader. Contact address: B1130/02 Bandar Road, Sukkur, Sindh 65200, Pakistan. Email: privacy@weavecycle.ai.
What we hold. Your name, work email address, role and company, and public details about your store, such as its returns policy.
Where it came from. Your company's own website, a public company register (for example Companies House in the UK), or a business directory.
Why. To write to you about a product that relates to your role. Our legal basis is our legitimate interest in contacting businesses about relevant products.
How long. We keep your name and email address for 30 days after our last email, unless you reply. After that we keep only your company's website address, so we never write to the same company twice.
Who else handles it. Our email sending service (Instantly), our CRM (HubSpot) and our database (Supabase, hosted in Ireland).
Transfers. We are based in Pakistan, and our service providers may process your details outside the UK and the EU.
Your rights. You can object at any time, without giving a reason, by replying "no thanks" or writing to privacy@weavecycle.ai. We then stop and never contact you again. You can also ask to see, correct or delete your details. You can complain to your data protection authority, for example the ICO in the UK or the CNIL in France.