Privacy Policy

1. Who we are

Virtual Media Group Ltd (trading as Weaveeo) is the data controller for personal data processed through the Weaveeo website and application. Our contact address is United Kingdom. For privacy enquiries, email privacy@weaveeo.com.

2. What data we collect

• Account data: name, email address, password (hashed), role, and onboarding preferences.
• Artist profile data: stage name, genre, location, biography, and links you provide.
• Music & integration data: Spotify catalogue metadata, track information, and connection tokens when you authorise integrations.
• AI interaction data: chat messages, AI-generated reviews, gig search queries, and drafted emails you create or approve.
• Billing data: subscription status and Stripe customer identifiers (payment card details are processed by Stripe, not stored by us).
• Support data: messages you send to our support inbox and related ticket metadata.
• Technical data: IP address, browser type, device information, and cookies (see our Cookie Policy).
• Marketing reviews: name, optional role, rating, and review text you submit for publication (moderated before display).

3. How we use your data and lawful bases

Under UK GDPR we rely on the following lawful bases:

• Contract — to provide the service you sign up for, including AI features, gig tools, and billing.
• Legitimate interests — to improve our product, prevent abuse, and secure our platform, balanced against your rights.
• Consent — for optional cookies, marketing communications where required, and third-party integrations you connect.
• Legal obligation — where we must retain records for tax, accounting, or regulatory purposes.

4. AI processing

Weaveeo uses artificial intelligence to generate track reviews, draft emails, suggest gigs, and power in-app chat. AI outputs are assistive — you remain responsible for approving outbound communications and release decisions. See our AI Transparency Notice for full details.

5. Who we share data with

• Stripe — payment processing.
• Spotify — when you connect your account, subject to Spotify's own privacy policy.
• Mailgun — transactional and outreach email delivery.
• AI providers (e.g. Ollama) — to process prompts and generate responses you request.
• Infrastructure providers — hosting and database services that store encrypted data on our behalf.

We do not sell your personal data.

6. International transfers

Some providers may process data outside the UK. Where this occurs, we use appropriate safeguards such as UK International Data Transfer Agreements or adequacy regulations, and we assess transfer risks before enabling a sub-processor.

7. Retention

We keep account data while your account is active and for a reasonable period afterwards for legal and security purposes. Billing records are retained as required by UK law. Support tickets are retained to handle follow-ups and service quality. You may request deletion subject to exceptions (e.g. ongoing disputes or legal obligations).

8. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure in certain circumstances.
• Restrict or object to processing in certain circumstances.
• Data portability for data you provided, where applicable.
• Withdraw consent where processing is based on consent.

To exercise your rights, contact privacy@weaveeo.com. We respond within one month in most cases.

9. Complaints

If you are unhappy with how we handle your data, contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).