Privacy Policy

With this Privacy Policy we inform you in accordance with Art. 13 and Art. 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), the German Federal Data Protection Act (BDSG) and the German Digital Services Act (DDG) about how we process personal data when you use our website uiweaver.io and the related services.

1. Data controller

The controller within the meaning of Art. 4 No. 7 GDPR is:
DexterBee GmbH
Industriestraße 13
63755 Alzenau
Germany
Managing Director: Stephan Dongjin Oh
Commercial register: Amtsgericht Aschaffenburg, HRB 17694
VAT ID: DE369096037
Email: privacy@uiweaver.io
See also: Legal notice.

2. Data protection officer

A statutory obligation to appoint a Data Protection Officer under Art. 37 GDPR in conjunction with § 38 BDSG does not currently apply, as our core activities do not consist of large-scale regular and systematic monitoring of data subjects nor of large-scale processing of special categories of personal data. For any data protection inquiry please contact privacy@uiweaver.io.

3. Categories of data processed

3.1 Data you provide

• Contact details — name and email address and, optionally, phone number and company, when you submit a project enquiry, request a preview, or contact us.
• Business URL and business information — when you request a website audit or describe your business.
• Chat transcript — your messages to our AI assistant "Sophie" and her replies (see Section 5).
• Project brief — your website requirements in structured form, captured in the chat with Sophie or via a form and editable by you at any time, plus the template or package you selected, if any.
• Payment data — processed exclusively by Stripe; we never store full card numbers.

3.2 Data collected automatically

• IP address — hashed within 24 hours; used only for regional delivery and abuse prevention. With project enquiries and consent records we store the IP address only as a truncated, salted SHA-256 hash.
• Usage data — pages visited, time on site, referrer (only with consent).
• Cookies and similar technologies — see Cookie Policy.
• Consent records — as proof of your cookie choice we store a consent ID, your choices, the version of the consent text, the hashed IP address, your browser's user agent, the language and the timestamp.

4. Legal bases for processing

Purpose	Legal basis
Handling your project enquiry (AI assistant Sophie or form, project brief, storing the enquiry, follow-up by our designers)	Art. 6(1)(b) GDPR (pre-contractual measures taken at your request)
Internal initial assessment of enquiries (package estimate, lead score) to prioritise our call-backs	Art. 6(1)(f) GDPR (legitimate interest in prioritising call-backs efficiently)
Providing the service (preview, delivery)	Art. 6(1)(b) GDPR (contract performance / pre-contractual measures)
Sending transactional emails (receipts, delivery, copy of your project brief)	Art. 6(1)(b) GDPR
Proof of cookie consents given or refused	Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent)
Analytics (Google Analytics 4)	Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent)
Marketing emails (newsletter)	Art. 6(1)(a) GDPR (consent)
B2B outreach (Renewal Protocol — sending design previews)	Art. 6(1)(f) GDPR (legitimate interest, documented via a balancing test)
Fraud prevention and IT security	Art. 6(1)(f) GDPR
Compliance with retention obligations	Art. 6(1)(c) GDPR (§§ 147 AO, 257 HGB)

5. Project enquiry and AI assistant "Sophie" (Google Gemini)

5.1 AI assistant Sophie

At /en/start you can describe your website project in a chat with "Sophie", UIWeaver's AI assistant. Sophie is clearly disclosed as an AI assistant in her greeting and next to her avatar (Art. 50 Regulation (EU) 2024/1689, AI Act). Sophie asks about your website requirements and records them in a structured project brief that you can see live and edit at any time. Sophie does not make decisions, quote prices, or create designs.

To generate Sophie's replies we use Google's Gemini API (paid tier). Your chat inputs and the current state of the project brief are transmitted to Google and processed there to generate Sophie's replies. Under Google's paid-tier terms these inputs are not used to train Google's models; however, Google may retain them for a limited period to detect abuse. Before your first message the chat informs you that your messages are stored so that our designer understands your request, that they are deleted after 90 days, and that the replies are generated by Google Gemini. Recipient: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For international transfers see Section 8.

5.2 Form without AI

Alternatively, you can fill in the same project brief as a plain form. No AI system is involved in this case.

5.3 Storing your enquiry

When you submit your enquiry, we store in our Supabase database (EU region Frankfurt am Main) the project brief, your contact details (name, email address, optionally phone number and company), the chat transcript (if you used the chat), a truncated, salted SHA-256 hash of your IP address, and information on the template or package you selected. In addition, short internal notes for our designers summarising the conversation are created via the Gemini API. By email (via Scaleway Transactional Email, EU) we receive a notification of your enquiry, and you receive a copy of your project brief.

5.4 Internal initial assessment

For each enquiry an estimate of the likely suitable package and a priority (lead score) are determined automatically. This information is visible internally only and is used solely to prioritise the order of our call-backs. It has no legal effect on you and does not similarly significantly affect you; every enquiry is reviewed by a human designer. This is a profiling-like internal assessment; no automated individual decision within the meaning of Art. 22 GDPR is taken. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is prioritising call-backs to incoming enquiries efficiently. You may object to this processing at any time (Art. 21 GDPR, see Section 12).

The legal basis for the processing described in Sections 5.1 to 5.3 is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). For retention periods see Section 6.

6. Retention periods

• Chat transcripts with Sophie and the internal designer notes derived from them: deleted after 90 days.
• Project enquiries (project brief, contact details, internal initial assessment) without a concluded contract: deleted 6 months after the enquiry was received, unless it is still being actively handled (open quotes are kept until they are concluded).
• Consent records (cookie consents): deleted 3 years after the consent was given or last updated.
• The deletion periods above are enforced by an automated job that runs daily.
• Customer records: 10 years per § 147 AO and § 257 HGB (German tax and commercial law), then deleted.
• Unsubscribed contacts: personal data deleted within 30 days; email kept on a suppression list to prevent re-contact (Art. 6(1)(c) GDPR).
• Prospect data (publicly accessible business data): automatically deleted after 90 days if no conversion occurs.
• IP addresses: hashed within 24 hours of collection.
• Analytics data: 14 months (configured GA4 retention).

7. Recipients and processors

We engage carefully selected processors within the meaning of Art. 28 GDPR. A data processing agreement (Art. 28(3) GDPR) is in place with each processor. A template is available at Data Processing Agreement.

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Payment processing (PCI-DSS certified). Legal basis: Art. 6(1)(b) GDPR. stripe.com/privacy.

Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992; parent company based in the USA. PostgreSQL database (including storage of project enquiries and consent records) hosted in the EU region Frankfurt am Main (AWS eu-central-1). Legal basis: Art. 6(1)(b) and (f) GDPR. Third-country transfers (USA) are safeguarded by EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 and, additionally, the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023, C(2023) 4745). supabase.com/privacy.

Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Hosting and edge functions. Legal basis: Art. 6(1)(b) GDPR. US transfers safeguarded by EU Standard Contractual Clauses and the EU-US Data Privacy Framework (adequacy decision of 10 July 2023). vercel.com/legal/privacy-policy.

Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France (Scaleway Transactional Email, region fr-par, Paris). Transactional email delivery, including our notification of new project enquiries, the copy of your project brief sent to you, delivery and receipt emails following a purchase via Stripe, and notifications of enterprise applications. Processing takes place within the EU; no third-country transfer occurs for email delivery. A data processing agreement pursuant to Art. 28 GDPR is in place with Scaleway. Legal basis: Art. 6(1)(b) GDPR.

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Gemini API). Processing of chat inputs and the project brief to generate the replies of the AI assistant Sophie and internal conversation summaries for our designers (see Section 5). Legal basis: Art. 6(1)(b) GDPR. Third-country transfer based on EU Standard Contractual Clauses and the EU-US Data Privacy Framework (Google LLC is certified). ai.google.dev/terms.

Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4). Reach analysis. Only used after prior consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG); IP anonymisation is enabled. Onward transfers to Google LLC, USA, are safeguarded by the EU-US Data Privacy Framework.

Sanity.io (Sanity, Inc., 153 Townsend Street, San Francisco, CA 94107, USA) — headless CMS for delivered customer websites (optional). Third-country transfer based on Standard Contractual Clauses and the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR.

We do not sell your personal data.

8. International transfers

Our primary infrastructure (database, storage) is located within the EU/EEA. Where processors are located outside the EU, or where data is transferred to affiliates in the United States, transfers are based primarily on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework of 10 July 2023 (C(2023) 4745). Additionally, we rely on EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 and supplementary technical and organisational measures (encryption in transit and at rest, access controls, data processing agreements). Upon request we will provide you with the applicable safeguards.

9. Magic-link preview

Where we proactively prepare a design preview for a business (Renewal Protocol, see Section 4), that business receives a personal preview link (magic link) by email. Project enquiries via /start do not receive such a link. The link contains a cryptographically signed HMAC token valid for 30 days and grants access to the prepared preview without a classic login. No profiling is performed. Legal basis: Art. 6(1)(b) GDPR. After expiry the token becomes invalid server-side.

10. Personal data breaches (Art. 33, 34 GDPR)

We undertake to notify the competent supervisory authority of a personal data breach without undue delay, where feasible within 72 hours of becoming aware of it (Art. 33 GDPR). Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, you will also be notified without undue delay (Art. 34 GDPR). We operate internal escalation and incident-response processes to ensure these obligations are met.

11. Data Processing Agreement (Art. 28 GDPR)

Where we process personal data of our customers' end-users on their behalf, we enter into a data processing agreement under Art. 28 GDPR upon request. A pre-formulated template is available at /en/legal/dpa and can be provided in signed form on request to privacy@uiweaver.io.

This applies in particular to the AI features we operate for our customers on their websites and channels (e.g. AI chatbot, AI enquiry manager, WhatsApp chatbot). For this processing, the respective customer, as operator of the website, is the controller, and their privacy policy applies. This Privacy Policy covers only processing for which we ourselves are responsible.

12. Your rights (Art. 15 et seq. GDPR)

You have the following rights vis-à-vis us:

• Access (Art. 15 GDPR).
• Rectification (Art. 16 GDPR).
• Erasure ("right to be forgotten", Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Portability in a structured, commonly used, machine-readable format (Art. 20 GDPR).
• Objection to processing based on legitimate interests, including profiling (Art. 21 GDPR) — in particular to the internal initial assessment of your enquiry (package estimate, lead score, Section 5.4).
• Withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
• Not to be subject to a decision based solely on automated processing (Art. 22 GDPR). Note: our AI assistant Sophie does not make decisions; the internal initial assessment (Section 5.4) is used for prioritisation only, and every enquiry is reviewed by a human.

To exercise these rights, an informal notice to privacy@uiweaver.io is sufficient. We respond within one month (Art. 12(3) GDPR).

13. Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for DexterBee GmbH is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de). You may also lodge a complaint with the authority of your habitual residence or workplace. A list of all EEA data protection authorities is available at edpb.europa.eu.

14. Obligation to provide data

To enter into a contract, providing the data marked as mandatory (in particular email address and billing data) is required. Without these data the contract cannot be concluded or performed. To handle a project enquiry, your name and email address are required; phone number and company are optional.

15. Changes to this Privacy Policy

We update this Privacy Policy as legal requirements or our processing activities change. Material changes will be communicated by email to known contacts. The version in force at the time of processing applies.

16. Contact

Privacy inquiries: privacy@uiweaver.io
Postal address: see Legal notice.