Last updated: April 16, 2026 · Effective date: April 16, 2026
We collect information in the following categories:
Information you provide directly
Information collected automatically
Information from third parties
We do not collect sensitive personal information such as Social Security numbers, driver's license numbers, precise geolocation, racial or ethnic origin, health data, or biometric identifiers.
We use the personal information we collect for the following business and commercial purposes:
We will not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases as defined by GDPR Article 6:
| Purpose | Legal Basis |
|---|---|
| Responding to inquiries & delivering services | Performance of a contract (Art. 6(1)(b)) |
| Processing payments | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails | Performance of a contract (Art. 6(1)(b)) |
| Website analytics & improvement | Legitimate interests (Art. 6(1)(f)) |
| Fraud prevention & security | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance & record-keeping | Legal obligation (Art. 6(1)(c)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interests at any time — see Section 06.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:
Right to Know (Access)
You have the right to request that we disclose: (1) the categories of personal information we have collected about you; (2) the categories of sources; (3) the business or commercial purpose for collecting it; (4) the categories of third parties with whom we share it; and (5) the specific pieces of personal information we have collected about you.
Right to Delete
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., completing a transaction, legal obligations, or security purposes).
Right to Correct
You have the right to request that we correct inaccurate personal information we maintain about you.
Right to Opt-Out of Sale or Sharing
We do not sell personal information, nor do we share it for cross-context behavioral advertising. You therefore do not need to opt out. If this practice changes, we will update this policy and provide a “Do Not Sell or Share My Personal Information” link on our homepage.
Right to Limit Use of Sensitive Personal Information
We do not collect or process sensitive personal information as defined by the CPRA beyond what is strictly necessary to provide the services you have requested.
Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny services, charge different prices, or provide a different quality of service based on your exercise of these rights.
How to Submit a Request
To submit a verifiable consumer request, contact us at support@wevyst.com with the subject line “California Privacy Request.” We will respond within 45 days. If we need more time, we will inform you of the reason and extension (up to 90 days total). You may designate an authorized agent to make a request on your behalf; we will require written proof of authorization.
Shine the Light (California Civil Code § 1798.83)
California customers may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures. To make a request under this law, email us at support@wevyst.com.
Categories collected in the past 12 months
| Category | Collected | Sold / Shared |
|---|---|---|
| Identifiers (name, email, IP) | Yes | No |
| Commercial information (purchase records) | Yes | No |
| Internet / network activity | Yes | No |
| Sensitive personal information | No | No |
| Geolocation data | No | No |
| Biometric data | No | No |
If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the GDPR (and UK GDPR respectively):
International data transfers
Our primary service providers (Stripe, Supabase) may process data in the United States. Where we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.
How to exercise your rights
Submit requests to support@wevyst.com with the subject line “GDPR Data Request.” We will respond within 30 days (extendable by two further months for complex requests). We may need to verify your identity before fulfilling your request.
Right to lodge a complaint
You have the right to lodge a complaint with your local supervisory authority. In the EU, you can find your authority at edpb.europa.eu. In the UK, contact the Information Commissioner's Office (ICO).
We retain personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law.
| Data type | Retention period |
|---|---|
| Client project records | 3 years after project completion |
| Invoices and payment records | 7 years (tax / legal obligation) |
| Inquiry / contact form data | 1 year if no contract is formed |
| Analytics data | 26 months (Google Analytics default) |
| Marketing consent records | Until consent is withdrawn + 3 years |
You may request earlier deletion at any time (subject to legal retention requirements) by contacting support@wevyst.com.
We implement appropriate technical and organisational measures to protect your personal information against accidental loss, unauthorised access, alteration, disclosure, or destruction. These include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33–34.
No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
Our services are not directed to individuals under the age of 16 (or under 18 in jurisdictions that require a higher age for consent). We do not knowingly collect personal information from children.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@wevyst.com and we will delete it promptly.
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
We encourage you to review this policy periodically. Your continued use of our services after changes become effective constitutes acceptance of the revised policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
For GDPR-related matters, you may also contact us as the data controller. If you are unsatisfied with our response, you have the right to contact your local data protection authority.