Privacy Policy

WeEngage
Operated by InsightEQ Solutions LLC
Effective Date: August 26, 2026
Last Updated: October 16, 2026

Latest change (October 16, 2026): Accuracy update. Messages sent during a live session, between participants, between a participant and the facilitator, and in the group channel, are not stored in our database. They are held only in the server's memory while the session runs. They are erased when the session ends, whichever way it ends, and they are lost if the server restarts. A participant or facilitator can keep a copy by downloading a chat transcript as a text file, which is saved to their own device, not by WeEngage (Section 2.3).

Earlier change (October 8, 2026): New feature: a facilitator can lock a session. A locked session has no open join code; the facilitator adds each person by name and email, and WeEngage emails that address a personal link that is the person's seat. Because the facilitator needs to resend a link, the address is stored on the session's participant list (Section 2.3) and is deleted with the session (Section 5). It is used for nothing else. A seat that joined with the open code before the session was locked has no address unless the facilitator adds one.

Earlier change (October 8, 2026): Two things about participants, who still need no account. First, a participant can now switch devices: the join form has an optional email field, and the participant screen has a Switch devices panel that can email a rejoin link or show a QR code. The email address is used to send that one message and is not stored anywhere (Section 2.3). What is stored on the session's participant list is a one-way hash of the link, so the link can be checked when it is opened; the facilitator can revoke it, and it stops working when the session ends. Second, a correction: since October 7 the browser no longer sends a browser-wide identifier when joining. Instead WeEngage gives each browser a random key for that one seat in that one session and stores only a one-way hash of it (Section 2.3), so nothing links a participant in one session to a participant in another. Nothing else changed about what is collected or how long it is kept.

Earlier change (October 6, 2026): When you sign up while using WeEngage inside Microsoft Teams or Zoom, we now record that, so we can see how many sign-ups come through each marketplace. It is the same optional tag we already recorded from links (Sections 2.1 and 9.1), set automatically instead of from a link. Nothing is shared with anyone, nothing follows you across other sites, and nothing new is kept in your browser beyond the tab.

Earlier change (October 3, 2026, later the same day): Organizations with four or more teams can group them into departments of two or more teams (the organization chooses the word). A department's leaders see that department's insights, usage and report, the way a team's leaders see their team's; they never see a team's own view or client data. On organization-wide insights and reports, each theme names the departments it came from once two or more departments held a meeting in the period; teams are still never named, and the team count shows otherwise (Section 3.2).

Earlier change (October 3, 2026): Reports now cover projects, teams and the whole organization as well as clients, and a new Reports page lists every report you have saved. Team and organization reports never include quotes; an organization-wide report (and organization insights) can say how many teams a theme came from, as a count only, never a team's name, and only when three or more teams held a meeting in the period. To tell you whether a saved report is still up to date, and to open an existing report instead of building a second one over the same meetings, each report now records which meetings it covered (their ids, not their content). Reports are saved per client, project, team or organization, view and lens; building again with a different time range replaces the earlier one (Section 3.2). Nothing else changed about what is collected or how long it is kept.

Earlier change (October 2, 2026): New feature. A facilitator on a Pro plan can create a client report from a client's insights: a printable summary of themes across that client's meetings, with a few quotes from participants' own responses. To write it, WeEngage sends Claude the name-free digests of the client's meetings, and a numbered list of response text so Claude can choose which responses to quote. Claude only picks; it never writes or changes a quote. The facilitator reviews every quote before printing and quotes carry no names. WeEngage keeps the latest report so the facilitator can come back to it; it keeps which responses were chosen, not copies of them (Section 3.2). Meetings marked Confidential are left out of client reports entirely (Section 3.2). Nothing else changed about what is collected or how long it is kept.

Earlier change (October 2, 2026): New feature. A facilitator on a Pro plan can add one transcript from their own notetaker (for example Zoom, Teams or Otter) to a saved session, and WeEngage rewrites that session's meeting digest from the record and the transcript together (Section 3.2). Before anything is sent to Claude, WeEngage replaces the names it can identify with a placeholder and numbers each speaker; email addresses, phone numbers and links are removed by pattern. The transcript itself is never stored: only its file name and the date it was added are kept, and they are deleted with the session (Sections 5.2 and 5.3). Section 6.3 updated to match. WeEngage still does not record or transcribe meetings.

Earlier change (October 2, 2026): Pro can now be bought through the Zoom App Marketplace, and to give the right WeEngage account its Pro we now keep a small amount of Zoom information for people who use WeEngage inside Zoom (Section 6.6): your Zoom user ID, linked to your WeEngage account; whether Zoom reports a paid WeEngage license for you; and an encrypted token used only to ask Zoom that one question. Before this change no Zoom identifier was linked to a WeEngage account. We still request no access to your meetings, participants, contacts, recordings, or chat, and we never receive your payment details from Zoom. This applies only if you add WeEngage to Zoom.

Earlier change (October 1, 2026): We now count how many times a Sign up button is clicked, so we can see how many people who start signing up go on to finish (Section 9.2). The count is anonymous: we record which button was clicked, whether WeEngage was open in a browser, Zoom, or Microsoft Teams, and the date. We do not record who clicked, and nothing is stored in your browser for it.

Earlier change (September 30, 2026): Meeting digests can now be read through a lens (Organizational health, Coaching, or Project management), and each lens's grouping is made by a second, smaller call to Claude that sees only the digest's own name-free points, never the session record (Section 3.2). Nothing changed about what is collected or how long it is kept.

Earlier change (September 30, 2026): When you sign up, we now record where you came from, so we can see which channels bring people to WeEngage. Two optional pieces: the answer to a new "How did you hear about us?" question on the sign-up form, and, if the link you followed had a short tag on the end (such as ?src=linkedin), that tag (Sections 2.1 and 9.1). Nothing is shared with anyone, and nothing follows you across other sites.

Earlier change (September 28, 2026): In Ask about your meetings, a facilitator can now attach up to five files instead of three (Section 3.2). Nothing else changed about how those files are handled: they are still sent to Claude only to answer questions in that chat and are never saved.

Earlier change (September 26, 2026): Deleting your account now cancels your own Pro subscription at Stripe immediately, so your card is not charged again (Section 5.4). Before this change, deletion left the subscription running until you cancelled it from your billing portal. Nothing changed about what data we collect, how it is processed, or your rights.

Earlier change (September 26, 2026): Two things. First, a new feature: Ask about your meetings, the private chat a Pro facilitator can use over their own saved sessions (Section 3.2), including the option to attach files of the facilitator's own, such as a meeting transcript from their notetaker or an agenda. Chat conversations (questions and answers) are saved so the facilitator can return to them; attached files are sent to Claude to answer questions and are never stored. Sections 5 and 6.3 updated to match, and Section 5.5 now explains how participants' deletion requests are handled for sessions run by an individual facilitator and for sessions run for an organization.

Second, an accuracy sweep of the whole policy against how the app actually works. The corrections: individual responses cannot be deleted in the app, and a participant can change their own response until the facilitator closes the question, not only until responses are shown (Sections 5.5, 8.2, 8.3); account deletion is self-service, marks the account deleted at once, and permanently removes it after 90 days (Sections 5.4, 8.3); a participant's display name is stored with every response, including anonymous ones, and is hidden rather than removed (Section 2.3); a random identifier kept by the participant's browser is recorded at join (Section 2.3); the post-session feedback form and thumbs-up/down ratings on insights are stored (Sections 2.3, 3.2); we send more than login codes by email, including product and marketing emails you can opt out of (Sections 3.5, 6.1); passwords are stored as one-way hashes (Section 2.5); the browser holds more than one sign-in token, and one short-lived cookie is set during Zoom installation only (Sections 6.6, 9); we do have direct access to our own database as its operator (Section 7.3); there is no account-level switch that turns off AI processing (Sections 8.6, 8.7); the help chat's plan tier can also be Team, and emailing support from it sends your account name as well as your email (Section 3.3); and the placeholder under Contact Us is gone. Section 14 no longer promises an email or in-app notice, or a separate opt-in, for policy changes; changes are described at the top of this page, as they always have been. Also added: what the API returns for accounts that have it enabled (Section 4.5) and what else we store about facilitators, such as notes, whiteboard drawings, client and project names, and organization membership (Section 2.6). Nothing changed about how data is processed or shared, and nothing new is collected.

Earlier change (September 24, 2026): New feature. When a Pro facilitator ends a session with Save & End Session, WeEngage now writes a meeting digest: a short, structured record of what the meeting surfaced, used to find patterns across meetings (Section 3.2). Names are removed before the record is sent to Claude, and the digest is deleted along with the session. Also an accuracy correction: Sections 3.2 and 6.3 previously mentioned a per-session switch to turn AI insights off. No such switch exists; the actual controls are now described there. Nothing changed about what data we collect or your rights.

Earlier change (September 11, 2026): New feature. You can now rate a help-chat reply with a thumbs up or down. If you do, we store that one rated exchange — the question you asked, the reply, your rating, and any comment you add — so we can find and fix wrong answers (Section 3.3). The rest of the conversation is still not stored on our servers. Nothing changed about what data we collect elsewhere, how it is processed, or your rights.

Earlier change (September 11, 2026): Accuracy update. Session records are printed or saved as PDF from the session view in the app; the earlier references to downloading an HTML or JSON export (Sections 3.1, 4.1, 8.4 and 10.3) described a button that was removed on August 26, 2026. Nothing changed about what data we collect, how it is processed, or your rights.

Earlier change (September 10, 2026): Added Section 3.3 describing the new in-app help chat: what is sent to Anthropic's Claude API when you use it (your chat messages, the page you are on, and — if signed in — your plan tier, nothing else), that conversations are not stored on our servers, and that choosing Email support emails the conversation to us. Section 6.3 updated to match, and the former Section 3.3 (Service Improvement) is now 3.4. Nothing changed about what data we collect elsewhere, how it is processed, or your rights.

Earlier change (September 6, 2026): Section 6.2 now names the specific hosting location (Railway's US West region, California). Also added Section 6.6 describing what is (and is not) shared with Zoom when WeEngage is installed from the Zoom App Marketplace, and what happens when the app is removed. Also corrected the numbering of the Vercel section (now 6.5). Nothing changed about what data we collect, how it is processed, or your rights.

Earlier change (September 5, 2026): Accuracy update. Added Section 6.4 disclosing Stripe as the third-party processor for Pro subscription payments — this was already how billing worked, just not previously named here. Nothing changed about what data we collect, how it is processed, or your rights.

Earlier change (September 2, 2026): Accuracy update. If a free trial ends without ever converting to a paying Pro subscription, sessions from that trial are now retained for 7 days from the trial's end date instead of the previous 365-day window (Section 5.2) — this does not affect a genuine Pro subscriber who later cancels.

Earlier change (August 31, 2026): New feature. When you end a session, you now choose whether to save it or delete it immediately, instead of it being saved automatically (Section 5.1).

Earlier change (August 31, 2026): Accuracy corrections. Corrected the account-deletion process (Section 5.4) to describe the actual self-service flow, replaced outdated PDF-export and "coming soon" JSON-export language (Sections 3, 8.4) with what the app actually offers today, corrected the sign-in token's expiry from a 30-day inactivity window to a fixed 7 days (Section 9.1), and updated the recovery-code claims (Sections 2, 7.3) — codes are now stored as one-way hashes rather than the encrypted-but-in-practice-plaintext claim previously here. Removed a stray second line under the postal address in Section 15 that read as an unrelated second location.

Earlier change (August 30, 2026): Accuracy corrections. We clarified that WeEngage uses no cookies — a single sign-in token is kept in your browser's local storage to keep you logged in (Section 9). We removed an outdated statement that sessions auto-close after 2 hours of inactivity; a session now stays open until the facilitator ends it (Section 5.1). We also aligned plan names with the app ("Pro" rather than "Premium"). Nothing changed about what data we collect, how it is processed, who can access it, or your rights.

1. Introduction

WeEngage is a real-time group facilitation and insights tool designed to help facilitators gather participant responses, generate AI-powered insights, and keep a printable record of each session.

This Privacy Policy explains:

• What data we collect
• How we use it (including AI processing)
• Who has access to it
• How long we keep it
• Your rights and choices

Scope: This policy applies to all users of WeEngage, whether you're using the app as a facilitator (creating sessions) or as a participant (joining sessions). It covers all personal data we collect and process.

2. Data We Collect

2.1 Facilitator Data (Account Owners)

When you create a WeEngage account, we collect:

• Authentication data: Email address (primary and, optionally, a backup address for recovery) and your password, stored only as a one-way hash (see Section 2.5)
• Profile information: First name, last name, role and industry (each chosen from a fixed list), organization name, job title, location (country and state or province)
• Account use declaration: Whether the account is for personal use or on behalf of an organization (see Terms of Service, Section 4.5)
• Optional: Profile picture (base64 encoded, max 2MB)
• Account recovery: One-time recovery codes (10 codes; only a one-way cryptographic hash of each code is stored, never the code itself — shown to you once, at generation)
• Plan and billing status: Your plan, trial dates, subscription status, and, if you have subscribed, the identifiers Stripe assigns to your customer and subscription records (Section 6.4)
• Where you heard about us: Your answer to the optional "How did you hear about us?" question on the sign-up form (chosen from a fixed list), and, if the link you followed to reach WeEngage ended in a short tag such as ?src=linkedin, that tag. If you sign up while using WeEngage inside Microsoft Teams or Zoom, we record teams or zoom in the same way (Section 9.1). Both are used only to count which channels bring people to WeEngage
• Preferences: Whether you have opted out of product and marketing email (Section 3.5), and whether you have accepted the terms for insights across meetings

Why: To create and secure your account, help you recover access, and improve the service.

2.2 Session Data (Facilitator-Created)

When you create a session, we collect:

• Session metadata: Session name, session type (e.g., Strategy, Brainstorm), meeting context (facilitator-provided description)
• Session settings: Whether anonymity is enabled, participant access codes/tokens
• Timestamps: When the session was created, when it was closed

Why: To organize your sessions, control access, and apply retention rules based on session age and tier.

2.3 Participant Response Data

When participants join your session and submit responses, we collect:

• Response content: The text or data they submit to questions, or the fact that they declined to respond
• Display name: The name a participant chooses when joining (required). It is stored with every response, including anonymous ones. When a response is submitted anonymously, the name is hidden from everyone who reads it — the facilitator, other participants, the session record, the API, and Claude all see "Anonymous" — but it is not removed from our database; see Section 5.5 for how to have a response removed
• Response metadata: Whether the response was submitted anonymously, when it was created and last changed
• Session linkage: Which session and question the response belongs to
• Seat key: When a browser joins a session, WeEngage gives it a random key for that seat (that name in that session). The browser keeps the key so a refresh or a second tab lands on the same name; the session's participant list stores only a one-way hash of it, with when that device was added and last seen. A seat can hold up to two such keys (for example a laptop and a phone). The key is not tied to an account, a person, or a device fingerprint; it is good for that one session only, and clearing the browser's storage discards it. (Before October 7, 2026, the browser sent one identifier it reused across sessions; records from then are converted the first time that browser rejoins.)
• Rejoin link (optional): If a participant gives an email address on the join form, or asks for a link from the Switch devices panel, we send that address one email containing a rejoin link and do not store the address. The participant list stores a one-way hash of the link so it can be checked when opened; the facilitator can revoke it, and it stops working when the session ends. A QR code shown on the participant's screen works the same way, for two minutes and once.
• Roster email (locked sessions): When a facilitator locks a session and adds a person to it, the name and email address the facilitator typed are stored on the session's participant list, so the facilitator can resend that person's personal link. The address is used only to send the link, is shown only to the facilitator, and is deleted with the session (Section 5). The link itself is stored as a one-way hash, like a rejoin link.
• In-session chat: Messages sent during a live session, in the group channel or in private threads between participants and the facilitator, are not stored in our database. They exist only in the server's memory while the session runs. They are erased when the session ends, and they are lost if the server restarts. A participant or facilitator can download a chat transcript as a text file to their own device. That file is never stored by WeEngage.
• Feedback: If a participant fills in the short form offered when a session ends, we store the rating and comment with the session, without their name. If a participant rates a shared insight (helpful or not, with an optional comment), the rating is stored with the session together with their display name (Section 3.2)

Important: Participants do not need an account, and nothing links a participant in one session to a participant in another.

2.4 Brainstorm-Specific Data

For brainstorm questions, we additionally collect:

• Ideas: The text of ideas submitted, and who submitted each (hidden when anonymous)
• Groups, stacks, and themes: How the facilitator and participants sorted the ideas: named groups, stacks of duplicate ideas and any headline the facilitator gave a stack, and theme tags. These are made by people in the session, not by AI
• Insights: AI-generated themes, key insight, and follow-up questions derived from the ideas and how they were grouped (Section 3.2)

2.5 Login & Authentication Data

For account access, we collect:

• Password: Stored only as a one-way (bcrypt) hash; we cannot read it back. Password-reset links expire after 15 minutes
• Login and confirmation codes: 6-digit codes sent to your email, valid for 15 minutes and stored only as a hash. They confirm your address at sign-up and let you sign in without a password
• Session tokens: A signed token (JWT) kept in your browser to keep you logged in (Section 9.1)
• Access logs: Basic application logs (timestamps, error messages)

Third-party: Codes and password-reset links are sent via SendGrid, our email delivery partner. See Section 6.1.

2.6 Other Facilitator Content

Also stored with your sessions and account, and visible only to you unless this policy says otherwise:

• Notes: Your session note and question notes. They are never shown to participants and are not sent to Claude for the meeting digest, though the session note is available to Ask about your meetings (Section 3.2)
• Whiteboard drawings: Every board's drawing is saved automatically while a session runs, including any images pasted onto it. Boards you add to the session record are kept with it; the rest go when the session does
• Templates: Sessions you save as templates (questions, notes, and context, never responses) and their tags
• Clients and projects: The names you give them, and which sessions you file under each
• Organization membership: If you belong to an organization: the organization's name and logo, your role, which teams you are on, and, for the Team plan, seat and billing records (Section 6.4). Owners, admins, and team leaders can see who is in the organization and how much it is used; they cannot see your sessions' content (Section 4.1)
• API keys: If API access has been enabled for your account, the names of the keys you create and a one-way hash of each key (Section 4.5)

3. How We Use Your Data

3.1 Session Management & Facilitation

We use your data to:

• Store and retrieve sessions
• Show/hide responses based on your reveal settings
• Control participant access via session codes or tokens
• Print any session’s record, or save it as a PDF, from the session view in the app (open it from Previous Sessions and choose Print Session)

3.2 AI Insights (Claude API)

If you generate AI insights in a session:

We send to Claude (Anthropic's AI model):

• Participant responses (text only), and for brainstorm questions how the ideas were grouped, stacked, and themed
• Question text (for insights across the whole session and for the meeting digest; insights on a single open-ended, brainstorm, or Start/Stop/Continue question send the responses without the question)
• Session type and context (e.g., "Strategy session")
• Participant names only if responses were not submitted anonymously, and only for open-ended and laddering questions; brainstorm and Start/Stop/Continue insights never include names
• Declined responses are never sent

We do NOT send:

• Facilitator account details or recovery codes
• Participant IP addresses or session access logs
• Your profile picture or personal metadata

What Claude does:

• Processes the data to generate three themes, a key insight, and three follow-up questions (and, when you share an insight with the group, a separate participant-facing version)
• Returns the insights to us
• Does not train Claude models on your data (per Anthropic's standard API terms)

Important: Claude may briefly retain data for abuse detection/safety monitoring per Anthropic's privacy practices. See Section 6.3.

Insight ratings: Each insight asks “Were these insights helpful?” with Yes / No buttons and an optional comment. If you use it, the rating is stored with the session so we can see where the insights fall short. Participants can rate an insight you shared with them; their rating is stored with their display name. Ratings are deleted with the session.

Meeting digest (Pro plans): When a facilitator on a Pro plan ends a session with Save & End Session, WeEngage sends that session's record to Claude once, to write a meeting digest. The digest is a short, structured summary of what the meeting surfaced: a list of general points (such as where work gets stuck, how people describe working together, and what would help them), plus decisions, commitments, open issues, and requests. It is used to find patterns across meetings: in the facilitator's own view, and in organization and team insights when the meeting belongs to an organization.

• Names are removed first. Every response is sent as "Participant", and the names of participants and the facilitator are removed from the text before anything is sent. This happens whether or not responses were anonymous.
• What is sent: response text, question text and results (such as poll counts), the words written on whiteboard boards saved to the record, and the session type and context. Declined responses and chat are never sent.
• Personal details are left out. The digest is written to leave out personal-life details and anything that could identify a person, and it never quotes anyone.
• Lenses: a digest can be read through a lens (Organizational health, Coaching, or Project management), which groups its points under headings such as Culture, Aims, or Risks and blockers. The grouping is made by a second, smaller call to Claude that sees only the digest's own name-free points, never the session record, the first time each lens is used, and is stored with the digest.
• The facilitator can read it on the session's record but cannot edit it.
• Confidential meetings: in an organization, the facilitator can mark a meeting Confidential before it starts. Confidential meetings are only seen by the facilitator. Their digests are left out of team and organization views and of any client report the facilitator creates. Participants see whether a meeting is Confidential when they join.
• It is deleted with the session: by End Without Saving, by deleting the session, or when the session's retention window ends (Section 5.2).

Adding a transcript (Pro plans): A facilitator can add one transcript from their own notetaker (for example Zoom, Teams or Otter) to a saved session. WeEngage does not record or transcribe meetings; the facilitator provides the file. WeEngage then rewrites that session's meeting digest once, from the session's record and the transcript together, so decisions and commitments made out loud are part of it.

• Names we can identify are removed first. Everyone who spoke, everyone who joined the session, and the facilitator are replaced with a placeholder before anything is sent to Claude, and each speaker is given a number instead of a name. Email addresses, phone numbers and web links are removed by pattern.
• What may remain. The names of people who were only mentioned and never spoke, and other personal details inside what was said, can remain in the text Claude reads. The digest itself is written without names and never quotes anyone (see "Personal details are left out" above).
• The transcript is not stored. It is read once for the rewrite and discarded. We keep only its file name and the date it was added, so the session's record can say its digest includes a transcript.
• The facilitator can remove it. Removing the transcript rewrites the digest from the session's record alone. Adding another transcript replaces the first.
• Shared and Confidential meetings work as above: a Confidential meeting's digest stays with the facilitator and is left out of client reports; a Shared meeting's updated digest reaches team and organization views.
• Deleted with the session, like the digest (Sections 5.2 and 5.3).

Client, project, team, department and organization reports (Pro and Team plans): From a client's or a project's insights, a facilitator can create a report to share, for example with that client. From team, department or organization insights, the people who can see those insights (owners, admins, a team's leaders for that team, a department's leaders for that department) can create a team, department or organization report; those reports never include quotes, only themes and counts. A department report can say how many of its teams a theme came from (a count, never a team's name, once two or more of its teams held a meeting in the period). An organization-wide report names the departments a theme came from once two or more departments held a meeting in the period, and otherwise counts teams (once three or more held a meeting), never naming one. It is made when the facilitator asks, shown on screen, and printed or saved as a PDF by the facilitator's own browser. WeEngage saves the latest report for each client or project view and lens, so the facilitator can come back to it, and building it again replaces it. A report also records which meetings it covered, so WeEngage can tell the facilitator whether it is still up to date, and open an existing report instead of building a second one over the same meetings. Only that facilitator can see it. What is saved is the themes, the per-meeting counts, which themes the facilitator chose to hide, the facilitator's own wording for the report's summary if they changed it, and which responses were chosen as quotes, as references: the quote text is not copied. It is read from the response each time the report opens, so a quote disappears from the report when its session is deleted or leaves its retention window, and is dropped if the response is no longer eligible. A copy the facilitator prints or saves is theirs.

• Meetings marked Confidential are left out. Neither their digests nor their responses are used, whatever view the report is made from.
• Themes. WeEngage sends Claude the name-free digests of the client's or project's meetings (the same digests described above, and their lens groupings) and Claude writes the report's themes from them. This is the same as generating client or project insights, except that the report always leaves out Confidential meetings.
• Quotes. A report can include quotes from participants' own typed responses (open-ended, brainstorm, and Start/Stop/Continue questions). To choose which, WeEngage sends Claude the report's theme titles and a numbered list of response text from the same meetings. No names, participant IDs, or other details about who wrote a response are sent. Declined responses and chat are never sent. Claude returns only the numbers of the responses it picks.
• Quotes are never rewritten. WeEngage copies each chosen response word for word from the session record. Claude does not write, shorten, or reword them.
• Participants are told. The Session Privacy Notice every participant accepts when joining says that the facilitator may quote responses, word for word and without names, in a report for a client.
• The facilitator decides. The facilitator sees every suggested quote, and can remove it, swap it for another, or leave quotes out of the report altogether, before printing. They can also hide themes and edit the report's one-sentence summary.
• Quotes carry no names. Whether or not a response was submitted anonymously, the report never shows who wrote it. A response may still contain names or details that a participant typed into it, which is why the facilitator reviews each one.
• This is separate from the meeting digest. The meeting digest still never quotes anyone. A client report is the only place a response is quoted, and only the ones the facilitator keeps.
• Counts for the charts. The report also shows, for each meeting, how many people joined and how many took part. These are counts only, with no names.

Ask about your meetings (Pro plans): A facilitator can ask questions about the sessions saved to their own record in a private chat.

• What is sent: the facilitator's questions and the chat's earlier replies; for each session being asked about, its name, date, type, client and project names, and its digest; and, when needed, a session's full record (responses with participant names for open-ended and laddering questions, except that anonymous responses stay "Anonymous"; results; saved whiteboard text; the session's context and the facilitator's session note). Only the facilitator's own saved sessions can be reached.
• Attached files: the facilitator can attach up to five files of their own, such as a transcript from their notetaker (for example Zoom, Teams or Otter), an agenda, notes or slides. WeEngage does not record or transcribe meetings; the facilitator provides the files. They are sent to Claude with each question in that chat, as provided, including any names in them.
• Saved chats: the facilitator's questions and the chat's answers are stored on our servers so the facilitator can come back to a chat. Only that facilitator can see them. When a session is deleted, by the facilitator or at the end of its retention window, chats about that session are deleted too. Chats about several sessions (a client, a project, or all of the facilitator's sessions) may still mention it until they are deleted. Any chat is deleted when the facilitator deletes it, when they delete their account, or 365 days after its last question.
• Attached files are never stored. They are held in the facilitator's browser while attached and sent with each question; only their file names are kept with the saved chat. An attached file is never added to the session record, the meeting digest, or any organization, team, client or project insights. Adding a transcript to a session's record is a separate action, described under Adding a transcript above.

Your control:

• Per-question and conversation insights are generated only when the facilitator asks for them
• The meeting digest is written only for sessions ended with Save & End Session on a Pro plan; End Without Saving sends nothing to Claude and keeps nothing
• A transcript is sent only when the facilitator adds one to a session, and only once
• A report is created only when the facilitator asks, and uses no Confidential meeting; the facilitator can build it again to replace the saved one, and it is deleted with its client, project, team, department or organization. Team, department and organization reports contain no quotes
• AI features are available only on Pro plans; on the Free plan, no session data is sent to Claude
• If you leave the meeting context blank, minimal context is sent

3.3 Help Chat (Support Assistant, Claude API)

The Help button on our public pages, the sign-in screen, and the dashboard opens an automated assistant that answers questions from the published User Guide.

If you use the help chat, we send to Claude (Anthropic's AI model):

• The messages you type into the chat, and the assistant's earlier replies in that conversation
• Which page you are on (e.g. "pricing")
• If you are signed in, your plan tier only (Free, Trial, Pro, Team, or complimentary)

We do NOT send:

• Your name, email address, or any other account detail
• Any session, response, participant, or billing data
• Anything at all if you never open the chat

The assistant has no access to our database or to any account. It cannot look up, change, or delete anything; it can only write a reply.

Storage: We do not store help-chat conversations on our servers. The conversation is kept in your browser tab only and is gone when the tab closes. We keep short-lived, per-visitor counters (by account, or by IP address if you are not signed in) purely to limit misuse; they contain no message text and expire within a day. If you choose Email support inside the chat, the conversation, any note you add, and the email address and name you give (or your account email and name, if signed in) are emailed to our support inbox so a person can reply, and a copy is sent to you — that email is retained like any other support correspondence.

Ratings: Each reply has a “Helpful?” Yes / No control. If you use it, we store that one exchange — the question you asked, the reply you rated, your rating, any comment you add, the page you were on, and, if you are signed in, your account identifier and plan tier — so we can review and correct wrong answers. Nothing else from the conversation is stored, and nothing is stored if you never rate a reply. Your IP address is not stored with a rating (a one-way hash of the visitor counter key is kept only so that changing your rating updates the same record). Ratings are retained until we delete them and are covered by the account-deletion and erasure rights in Sections 5.4 and 8.3 when tied to an account.

Model training: As with AI insights, your messages are not used to train Claude models (per Anthropic's standard API terms). See Section 6.3.

3.4 Service Improvement

We may use aggregated, anonymized data to:

• Understand how the app is used
• Identify bugs or performance issues
• Improve features

We do not: Profile individuals, make automated decisions about users, or use data for purposes other than operating WeEngage.

3.5 Email We Send You

We use your email address to send:

• Account and service email: sign-in and confirmation codes, password resets, a welcome message, notices when your trial ends or your plan changes, billing confirmations and receipts, a notice a few days before a session is removed, a notice when a scheduled session was never started, organization invitations and hand-off notices, and replies to support requests. These are part of operating your account and cannot be switched off while you have one.
• Product and marketing email: a short series during and after your trial, and occasional messages about new features and how to get more from WeEngage. Every one of these has an unsubscribe link that works with one click and no sign-in. Opting out is recorded on your account and stops all product and marketing email; it does not stop the account and service email above. Members covered by an organization's Team plan are not sent trial or upgrade email.
• Waitlist email: if you joined the waitlist before launch, updates about launch, with the same one-click unsubscribe.

All email is sent through SendGrid (Section 6.1). We do not sell or share your address with anyone else.

4. Who Has Access to Your Data

4.1 You (Facilitator)

• Full access to your account, sessions, and all responses
• Can print or save session records and share them with others (your responsibility)
• Can view AI insights and their session's own response statistics (e.g. how many participants answered each question)

4.2 Session Participants

• See only responses that you (the facilitator) have revealed
• Cannot see unrevealed responses
• Do not have persistent access (no account means no login)

4.3 Third-Party Service Providers

See Section 6: Third-Party Processors.

4.4 We Do NOT Share or Sell Data

• We do not sell, license, or share your data with third parties for marketing, profiling, or research
• We do not use participant responses for any purpose other than the session context
• We do not disclose data to competitors, advertisers, or data brokers

4.5 API Access (Enterprise Accounts)

We can enable a key-based API for an account on request (it is switched on per account, not by plan). A facilitator with API access creates keys from API access in their Profile; each key is shown once and stored only as a one-way hash, and it can read and run only that facilitator's own sessions. Through the API another system can read a session's questions, responses (with participant display names, except that anonymous responses are returned without a name), results, AI insights, meeting context and facilitator notes, and can create, run, and end sessions. It never returns chat, participants' browser identifiers, declined responses (only their count), deleted sessions, or join links. The facilitator is responsible for the systems they connect and for the copies of session data those systems keep. See the API guide.

5. Data Retention & Deletion

5.1 Active Sessions

Sessions remain in our system and visible to you while status = active. A session stays active until you (the facilitator) end it — it does not close automatically after a period of inactivity. As a housekeeping measure, a session that has been completely untouched for 30 days is closed by an automated cleanup.

When you end a session, you choose what happens to it: Save & End Session keeps its responses and insights under the retention window in Section 5.2 below, or End Without Saving deletes them immediately — the same effect as the manual deletion described in Section 5.3, just applied the moment the session ends rather than afterward from "Previous Sessions." In-session chat is erased when the session ends, whichever option you choose. It is never kept under the retention window, because it isn't stored (Section 2.3).

5.2 Closed Sessions (Retention Windows)

Free Plan:

• Sessions visible in "Previous Sessions" for 7 days after closure
• After 7 days: soft-deleted (hidden from your view)
• Remain in database for 90 days (audit trail)
• Hard-deleted (permanently removed) after 90 days

Pro Plan:

• Sessions visible in "Previous Sessions" for 365 days after closure
• After 365 days: soft-deleted
• Remain in database for 90 days
• Hard-deleted after 90 days

What goes with a session at the end of its window: its meeting digest is removed right away, along with the name and date of any transcript added to it and saved Ask about your meetings chats about that session (Section 3.2). Its responses also stop appearing as quotes in saved client reports. A saved client report is deleted with its client, or with the account of the person who built it.

Free trial that ends without upgrading: The 365-day window above applies to sessions created while you were on an active trial. But if your trial ends and you never become a paying Pro subscriber, that window is shortened: sessions from that trial are instead retained for 7 days from the date your trial ends, not the original 365. This does not apply if you have ever actually paid for Pro — if you upgrade and later cancel, sessions you created while on Pro keep the full 365-day window above. If this shortened window applies to your account, you will see a notice in the app showing how many days remain, and a note in your trial-ended email.

5.3 Manual Deletion

You can manually delete sessions anytime from "Previous Sessions":

• Sets deleted_at = now (soft-delete, hidden from your view)
• Its meeting digest is removed right away, along with the name and date of any transcript added to it and your saved Ask about your meetings chats about that session (Section 3.2); its responses also stop appearing as quotes in saved client reports
• 90-day audit period applies
• After 90 days: permanent hard-delete

Important: Deleted sessions cannot be recovered after 90 days. A session within three days of the end of its retention window is listed under Being removed within 3 days on your dashboard, and we email you once, about three days before it goes.

5.4 Account Deletion

You can delete your own account anytime, self-service, from Edit Profile in your profile — no need to contact us. You confirm by typing "delete". Upon deletion:

• Your account is marked deleted at once: you can no longer sign in, your API keys stop working, and your saved Ask about your meetings chats are deleted immediately
• Your account data (name, email, profile, templates, clients and projects, saved client reports, API keys) is permanently removed 90 days later, by the same daily cleanup that hard-deletes sessions
• If you are in an organization, sessions you ran for it pass to the organization's longest-standing owner (or an admin, if there is no other owner), so the organization keeps its own meetings
• Your other sessions remain in the system but are detached from any account: nobody can see them or open them as facilitator, and they are removed under the normal retention windows in Section 5.2
• If you pay for Pro yourself, deleting your account cancels the subscription at Stripe immediately, so your card is not charged again. Stripe keeps its own record of your past payments under its privacy policy (Section 6.4)
• If your card pays for an organization's Team plan, the app asks you to cancel that plan before the account can be deleted

5.5 Participant Data Deletion

Participants have no persistent accounts and no direct way to request deletion. However:

• Individual responses can't be deleted in the app, by the facilitator or the participant. A participant can change their own response, or switch it to a decline, until the facilitator closes that question; after that it is locked.
• You (the facilitator) can delete entire sessions, which removes all associated responses
• Sessions run by an individual facilitator: participants can contact us to request deletion of their responses, and we will work with the facilitator to respond as applicable law requires.
• Sessions run for an organization (for example, an employer on the Team plan): the organization decides how its meeting records are kept and deleted, and WeEngage handles that data on its behalf. A participant who wants their responses removed should contact the organization first, or contact us and we will pass the request on. We will work with the organization to respond in line with its policies and applicable law. This means a response may not be removed right away, and in some cases the law or the organization's legitimate needs may allow it to be kept.
• Meeting digests are written with names removed and without quoting anyone, so they are not meant to be traceable to an individual participant. A client report may quote responses a facilitator chooses to include; those quotes carry no name, but a quote's own wording can still point to a person, which is why the facilitator reviews each one.

6. Third-Party Data Processors

6.1 SendGrid (Email Delivery)

Data shared: Your email address and name, and the content of each email we send you (Section 3.5) — sign-in codes, account and billing notices, product and marketing email, and support replies
Purpose: Deliver every email WeEngage sends
Retention: Per SendGrid's privacy policy. SendGrid may record whether an email was delivered and whether a link in it was clicked; we use this only to check that email is arriving
Your control: You must provide an email to use WeEngage. Product and marketing email has a one-click unsubscribe (Section 3.5)

SendGrid Privacy Policy

6.2 Railway (Backend Infrastructure & Data Storage)

Data shared: All session data, responses, user accounts, AI insights
Purpose: Store and retrieve all WeEngage data
Retention: Indefinite (unless you delete)
Security: Railway provides encrypted data at rest and in transit; see their security docs
Compliance: Railway has a Data Processing Addendum (DPA) with EU Standard Contractual Clauses (SCCs) for GDPR compliance

Railway DPA
Railway Compliance Documentation

Where your data lives: WeEngage's database and API run in Railway's US West region (California, USA). For users in the EU, EEA, and UK this is a transfer outside the EU, protected by Standard Contractual Clauses as part of Railway's DPA.

6.3 Anthropic (Claude AI API)

Data shared: Response text, question text, session context and saved whiteboard text (when you generate AI insights, and once per session for the meeting digest on Save & End Session, with names removed; Section 3.2); the name-free digests of a client's meetings, and the text of individual responses (without names or any author details), when a Pro facilitator creates a client report, with Confidential meetings left out (Section 3.2); a meeting transcript a Pro facilitator adds to a session, with the names we can identify removed, once, for the digest rewrite (Section 3.2); a Pro facilitator's questions, their own session records and digests, and any files they attach, when they use Ask about your meetings (Section 3.2); help-chat messages, the current page, and your plan tier (if you use the help chat — Section 3.3)
Purpose: Generate AI insights (themes, tensions, follow-up questions) and meeting digests; answer a facilitator's questions about their own meetings; answer help-chat questions from the User Guide
Retention: Per Anthropic's standard API data retention policy (brief retention for abuse detection, not model training)
Model training: Your data is not used to train Claude models by default
Your control: Insights are generated only when you ask; the meeting digest only on Save & End Session (Pro); a client report only when you create one, and never from a Confidential meeting. End Without Saving sends nothing, and on the Free plan no session data is sent. The help chat only sends what you type into it; if you never open it, nothing is sent

Important: We strongly recommend reviewing Anthropic's Privacy Policy and Commercial Terms directly, as their practices and policies may change.

6.4 Stripe (Payment Processing)

Data shared: Email, name, and an internal account identifier — only when you start a Pro subscription; Free-plan users are never sent to Stripe. For an organization's Team plan: the organization's name, the paying owner's email, and an internal organization identifier
Purpose: Process your Pro subscription payment and manage billing (invoices, cancellations, payment method updates)
Retention: Per Stripe's privacy policy
Your control: Your card details are entered directly on Stripe's own hosted checkout page — WeEngage's servers never see or store your card number

Stripe Privacy Policy

Anthropic Privacy Policy
Anthropic Commercial Terms

6.5 Vercel (Frontend Hosting)

Data shared: Nothing beyond an ordinary web request: Vercel serves the app's pages and files to your browser and, like any web host, keeps standard access logs (IP address, page requested, time)
Purpose: Host and deliver the WeEngage interface
Retention: Access logs per Vercel's privacy policy
Security: The app itself talks to our API on Railway directly, so your session data and sign-in token do not pass through Vercel. Two exceptions are relayed through Vercel without being stored there: calls to the public API at weengage.app/api/v1 (Section 4.5) and the Zoom installation handshake (Section 6.6)

6.6 Zoom (Zoom App Marketplace)

This section applies only if you add WeEngage to Zoom from the Zoom App Marketplace. Using WeEngage in a browser, or in Microsoft Teams, involves no data exchange with Zoom, apart from the daily license check described below for people who hold a license bought through Zoom.

Data shared with us by Zoom:

• When you add the app: a one-time authorization code so the installation can complete and WeEngage can open inside your Zoom client, and with it a pair of access tokens limited to the one permission WeEngage asks for: seeing whether you hold a WeEngage license bought through Zoom.
• When you open WeEngage inside Zoom while signed in: your Zoom user ID, in an encrypted form only our server can read. We link it to your WeEngage account so that a Pro license assigned to you in Zoom reaches the right account.
• License information: whether you hold a paid WeEngage license, the plan's name, and Zoom's identifiers for the plan and the license. Zoom may also notify us when a license is assigned or removed.
• When you remove the app: a removal notification containing your Zoom user ID and account ID.

WeEngage requests no access to your Zoom meetings, participants, contacts, recordings, chat, or any other Zoom data. If you buy Pro on the Zoom App Marketplace, Zoom takes the payment: we never receive your card details, price paid, or order details.

What we store: Your Zoom user ID, linked to your WeEngage account; the license information above; and one of the tokens (the refresh token), encrypted, which we use only to ask Zoom whether you still hold a license — when you open the app and once a day while you hold one. Your Zoom account ID, email address, and name are not stored. If the license permission has not been granted to the app, none of this is stored.
Purpose: Complete the installation and open WeEngage in the Zoom apps panel; give your WeEngage account the Pro you or your organization bought through Zoom, and end it when the license ends; acknowledge removal
Retention: The authorization code is used once and never stored. During installation only, one cookie (weengage_zoom_state) is set for 10 minutes to protect the handshake against forgery; it holds a random value, is sent only to the Zoom installation endpoint, and expires on its own. When you remove the app, the stored token is deleted at once, and so are your Zoom user ID and license record — unless you hold a paid license at that moment, in which case the link between your Zoom user ID and your WeEngage account is kept so the Pro being paid for keeps working, and is deleted when that license ends. A token belonging to someone who added the app but never signed in to WeEngage is deleted after 7 days. Deleting your WeEngage account deletes all of it immediately. Any other Zoom-related data is deleted within 10 days of Zoom notifying us of removal, in line with Zoom's marketplace requirements
Your control: Remove WeEngage at any time from the Zoom App Marketplace under Manage › Added Apps. Removing the Zoom app does not delete your WeEngage account or sessions, and does not cancel a subscription bought through Zoom; see Section 5 for account deletion

Zoom Privacy Statement

7. Data Protection & Security

7.1 In Transit

• All data transmitted between your browser and our servers is encrypted via HTTPS
• Session access is protected by cryptographic tokens (not just simple codes)

7.2 At Rest

• Data is stored in a PostgreSQL database on Railway
• Railway provides encryption at rest (AES-256)
• Database access is restricted to application code

7.3 Access Controls

• In the app, session data is reachable only through your own signed-in session, a participant's join link or code, or an API key you created
• As the operator of the service we have direct access to our database for maintenance, migrations, and support. We look at the content of a session only to fix a problem you have reported to us, or where the law requires it; the metrics we review for running the business are counts and aggregates, never responses
• Passwords and recovery codes are stored as one-way hashes, not the values themselves; a recovery code cannot be used to access your account without your email

7.4 What We Don't Do (Yet)

• We do not offer end-to-end encryption (session data is visible to facilitators, and to Claude when AI insights or the meeting digest are generated)
• We do not currently perform penetration testing or formal security audits
• We do not use hardware security modules (HSMs) for key management

8. Your Rights & Choices (GDPR, CCPA, PIPEDA)

8.1 Right to Access (DSAR - Data Subject Access Request)

You can request all personal data we hold about you.

How: Email us at support@weengage.app with "Data Access Request" in the subject line.

Timeline: We will respond within 30 days.

What you'll get:

• A summary of personal data (emails, names, profile info, etc.)
• A list of sessions you created
• Options to export or review your data

8.2 Right to Rectification

You can correct or update your personal data.

• Edit your profile via "Edit Profile" in Settings
• Change your own response until the facilitator closes that question
• Contact us to correct data we hold (e.g., correct your email if misspelled)

8.3 Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data.

• Individual responses can't be deleted in the app; participants can ask us to remove theirs (see Section 5.5), which we handle by hand
• Delete entire sessions (soft-delete, then hard-delete after 90 days)
• Delete your account yourself from your profile settings (see Section 5.4)

Limitation: We retain soft-deleted data for 90 days for compliance audits. After 90 days, data is permanently deleted.

8.4 Right to Data Portability

You can get your data in a portable format.

• Print or save as PDF any individual session anytime, directly in the app (open it from Previous Sessions and choose Print Session)
• Request a full export of your account and all its sessions bundled together (contact us — this isn't yet self-service)
• Data will be provided in a structured, machine-readable format

8.5 Right to Restrict Processing

You can limit how we use your data.

• Don't generate AI insights, or end a session with End Without Saving (no meeting digest is written and nothing is kept)
• Request we not use your data for service improvement

How: Contact us with specific restrictions.

8.6 Right to Object

You can object to certain processing.

• Object to AI processing. There is no account-level switch for this. A facilitator avoids it by not generating insights and by ending sessions with End Without Saving (Section 3.2). A participant who objects should say so to the facilitator before responding, or decline to respond; once a response is in a saved session, contact us and we will handle removal by hand (Section 5.5)
• Object to automated decision-making (we don't do this)
• Object to profiling (we don't do this)

How: Contact us; we'll accommodate within 30 days.

8.7 Right to Withdraw Consent

You can withdraw consent to data processing.

• Withdraw consent to use your email for sign-in and account email (you can no longer access your account; delete it instead, Section 5.4)
• Withdraw consent to product and marketing email at any time with the unsubscribe link (Section 3.5)
• Withdraw consent to AI processing for future sessions by not generating insights and using End Without Saving; there is no account-level switch (Section 8.6)

Limitation: You cannot withdraw consent for responses already submitted to a session. Once a response is submitted and insights are generated, that processing cannot be reversed. However, you can ask us to remove the response by hand (Section 5.5), and the facilitator can regenerate the insights without it.

9. Cookies & Tracking

9.1 What We Keep in Your Browser (Almost No Cookies)

WeEngage sets no cookies in ordinary use. The one exception is a cookie set for 10 minutes while you install the app from the Zoom App Marketplace, to protect that handshake (Section 6.6); it expires on its own.

Instead, the app keeps a few things in your browser's own storage. All of it is first-party (never sent to anyone but WeEngage) and used only to make the app work:

Kept until you log out or clear it (local storage):

• Sign-in token: An authentication token (a JWT) that confirms your identity so you don't have to log in on every page. It expires 7 days from sign-in, regardless of activity; after that you log in again
• A copy of your profile: Your name, email, role, and the other profile fields, including your picture, so the app can show them without a round trip. It is refreshed when you sign in or edit your profile and removed when you log out
• Display preferences: Your light/dark theme choice, which template sections you have opened, and which notes you have collapsed
• Participant identifier: The random browser identifier described in Section 2.3, created the first time this browser joins a session

Kept only until the tab closes (session storage):

• For participants: your display name for the session you are in and the fact that you accepted the session privacy notice, so a page refresh puts you back in the session
• The help-chat conversation (Section 3.3), which question or board you were looking at, and, while you accept an organization invitation, the invitation details
• If you arrived by a link that ended in a short tag such as ?src=linkedin, or if WeEngage is open inside Microsoft Teams or Zoom, a short tag (that link tag, or teams or zoom), so it can be sent with the sign-up form if you create an account (Section 2.1). It stays in the tab, is sent nowhere else, and is gone when the tab closes

Apart from that link tag, which is used only to count which channels bring people to WeEngage, we store nothing in your browser for analytics, advertising, or tracking.

9.2 No Analytics, Advertising, or Third-Party Tracking

• We do not use any website analytics service (Google Analytics, Plausible, Mixpanel, or similar)
• We do not use tracking pixels, advertising cookies, or browser fingerprinting
• We do not allow third parties to track you on WeEngage
• Because we set no non-essential cookies, and the only optional item we keep in your browser is the short-lived link tag described in Section 9.1 (held in the tab, used only to count where sign-ups come from), WeEngage does not display a cookie-consent banner
• Our email provider may record whether a link in an email we sent you was clicked (Section 6.1); no such tracking exists on the site itself
• We count how many times a Sign up button is clicked. Each count records which button it was, whether WeEngage was open in a browser, Zoom, or Microsoft Teams, and the date. We do not record who clicked: no name, email, account, IP address, or device is stored with it

Our hosting providers keep standard server access logs for security and reliability, as any website host does; we do not use these for analytics or profiling.

9.3 Your Choice

You can clear WeEngage's storage from your browser settings at any time. Doing so logs you out, resets your display preferences, and discards the participant identifier — it has no other effect, and nothing on our servers changes.

10. Sensitive Data & Responsible Use

10.1 Types of Sensitive Data Often Discussed

Participants and facilitators may share sensitive information in sessions, including:

• Organizational change (layoffs, restructures)
• Performance feedback or personal criticism
• Health, wellness, or personal struggles
• Conflict or interpersonal issues
• Strategic decisions or competitive information
• User research or customer feedback

10.2 Our Protections

• Anonymity option: On the question types that show names (open-ended, poll, brainstorm, Start/Stop/Continue, laddering), the facilitator can allow anonymous responses; the option is on by default when a question is created. The other types never show who answered what
• Visibility controls: Responses are hidden until you reveal them
• No email broadcasts: Responses are not automatically emailed to others
• Private sessions: Only participants with the session code/token can join
• No public listing: Sessions are never listed publicly
• Encryption in transit: All data is encrypted when transmitted

10.3 Facilitator Responsibilities

As a facilitator, you should:

• Inform participants that responses may be AI-processed (via the session entry banner)
• Enable anonymity for sensitive topics
• Be transparent about session context and data retention
• Only use data for the stated purpose (e.g., don't use strategy session responses for performance reviews without telling people)
• Protect any session record you print or save — treat the copy as carefully as the original
• Consider participant consent if you plan to share session data outside the facilitation group

Important: WeEngage provides the tools for privacy, but you as the facilitator are responsible for using them ethically.

11. Incident Response & Breach Notification

11.1 If We Detect a Data Breach

We will:

1. Investigate immediately to determine scope and impact
2. Notify affected users without undue delay (GDPR: within 72 hours; US states: within 30 days)
3. Notify regulators if required by law
4. Provide guidance on steps you can take to protect your data

11.2 What We'll Tell You

• What data was accessed or compromised
• When the breach occurred
• What we're doing to prevent future breaches
• Contact information for questions

11.3 What We're Monitoring

• Application error logs and alerts
• Unauthorized access attempts
• Database anomalies

11.4 What We're Not (Yet) Doing

• Formal penetration testing
• Real-time Security Information Event Management (SIEM)

12. Children & Minors

WeEngage is not intended for children under 13. We do not knowingly collect data from children under 13.

If you are between 13 and 18, you may use WeEngage with parental consent. Parents can contact us to exercise rights on behalf of minors.

13. International Users & Data Transfers

13.1 GDPR (European Union, UK, EEA)

If you are located in the EU, UK, or EEA:

• You have the rights outlined in Section 8 above
• Your data may be transferred to the US (Railway) via Standard Contractual Clauses
• You can file a complaint with your local Data Protection Authority

13.2 CCPA (California)

If you are a California resident:

• You have rights to access, delete, and opt-out (see Section 8)
• We do not sell your personal information
• You can contact us to exercise your rights

13.3 PIPEDA (Canada)

If you are a Canadian resident:

• You have rights to access and correct your information
• You can request deletion (subject to legal holds)
• You can contact us to exercise your rights

13.4 Other Jurisdictions

If you are located in another country with data protection laws, we will make reasonable efforts to comply. Contact us to discuss.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our service (e.g., new features, new processors)
• Changes to third-party practices (e.g., Anthropic's API terms)
• Legal or regulatory requirements

How you'll know: When we change this policy, we update the Last Updated date and describe the change at the top of this page, where every earlier change is also listed. Continuing to use WeEngage after a change means you accept the updated policy. If you disagree, you can delete your account (Section 5.4).

15. Contact Us

Questions about this Privacy Policy?

Email: support@weengage.app
Postal Address:
InsightEQ Solutions LLC
980 Broadway #137, Thornwood, NY 10594

Data Protection Officer: We have not appointed one; direct all privacy inquiries to the contact above.

Response time: We aim to respond to privacy inquiries within 10 business days.

16. Legal Basis for Processing (GDPR)

We process your data based on:

End of Privacy Policy

Document Version: 1.6
Date: September 26, 2026