Privacy Policy: How Wemify Protects Data

1. Who is responsible for your data

Wemify is currently operated by the team behind the Wemify product during its early development and beta phase. Wemify does not yet have a registered legal entity, organisation number, business address, or VAT number, and it does not issue invoices. For privacy-related questions or requests about your personal data, contact us at privacy@wemify.com or support@wemify.com.

If you use Wemify as part of a team, your workspace owner controls the workspace content. For that content we act as a processor on their behalf.

Once Wemify becomes a registered company and begins full commercial operations, this section will be updated with the correct legal entity name, organisation number, business address, and any other required details.

2. What we collect and why

Data	Purpose	Legal basis	Retention
Account: email, name if provided, password hash or Google sign-in profile	Create and secure your account, sign you in, contact you about your account	Contract	While the account exists, then deleted
Workspace: workspace name, members, roles, invites	Run the workspace and team collaboration	Contract	While the workspace exists
Business and onboarding answers: industry, audience, goals, tone of voice, brand profile	Personalize the product and AI assistance	Contract	Until you change or delete it, or the account is deleted
Content: drafts, captions, briefs, campaigns, marketing plans, prepared work, comments, approvals, chat messages	Provide the content workflow you signed up for	Contract	Until you delete it, or the account is deleted
Media: images and files you upload, plus file metadata	Attach media to posts and publish it	Contract	Until you delete it, or the account is deleted
Connected social accounts: provider account and page identifiers, display names and avatars, publish results, post and follower statistics. OAuth access tokens are held by our publishing provider, not stored by Wemify	Publish or schedule on your behalf and show performance	Contract	Until you disconnect the account or delete the account
Billing: customer and subscription identifiers, plan, status, credit ledger	Run subscriptions, credits and add-ons	Contract, plus legal obligation for accounting records	Accounting records kept as required by law, typically 7 years
Support: your messages, the email we reply to, context you provide	Answer your questions	Contract and legitimate interest	While your account exists, deleted with the account; older conversations reviewed periodically
Email delivery: recipient address, send, bounce and complaint events	Deliver account emails and keep our sending reputation healthy	Contract and legitimate interest	No longer than needed for delivery troubleshooting; suppression entries kept longer to avoid re-sending
Marketing contact: email, first name, signup date and method, plan, verification status, activation stage, marketing consent	Send product tips, updates and offers if you opt in, and lifecycle emails about getting started	Consent for marketing emails; legitimate interest for product lifecycle emails	While your account exists; the contact is removed when you delete your account
Security and anti-abuse: basic request logs, error events, signup bot-protection checks	Keep the service available and prevent abuse	Legitimate interest	Short-lived, according to our hosting and bot-protection providers' log retention
SEO lookups: the keywords, topics and domains you enter in the SEO features	Return keyword ideas and search result data from our SEO data provider	Contract	Saved with your workspace until you delete it, or the account is deleted
Product analytics: pageviews, automatically captured clicks and page interactions, page performance data, device and browser metadata, truncated IP handled by our analytics provider	Understand which features are used so we can improve them	Your consent	As configured with our analytics provider, reviewed periodically
Marketing measurement: Meta Pixel page views	Measure the effectiveness of our own marketing	Your consent	Controlled by Meta, see their policy

Analytics and marketing only run if you allow them in the cookie banner. See the Cookie Policy. Our own team is excluded from analytics: if your email address ends in wemify.com, capturing is switched off in your browser. That check happens locally and your email is never sent to the analytics provider.

3. What we do not collect

Wemify is not designed to collect any of the following:

Payment card numbers. Card data goes directly to our payment processor.
Government identification numbers or home addresses.
Health data, religious or political views, or criminal history.
Email inbox contents, call recordings, or scraped social profiles.

Please avoid entering sensitive personal data into drafts, comments, notes or AI prompts. Wemify is built for marketing planning and content workflows.

4. AI features

Several features use AI. When you use them, selected workspace context is sent to our AI provider so it can produce the result you asked for. This can include draft text, briefs, campaign and plan context, your brand and onboarding answers, aggregated performance data, and images when you ask Wemify to write a caption from an image.

The full details, including what is stored and our position on model training, are in the AI & Data Policy.

5. Who processes your data

We never sell your data. We use a small number of providers to run the product, and we choose providers that offer a data processing agreement and standard contractual clauses for transfers. The full list, with purpose and data categories, is on the subprocessors page. It covers our hosting and database platform, the AI gateway, the social publishing API provider, payments, transactional email, product analytics, bot protection, SEO data lookups, web fonts, and sign-in with Google.

When you publish, the content and media you selected are sent to the social platform you chose (for example LinkedIn, Instagram, Facebook or X) and are then governed by that platform's own terms.

6. Where your data is stored and transferred

Our database, file storage and product analytics are hosted in the EU. Some providers, including payments, AI inference, email delivery, SEO data lookups and the social platforms you connect, may process data outside the EU or EEA. For those transfers we rely on the safeguards each provider offers, such as the EU Standard Contractual Clauses where they are available and, where applicable, adequacy decisions. Our web font files are requested from Google Fonts, which means your IP address reaches Google when a page loads.

7. Security

Data is isolated per workspace with Row Level Security at the database layer, and access is scoped by workspace role. Uploaded media lives in private storage served through short-lived signed links. Traffic is encrypted in transit. Social access tokens are held by our publishing provider and are never exposed to the browser. Access to production systems is limited to those who need it.

No system is fully secure. If a personal data breach affects you, we will notify the relevant supervisory authority within 72 hours where required and inform affected users without undue delay.

8. Your rights

Under the GDPR you can ask us to:

Give you access to a copy of your personal data.
Export your data in a portable, machine-readable format.
Correct data that is wrong or incomplete.
Delete your account and personal data.
Restrict or object to processing based on legitimate interest.
Withdraw consent for analytics or marketing at any time.

You can delete your account yourself in Settings, and you can change or withdraw cookie consent from the Cookie Policy page. Settings also has a one-click export that downloads your workspaces, brand profiles, drafts, plans, campaigns, media references, publishing history and settings as a JSON file. It does not include support conversations, notifications or credit history; email privacy@wemify.com and we will provide those too. We respond within 30 days.

You also have the right to complain to your data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).

9. Deleting your account

Deleting your account in Settings permanently removes your login, the workspaces you own and everything inside them: drafts, media records, plans, campaigns, analytics history, chat, comments, approvals, notifications, social connections and credit records. Team members lose access immediately. Workspaces owned by someone else are not deleted; your membership in them is removed and their content stays with the owner.

Uploaded files are queued for removal from our private storage and are deleted by an automated cleanup job shortly afterwards rather than in the same instant. Connections to your social accounts are removed on our side; because the OAuth tokens are held by our publishing provider, you can also revoke Wemify's access directly in the settings of the platform itself.

Two things survive on purpose: billing and accounting records we must keep by law, and encrypted infrastructure backups, which roll off automatically according to our hosting provider's backup schedule. Analytics events are pseudonymous and are removed on request.

10. Children

Wemify is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has provided data, contact us and we will remove it.

11. Changes

We may update this policy as the product evolves. The date at the top reflects the latest version. We will tell you about material changes in the product or by email.

12. Contact

Privacy questions and data requests: privacy@wemify.com. General support: support@wemify.com.

Questions?

Email support@wemify.com and a real person will get back to you.

Contact page