Data, storage and consent

When you add Weaver to your website, Weaver measures your visitors on your behalf. This page tells you exactly what that involves: what is collected, what is placed in your visitors' browsers, where the data is kept and for how long, how Weaver treats your consent banner, and what you are responsible for. It is written so you can copy from it into your own privacy notice and cookie policy. Our privacy policy is the formal document; this page is the practical one.

Who is responsible for what

You decide to measure your website and what to switch on, so for your visitors' data you are the controller. Weaver collects, stores and processes that data only to provide the service to you, so Weaver is your processor. In practice: you tell your visitors that you use Weaver and ask for their consent where the law requires it; Weaver keeps the data safe, uses it for nothing else, and helps you answer your visitors' requests.

What Weaver collects

On every page view

• A random visitor identifier that Weaver creates and stores in the visitor's browser (see the list below).
• A session identifier that lasts until the browser tab is closed.
• The IP address the request came from, shortened before it is stored: the last part of an IPv4 address, the last 80 bits of an IPv6 address. It points to a neighbourhood of addresses, not one household. Addresses recorded before 27 September 2026 were shortened the same way.
• The browser's description of itself (user agent), its language, time zone, and screen and window size.
• The address of the page, including its query string, and the address of the page the visitor came from (without its query string).
• Campaign parameters already present in the link, such as UTM tags and advertising click identifiers.
• The answer your consent banner gave at that moment: accepted, refused, or not answered yet.
• Error messages from the Weaver script itself, so we can fix problems.

Only if you switch it on

• Orders — the total, currency, shipping and the items of an order, read from your order confirmation page. To read the total, Weaver may keep a copy of that page for up to thirty days; order confirmation pages usually contain the buyer's name and address.
• Leads — values from forms you choose to track. Password fields are never read, email fields are not stored as typed, and phone numbers are cut to their last four digits; other fields you track are stored as the visitor typed them, up to 100 characters. Track only the fields you need.
• Signed-in visitors — the email address of a visitor, but only when your own site passes it to Weaver. Weaver never reads an email address off the page by itself.
• Custom events — clicks, form steps and similar actions you define, with the details you choose to attach to them.

What Weaver never does

• Sell or rent data, or share it with advertisers.
• Follow your visitors to other companies' websites, or combine one customer's data with another's.
• Build advertising profiles.
• Record keystrokes or screen recordings of your visitors, or read password fields.

What Weaver stores in the visitor's browser

You can use this table for your cookie policy. All of it is analytics storage: none of it is needed for your website to work, so Weaver belongs in your banner's analytics (or “statistics”) category, not the essential one. None of it is stored for a visitor who has refused.

Where the data is stored

Your visitors' data is stored in Israel, in Amazon Web Services' Tel Aviv region. The European Commission recognises Israel as providing an adequate level of data protection. Storage disks and backups are encrypted, and data travels to and from Weaver over encrypted connections. Each website's records are kept separate and are visible only to the people you give access to.

These are the only other companies that process data for Weaver:

Transfers to suppliers in the United States rely on Standard Contractual Clauses or an equivalent safeguard. Our own marketing website also uses Contentsquare/Hotjar (only after you accept our banner) and Cloudflare; they receive nothing about your visitors.

How long it is kept

• Individual visit records — three years, then removed automatically.
• Copies of order confirmation pages — thirty days.
• Records of traffic identified as automated — ninety days.
• Everything built from the visits — visitor records three years after the visitor's last visit; conversions, leads, orders and custom events three years after they happened; then removed automatically.
• A deleted website — everything it recorded is deleted when the seven-day grace period after the deletion request ends. The record of your privacy settings and choices is kept.

You cannot set a shorter retention period yourself yet; if you need one, write to us.

How Weaver handles your consent banner

Weaver reads the consent tool already running on your site, on every page, and records the visitor's answer with each visit. It recognises:

• Cookiebot, OneTrust, Usercentrics, CookieYes and Complianz
• The WordPress Consent API and Shopify's Customer Privacy API
• Google Consent Mode (the analytics_storage signal most consent tools also send)
• The browser's Global Privacy Control signal, which Weaver treats as a refusal

If you use a different tool, tell Weaver the answer from your own code once the Weaver script has loaded:

window.weaverTracker.consent({ analytics: true });  // or false

When a visitor says no

Weaver switches that visitor to cookie-free measurement, on every page, from the moment the refusal is visible:

• Nothing is stored in the visitor's browser, and everything Weaver stored there earlier is removed.
• No visitor identifier is sent. Pages are grouped into a visit by a code our server derives, which changes every day and cannot be traced back once the day is over.
• The IP address is shortened before it is saved (the last part of an IPv4 address, the last 80 bits of an IPv6 address).
• No email address, no form values, no text from custom events, and no copy of the order confirmation page.

The visit, its source and campaign, and an order total still appear in your reports; the visitor counts as new on each day they return. If the visitor later accepts, Weaver starts a fresh identifier from that moment and never joins it to what came before.

In your dashboard's Privacy page you can choose to record nothing at all for visitors who refuse instead (Weaver then keeps only a count of refusals), pick which category of your banner lets Weaver measure, and switch data collection off entirely. Every change is recorded with who made it and when.

When a visitor gives no answer

If your site has no consent tool, or the visitor has not answered it yet, Weaver follows where the visitor appears to be. Visitors in the EU, EEA, UK and Switzerland are measured cookie-free, exactly as above; everyone else is measured normally. Weaver judges this from the time zone the visitor's device is set to — no lookup of their IP address — so it is an estimate: a traveller is judged by their device.

If you collect consent in a way Weaver cannot read and want full measurement in every region, write to privacy@weaverall.com. That choice is yours and your responsibility, and we record when it was made, by whom, and the warning that was accepted.

What you are responsible for

These are the conditions of using Weaver on a website:

1. Consent. Where the law requires your visitors' consent for analytics — for example for visitors in the European Union or the United Kingdom — you collect it with your own consent banner, set up so that it tells visitors the truth and lets them say yes as easily as no. Weaver does not provide a banner for your site. It treats a visitor as having refused only when they actually chose “no” — a banner still waiting for an answer is not a refusal.
2. The right category. Put Weaver in your banner's analytics or statistics category. Do not classify it as essential or strictly necessary.
3. Tell your visitors. Name Weaver in your privacy notice as your analytics provider, and list the storage above in your cookie policy. You may link to this page.
4. Switch on only what you need. Order, lead, signed-in-visitor and custom-event tracking collect more personal data. Enable them only when you have a reason and a legal basis, and never track form fields that ask for health, financial, identity-document or similarly sensitive information.
5. No data about children. Do not use Weaver to identify visitors under 16, or on sites directed at children, without a legal basis.
6. Answer visitor requests. If a visitor asks you to see or delete what Weaver holds about them, find them on the Privacy page of your dashboard by their email address or visitor identifier: you can download their data or erase it there. If anything is unclear, write to privacy@weaverall.com.

Whether your site needs a consent banner at all depends on where your visitors are and what else your site runs. That is a question for your own advisers; this page is not legal advice.

Agreements

Our terms of service and privacy policy apply to every account. A standard data processing agreement for customers is being prepared; if you need one now, write to privacy@weaverall.com.

Contact

Questions about this page, or a request about a visitor's data: privacy@weaverall.com