FAQ: data storage region, GDPR, team isolation, AI provider data handling, data sharing, retention, right to be forgotten.

FAQ — data and privacy

Common questions about how Wevion handles your data. For deep details on AI-specific privacy: see ai-110 Wavo privacy.

Where is my data stored?

Wevion's main database, cache, file storage, message queues, and transactional email run on AWS in the EU (eu-west-1, Ireland).

Some sub-processors process data outside the EU: for example Stripe, Sentry, PostHog, Microsoft Clarity and several AI providers in the US, and DeepSeek (the default AI model), Moonshot/Kimi and TikTok in China. The sub-processors list gives the location of each one.

For other questions about where your data goes, contact support.

Is Wevion GDPR-compliant?

Yes. Wevion respects GDPR principles:

• Lawful processing: data processed for the purposes you authorized (ad management, analytics)
• User rights: access, correction, deletion via support
• Data minimization: only data needed for the service
• Transparency: this FAQ + privacy policy
• Breach notification: per GDPR timeline if applicable

For a Data Processing Agreement (DPA): contact sales / legal.

Who can see my data inside Wevion?

Strict team isolation:

• Your team's data: visible only to authorized users in your team (per RBAC)
• Super_admin / owner roles: broader visibility within team
• Other teams: cannot see your data

Per-role visibility:

See team-101 role hierarchy.

Are AI conversations (Wavo) private?

Yes — strictly team-isolated.

What model providers see:

• Your message
• Last 20 messages of context
• System prompt + tool definitions
• Tool results

Per their enterprise terms (Anthropic, OpenAI, Google, DeepSeek, Moonshot). Most enterprise tiers do not train on customer data — review your specific agreement.

See ai-110 Wavo privacy.

Does Wevion sell my data?

No. Wevion does not sell customer data.

Does Wevion share data with third parties?

Yes, with the sub-processors that run the service and with the integrations you connect:

• Ad platforms and stores (Meta, Google, TikTok, Taboola, Outbrain, Snapchat, ExoClick, Shopify, WooCommerce) — when you connect them, to manage your ads and read your store data
• Infrastructure, payments and monitoring — AWS, Stripe, Sentry
• AI model providers — for Wavo and Creative AI (per their terms)
• Product analytics and advertising measurement — PostHog, Microsoft Clarity, Google, Meta, TikTok, X and OpenAI receive data from the tags we run on our own app and website; Meta, TikTok and X also receive conversion data from our servers when someone signs up, adds a card to the trial or pays
• CRM, support and notifications — Customer.io, Featurebase, Telegram, Slack

The full list is on the sub-processors page.

What's the data retention policy?

Varies by data type:

For specific retention questions: contact admin OR support.

Right to be forgotten (GDPR Article 17)?

Yes:

• User-initiated: user can request account deletion. Removes user-owned data (preferences, AI memory, sessions, personal info).
• Audit log: retained per legal / compliance requirements (often required by law to retain even after deletion).
• Workspace deletion: workspace owner can request full workspace deletion (data loss permanent).

Contact support for GDPR requests.

What about subprocessors?

Wevion uses subprocessors for:

• Cloud infrastructure, storage, queues and transactional email (AWS in eu-west-1, Ireland, including SES)
• Error monitoring (Sentry, US)
• AI providers (DeepSeek as the default model, Moonshot/Kimi, Anthropic, Google, OpenAI, plus creative-generation providers)
• Payment processing (Stripe)
• Product analytics and advertising measurement (PostHog, Microsoft Clarity, Google, Meta, TikTok, X, OpenAI)
• CRM, support and notifications (Customer.io, Featurebase, Telegram, Slack)

The full list, with locations and transfer mechanisms, is on the sub-processors page.

How are passwords + tokens stored?

• Passwords: hashed with bcrypt (industry standard; one-way)
• OAuth tokens: stored in an access-controlled database; encrypted at rest for supported ad providers (per-provider AES-GCM keys)
• Session JWTs: signed with EdDSA, 1-hour expiry (refreshed hourly)
• API keys: hashed; full value shown once at creation
• Backup codes (2FA): hashed; one-time use

Wevion staff cannot read your password or token values directly.

What about secrets in chat (Wavo)?

chat-security.ts sanitizeToolOutput() strips known secret patterns (Meta tokens, JWTs, AWS keys, Stripe keys, Google keys, DB strings) before they reach the model OR your screen.

Defense-in-depth: don't paste secrets to chat in the first place.

See Wavo privacy and data usage.

Are notifications privacy-safe?

Notifications respect team isolation:

• You see notifications for your team's data only
• Owner fan-out: owners see team members' notifications (by design)
• Email content sanitized for secrets (similar to Wavo)

External channels (Telegram, Slack) carry the notification text — review what you connect.

What if there's a security breach?

Wevion's incident response includes:

• Notification to affected customers per GDPR timeline (72 hours where applicable)
• Detail of what was exposed
• Recommended user actions (password change, token rotation, etc.)
• Investigation report

Suspect a breach: report to security channel (typically security@wevion.ai — verify with admin).

Cookies + tracking?

Wevion uses cookies for:

• Session management (essential)
• Workspace state (essential)
• Analytics on Wevion product usage (in the web app these tools currently run whatever you choose in the cookie banner; you can object by emailing privacy@wevion.ai)

See cookie consent banner on first visit + privacy policy.

Can I get a SOC 2 / ISO report?

For enterprise customers: contact sales for security documentation. Reports may include SOC 2 Type II, ISO 27001, penetration test summaries (depending on Wevion's current certifications).

FAQ

Where does Wevion store my data?

Wevion's main database, cache, file storage, queues, and transactional email run on AWS in the EU (eu-west-1, Ireland). Some sub-processors process data outside the EU, for example in the US and in China; the sub-processors list on wevion.ai gives the location of each one.

Who can see my data inside Wevion?

Wevion enforces strict team isolation: your team's data is visible only to authorized users in your team per RBAC, and other teams cannot see it. Broader visibility within a team is limited to super_admin and owner roles, with admin, manager, mediabuyer, finance, and viewer each scoped by the role hierarchy.

Does Wevion sell or share my data?

No — Wevion does not sell customer data. It shares data with the sub-processors that run the service (infrastructure, payments, AI providers, analytics and advertising measurement, CRM, support) and with the ad platforms and stores you connect. The full list, with locations, is on the sub-processors page of wevion.ai.

How does Wevion store my passwords and tokens?

Wevion hashes passwords, signs session JWTs with EdDSA (1-hour expiry, refreshed hourly), and hashes API keys and 2FA backup codes. Because these are hashed, Wevion staff cannot read your password directly. Full API key values are shown only once, at creation.

Related articles

• Wavo privacy and data usage
• Set up two-factor authentication (2FA)
• Notification categories explained
• Troubleshooting Wevion — complete guide