Legal
Privacy Policy
How Weflayr handles personal data for which it is responsible.
Version 1.1 · Last updated 28 August 2026
This policy explains how Weflayr SAS handles personal data for which we are responsible: the data of people who visit our website, who use our platform, who we contact about our product, and who apply to work with us.
It does not cover the data your application sends us through our SDK. For that data you are the controller and we act as your processor, on the terms of our Data Processing Agreement.
Who we are. Weflayr SAS, a société par actions simplifiée registered at 12 place Henri Bergson, 75008 Paris, France. RCS Paris 103 332 649.
Who to contact. privacy@weflayr.com. We have assessed the criteria of Article 37 of the GDPR and are not required to appoint a Data Protection Officer. We have designated a Data Protection Lead, who is the point of contact for any question about this policy.
What we collect, and why
If you visit our website
We collect limited technical data needed to serve the site securely, including your IP address, browser type and the pages you view.
We use PostHog, hosted in the European Union, to understand how the site is used. This includes session analytics that record page interactions (clicks, scrolling and navigation) so we can diagnose usability problems; it is configured to mask text entered into forms. PostHog runs only if you accept analytics cookies, and you can withdraw consent at any time from the “Cookie preferences” link in the footer.
With your consent, PostHog stores a small number of first-party cookies and local-storage entries to recognise your browser across pages and visits. They last no more than 13 months. If you decline, none are set.
Legal basis. Legitimate interest in operating and securing our website. Consent for non-essential analytics, session recording and cookies, which you can give or withhold in our cookie banner and change at any time.
If you use the Weflayr platform
We collect your name, business email address, your role and organisation, your authentication events, and records of your activity in the product. We also collect support requests you send us.
Legal basis. Performance of the contract with you or your employer, and our legitimate interest in securing the Service and preventing abuse.
If we contact you about Weflayr
We collect business contact information, being your name, business email address, job title, employer and publicly available professional information. We obtain it from you directly, from your employer’s website, from professional networks and from business data providers.
Legal basis. Legitimate interest in promoting a product relevant to your professional role. You can object at any time, and every message we send contains an unsubscribe link. Where the law of your country requires consent for such contact, we obtain it first.
If you apply for a role with us
We collect the information in your application and any notes we make during the process.
Legal basis. Steps taken at your request before entering into a contract, and our legitimate interest in assessing candidates.
If you are a customer contact for billing
We collect the information needed to invoice and be paid.
Legal basis. Performance of the contract and compliance with our accounting obligations.
Where your data is processed
Our platform, our analytical store and our internal systems are hosted in the European Union.
Some of the providers we use to run our own business are established outside the European Economic Area. Where that is the case, transfers are governed by an adequacy decision or by the Standard Contractual Clauses adopted by the European Commission. A copy of the relevant clauses is available on request.
How long we keep it
| Data | Retention |
|---|---|
| Website technical and analytics data | 13 months at most |
| Account and product usage data | The term of the subscription, then 30 days |
| Support correspondence | 3 years from the last exchange |
| Prospect and marketing contact data | 3 years from the last contact with you |
| Job applications, where you are not hired | 2 years, unless you agree to a longer period |
| Billing records and accounting documents | 10 years, as required by article L123-22 of the French Commercial Code |
| Security and access logs | 12 months |
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent.
To exercise any of these, write to privacy@weflayr.com. We usually respond within a few days, and always within the one month required by law.
If you are unsatisfied with our response, you may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris, or with the supervisory authority of your country of residence.
Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means alone.
Security
We maintain an information security management system aligned with ISO/IEC 27001. Our current security posture and certification status are published at trust.weflayr.com.
Changes to this policy
We may update this policy. Where a change materially affects you, we will say so at the top of this page and, where we hold your contact details and the change concerns you, we will tell you directly.
Contact
Weflayr SAS, 12 place Henri Bergson, 75008 Paris, France.