In effect · 12 August 2026
This policy describes what WeYala collects, why, who else sees it, and how to get it back or have it deleted. It describes what the software actually does today. If you find something here that does not match how the system behaves, that is a bug in one of the two and we want to know: founder@weyala.ai.
WeYala is a product of Ampera Labs, currently an unincorporated business operated from New York, United States. For UK/EU data-protection law we are the controller of account data, and a processor of the content you put into the service.
Contact for anything in this policy: founder@weyala.ai.
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Name, email address, and the profile picture your identity provider supplies | Google sign-in — we receive it, we do not see your Google password |
| Your content | Everything you put in: your idea, documents, spreadsheets and data files, existing code, notes, plans, and the work WeYala generates for you | You |
| Contact data | If you use outreach: the names, email addresses and organizations of people you want contacted, and their replies to you | You, and inbound email |
| Operational records | Which agents ran, when, what they decided, what they cost, and errors | Generated as the system runs |
| Technical | IP address, browser and device type, timestamps, pages viewed | Automatically, on connection |
We do not ask for and do not want payment-card numbers (a payment processor would handle those directly), government identifiers, health data, or biometric data. Please do not upload them.
We do not sell personal information, share it for cross-context behavioral advertising, or use your content to advertise to you. We do not profile you for automated decisions that have legal or similarly significant effects on you.
WeYala's work is performed by large language models operated by third parties. To do the work, the relevant parts of your content are sent to those providers. This is unavoidable — it is how the service functions — so it is worth being precise about it.
Your content is not used to train third-party models. We use these providers under business/API terms that do not permit training on customer inputs or outputs. We do not opt in to any training or data-sharing program on your behalf, and we do not use your content to train models of our own.
Providers may retain inputs and outputs briefly for abuse monitoring under their own terms. The current providers are named in the sub-processor list, which we keep current.
What we do use, and what we do not:
Only the providers we need to run the service, each doing a specific job under contract. They are listed by name, purpose and location in the sub-processor list — hosting, database, AI model providers, email delivery, and payments if and when billing is introduced.
Two connections your browser makes directly. Our pages load typefaces from Google Fonts and the Supabase JavaScript client from the public CDN esm.sh. We send them nothing about you, but your browser reveals its IP address to them when it fetches a font or a script — on every pageview, whether or not you sign in. Both are listed as sub-processors, and we intend to remove the dependency by hosting them ourselves.
Otherwise we disclose personal data only: where you direct us to; where the law compels us, in which case we will tell you unless we are prohibited; to establish or defend legal claims; or to a successor in a merger or acquisition, in which case this policy continues to apply until you are told otherwise.
We do not use advertising or third-party tracking cookies.
We use a cookie set by our authentication provider to keep you signed in. Without it, sign-in cannot work.
WeYala's tools also store your work in your browser's local storage — plans, workflows, task lists and saved items live on your own device first. That is not sent anywhere unless you are signed in and the item syncs to your account. Clearing your browser storage deletes anything that has not synced, and we cannot recover it.
| What | Kept for |
|---|---|
| Your content and generated work | Until you delete it or close your account |
| Account record | Until you close your account, then deleted within 30 days |
| Opt-out records | Kept indefinitely. We have to remember that someone asked not to be contacted, or we cannot honor it. This is the one thing deleting your account does not erase. |
| Operational and audit records | Retained while the account is open and for a period afterwards for security and accounting. Some are append-only by design and cannot be altered after the fact — that is deliberate, so a record of what the system did cannot be quietly rewritten. |
| Backups | Deleted content persists in our infrastructure providers' backups until their ordinary rotation removes it. We do not control that schedule, so we do not quote a number we cannot guarantee. |
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy, object to or restrict processing, and withdraw consent. Under US state privacy laws you also have the right not to be discriminated against for exercising them.
Email founder@weyala.ai and we will respond within the time the law requires — 30 days under UK/EU GDPR, 45 days under California law. We do not charge for this. If you are in the UK or EU you may also complain to your supervisory authority.
If you are a recipient of outreach sent through WeYala and want to be removed or want your data deleted, email founder@weyala.ai or reply STOP to any message. The customer who uploaded your details is the controller of that data; we will act on your request and pass it to them.
Data is encrypted in transit and at rest by our infrastructure providers. Credentials are held in a dedicated secrets vault, not in configuration files or source code. Database access is restricted per-user at the row level. Code-writing agents run in isolated containers with restricted network access.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.
Data is stored and processed in the United States (US East). If you are in the UK or EU, your data will be transferred to the US. Where we rely on a transfer mechanism we use the European Commission's Standard Contractual Clauses and the UK Addendum with the providers concerned.
WeYala is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.
If we change this policy materially we will give notice before it takes effect, and the date at the top will change. Questions, requests or complaints: founder@weyala.ai.