Privacy Policy

1. In brief

This is a short summary. The full detail is in the sections below, which prevail if there is any conflict.

• Who runs Wevion: Bhblasted SRL SB (VAT IT08466861211), an Italian company, is the data controller for your account. Contact: privacy@wevion.ai
• What we collect: account and billing details, how you use the platform, data from the ad accounts you connect, support and AI-chat interactions, and cookies.
• Why: to run the Service (contract), to bill and keep it secure (contract / legitimate interest / legal obligation), for aggregate analytics (legitimate interest), and for marketing (only with your consent).
• Your data is not sold. We do not sell it for money. Some advertising cookies may count as a "share" under California law; during the closed beta you can request an opt-out by emailing privacy@wevion.ai.
• Your rights: access, correct, delete, export, and object. EU/UK/EEA users can complain to their data protection authority (in Italy, the Garante).
• Ad platforms: when you connect Meta, Google or others, you remain responsible for collecting valid consent from the people you advertise to. For Meta Business Tools you and Meta may be joint controllers (see the Meta section).

2. Who we are and our role

Bhblasted SRL SB is the Business (CCPA/CPRA) and Data Controller (GDPR) for the personal data of platform users (account holders). For personal data that our customers process through the Service (for example audience or lead data), Bhblasted SRL SB acts as a Service Provider (CCPA) / Data Processor (GDPR), on the customer's documented instructions. B2B customers enter into a separate Data Processing Agreement (DPA) that governs those processor activities. Bhblasted SRL SB is established in the European Union (Italy). An EU representative under GDPR Art. 27 is therefore not required, because Art. 27 applies only to controllers not established in the Union. We have not appointed a Data Protection Officer as we are not required to; privacy matters are handled at privacy@wevion.ai. Contact for any privacy question: privacy@wevion.ai.

3. Data we collect

4. How we use your data (legal bases)

5. Sharing your data and international transfers

We do not sell your personal data (in the ordinary meaning or under the CCPA/CPRA definition). We share personal data only as follows:

• Sub-processors (hosting, email delivery, AI inference, payments, analytics). The current versioned list is at /sub-processors. We give advance notice of new sub-processors and customers may object.
• Legal authorities, where required by law or to protect our rights.
• An acquirer in a merger, acquisition, or asset sale (equivalent privacy protection required).
• For recipients outside the EEA, transfers are covered by SCCs or an adequacy mechanism (see /sub-processors).

6. Meta Business Tools and joint controllership

When you connect a Meta ad account and use Meta Business Tools through Wevion (for example the Meta Pixel or the Conversions API), you and Meta Platforms may act as joint controllers under GDPR Art. 26 for the collection and transmission of certain event data, as set out in Meta's Controller Addendum / Joint Controller terms. In this arrangement, Wevion acts as your service provider / processor, operating the integration on your documented instructions. You remain responsible for:

• obtaining valid consent from the individuals you advertise to before any pixel, tag, or Conversions API event fires, where consent is required;
• keeping proof of that consent, in line with Meta's requirements; and
• honoring opt-outs and providing any notices your local law requires.

The same principles apply to comparable tools from other ad platforms you connect. Wevion provides consent-gating and controls, but it cannot replace your own legal basis for advertising to your audiences.

7. Retention

Account data: While the account is active + 30 days after deletion Billing records: As required by tax law (typically 10 years under Italian fiscal law; longer where another applicable law requires) Usage logs: 180 days (aggregated analytics may be kept longer in anonymized form) Support tickets: 3 years Marketing consent records: Until withdrawn + 2 years Ad account data: While the integration is active; deleted on request AI chat history: Per account setting (configurable; default 12 months)

8. Your rights

9. California: Do Not Sell or Share and notice at collection

We do not sell personal information for money. Certain advertising cookies and tools (for example Meta Pixel and Google Ads) may qualify as a "share" for cross-context behavioral advertising under the CPRA, even without payment. During the current closed beta you can reopen the "Manage cookie preferences" panel from the app footer to review the cookie categories in use, and you can opt out of any "share" of your personal information by emailing privacy@wevion.ai. A self-service "Do Not Sell or Share My Personal Information" control and automated Global Privacy Control (GPC) handling are not yet available and will be enabled before we open the Service to the general public; until then we action opt-out requests received by email within 15 days. At the point where we collect personal information (for example the sign-up form and the cookie banner) we provide a short notice at collection describing the categories we collect, the purposes, whether data is sold or shared, and a link to this Policy.

10. AI features and automated decision-making

Wevion's AI features assist you, for example by drafting copy, generating creative assets, or suggesting budget adjustments. They do not make automated decisions that produce legal or similarly significant effects on you under GDPR Art. 22. You always review AI output before it is published or acted on, and final decisions rest with you. AI output is provided "as is"; you are responsible for reviewing it for accuracy, compliance, and rights clearance before use (see Terms of Service, section “AI & Machine Learning Features”). We do not sell your prompts or use them to train third-party models without your consent. California ADMT (effective 1 January 2026): to the extent any feature is treated as automated decision-making technology under CPRA rules, California residents may opt out and request information about the logic involved by contacting privacy@wevion.ai.

11. Security

We use technical and organizational measures appropriate to the risk (GDPR Art. 32). No system is completely secure; in the event of a breach we notify affected users and authorities as required by applicable law.

• TLS 1.2+ encryption in transit
• Encryption at rest for sensitive fields (AWS KMS)
• Role-based access control and MFA for production access
• Regular vulnerability scanning
• Documented incident-response plan
• Employee privacy and security training
• GDPR Art. 33–34: notification to the supervisory authority within 72 hours where required, and to affected individuals without undue delay
• CCPA/CPRA and US state laws: notice without unreasonable delay, as mandated

12. Children's data

Wevion is a B2B service and is not directed at children under 18 (or under 16 in the EU). We do not knowingly collect data from children under 13 (US COPPA). If you believe a child has provided us data, contact privacy@wevion.ai for removal.

13. Changes to this Privacy Policy

We may update this Policy from time to time. Material changes take effect 30 days after we notify you by email or in-app notice. Non-material updates (clarifications, new sub-processors covered by SCCs) are published with an updated "Last updated" date. Each version is identified by a version number and effective date, and your acceptance is recorded against the specific version in force when you accept.

14. Contact

Privacy inquiries: privacy@wevion.ai Bhblasted SRL SB, Attn: Privacy Via Boscofangone SNC, Zona ASI, Lotto C8, 80035 Nola (NA), Italy VAT IT08466861211