Privacy Policy
Version 4.1 · Effective 3 July 2026 · Last updated 15 October 2026
This document is published in English only, as it is in the Wevion app (app.wevion.ai/privacy), where you accept it.
In brief
This is a short summary. The full detail is in the sections below, which prevail if there is any conflict.
- Who runs Wevion: Bhblasted SRL SB (VAT IT08466861211), an Italian company, is the data controller for your account. Contact: privacy@wevion.ai
- What we collect: account and billing details, how you use the platform, data from the ad accounts you connect, support and AI‑chat interactions, and cookies.
- Why: to run the Service (contract), to bill and keep it secure (contract / legitimate interest / legal obligation), for aggregate analytics (legitimate interest), and for marketing (only with your consent).
- Your data is not sold. We do not sell it for money. Some advertising cookies may count as a "share" under California law; you can request an opt-out at any time by emailing privacy@wevion.ai.
- Your rights: access, correct, delete, export, and object. EU/UK/EEA users can complain to their data protection authority (in Italy, the Garante).
- Ad platforms: when you connect Meta, Google or others, you remain responsible for collecting valid consent from the people you advertise to. For Meta Business Tools you and Meta may be joint controllers (see the Meta section).
Who we are and our role
Bhblasted SRL SB is the Data Controller (GDPR) for the personal data of platform users (account holders) and, to the extent the CCPA/CPRA applies to us, the Business.
For personal data that our customers process through the Service (for example audience or lead data), Bhblasted SRL SB acts as a Service Provider (CCPA) / Data Processor (GDPR), on the customer's documented instructions. B2B customers enter into a separate Data Processing Agreement (DPA) that governs those processor activities.
Bhblasted SRL SB is established in the European Union (Italy). An EU representative under GDPR Art. 27 is therefore not required, because Art. 27 applies only to controllers not established in the Union. We have not appointed a Data Protection Officer as we are not required to; privacy matters are handled at privacy@wevion.ai.
Contact for any privacy question: privacy@wevion.ai.
Data we collect
3.1 Account data
Name, email, password (stored hashed), preferred language, role, organization affiliation.
3.2 Billing data
Processed through Stripe: name, billing address, tax ID (VAT/EIN/GST), payment‑method token. We do not store full payment card numbers.
3.3 Usage data
Actions on the platform (logins, campaigns created, rules triggered), device information (browser, OS), IP address, session cookies, and timestamps.
3.4 Ad account data (via integrations)
When you connect Meta, Google or other ad accounts: OAuth tokens, ad account IDs, campaign data, performance metrics, audience data, and creative assets you upload.
3.5 Support interactions
Email, chat and support‑widget messages, attachments, and related metadata.
3.6 AI chat data
Prompts you send to AI assistants and conversation history. They are kept while your account exists; archiving a conversation hides it but does not erase it. To have conversations erased, email privacy@wevion.ai.
3.7 Cookies and analytics
First‑ and third‑party cookies for authentication, preferences, analytics, and — where consent is required — marketing attribution. See the Cookie Policy.
Some analytics tools (Microsoft Clarity, PostHog, Sentry Session Replay) record session activity; recordings are configured to mask user input and sensitive fields. The Cookie Policy explains how these tools behave on wevion.ai and in the Wevion web app. In the web app they currently run whatever choice you record in the cookie banner; you can object at any time by emailing privacy@wevion.ai.
How we use your data (legal bases)
4.1 EU/UK/EEA users (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Providing the Service: account, workspaces, connected ad accounts, AI features and support | Contract (Art. 6(1)(b)) |
| Billing, payments and invoicing | Contract (Art. 6(1)(b)); keeping tax and accounting records: legal obligation (Art. 6(1)(c)) |
| Security, fraud and abuse prevention, including checks on sign-ups that reuse the same email pattern, IP address or browser, and error monitoring (Sentry) | Legitimate interest in protecting the Service, its users and our business (Art. 6(1)(f)) |
| Service and account messages, such as trial, billing and security notices | Contract (Art. 6(1)(b)) |
| Product analytics and session recordings (PostHog, Microsoft Clarity, Google Analytics, Sentry Session Replay, Customer.io) | On wevion.ai, consent (Art. 6(1)(a)) given in the cookie banner. In the web app these tools currently run whatever choice you record in the cookie banner, except Customer.io, which follows a refusal; you can object at any time by emailing privacy@wevion.ai (see 3.7) |
| Referral and partner programme: attributing your sign-up to the person or partner who referred you and calculating their reward | Legitimate interest in running the programme (Art. 6(1)(f)); showing them your name, company and city: consent (Art. 6(1)(a)) |
| Aggregated statistics from our own database, such as how many teams use a feature | Legitimate interest in understanding and improving the Service (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)), withdrawable at any time |
| Legal compliance and lawful requests | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object at any time by emailing privacy@wevion.ai (Art. 21); we then stop, unless we have compelling legitimate grounds or need the data for legal claims. Where we rely on consent, you can withdraw it at any time, as easily as you gave it, without affecting processing before the withdrawal. Providing your account and billing details is necessary to conclude the contract: without them we cannot open your account or bill you.
4.2 California residents (CCPA/CPRA)
To the extent the CCPA/CPRA applies to us, we process personal information for the business purposes listed below. We do not sell personal information for money, and we do not share it for cross‑context behavioral advertising without honoring your opt‑out (see the California section).
4.3 Other jurisdictions
We comply with applicable law (e.g. LGPD, PIPEDA, APPI, PDPA, and US state privacy laws). Your rights are described in the "Your rights" section.
- Providing the Service and related operations
- Billing, fraud prevention, and security
- Product improvement and analytics (anonymized where feasible)
- Marketing communications (only with opt‑in consent)
- Legal compliance (tax records, lawful requests)
Sharing your data and international transfers
We do not sell your personal data (in the ordinary meaning or under the CCPA/CPRA definition). We share personal data only as follows:
International data transfers
Bhblasted SRL SB is an Italian company. Our main database, cache and transactional email run on Amazon Web Services in the EU (eu‑west‑1, Ireland). Some sub‑processors process personal data outside the EU, for example in the United States and in China; the Sub-processors list at /sub-processors gives the location of each one.
For transfers of personal data from the EU/UK/EEA we use, for each recipient, an adequacy decision where one applies (for example the EU–U.S. Data Privacy Framework, for recipients certified under it) or the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, with supplementary measures where needed. The Sub-processors list shows the mechanism for each recipient; where it shows a mechanism as not yet confirmed, we have not yet completed that check. You can ask for a copy of the safeguards at privacy@wevion.ai. Data subjects keep their GDPR rights, enforceable against Bhblasted SRL SB.
- Sub‑processors (hosting, email delivery, AI inference, payments, analytics). The current versioned list is at /sub-processors. We give advance notice of new sub‑processors and customers may object.
- Advertising platforms (Meta, TikTok, X), to measure the advertising that brings people to Wevion. When you sign up, add a card to your trial or pay, our servers send them a hashed (SHA-256) copy of your email address, with a hashed account identifier for Meta and TikTok, and they send Meta and TikTok the same when you first spend on advertising through Wevion. At sign-up, Meta and X also receive your IP address, browser details and any advertising click or browser identifier we hold; for payments, all three receive the amount and currency. A hashed email address is still personal data, because the platforms can match it to their own users.
- The person or partner who referred you, if you sign up through a referral or partner link or code. They see that a sign-up came through their link, its date, whether you signed up as a company, a freelancer or a private individual, and whether and when you became a paying customer, with the amounts their reward is based on; a customer who invited you also sees a masked version of your email address. Your name, company and city are shown only if you agree. You can change this, or hide yourself completely, in Settings → Privacy.
- Legal authorities, where required by law or to protect our rights.
- An acquirer in a merger, acquisition, or asset sale (equivalent privacy protection required).
- For recipients outside the EEA, the Sub-processors list (/sub-processors) shows the transfer mechanism of each.
Meta Business Tools and joint controllership
When you connect a Meta ad account and use Meta Business Tools through Wevion (for example the Meta Pixel or the Conversions API), you and Meta Platforms may act as joint controllers under GDPR Art. 26 for the collection and transmission of certain event data, as set out in Meta's Controller Addendum / Joint Controller terms.
In this arrangement, Wevion acts as your service provider / processor, operating the integration on your documented instructions. You remain responsible for:
- obtaining valid consent from the individuals you advertise to before any pixel, tag, or Conversions API event fires, where consent is required;
- keeping proof of that consent, in line with Meta's requirements; and
- honoring opt‑outs and providing any notices your local law requires.
The same principles apply to comparable tools from other ad platforms you connect. Wevion does not collect or check consent on your behalf: configure your own consent tool so that events reach Wevion, and through it the ad platforms, only after consent has been given where it is required.
For the Meta Pixel and Conversions API that we use to measure our own advertising, Bhblasted SRL SB and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR); Meta is responsible for what it does with the data after receiving it. You can exercise your rights towards either of us.
Retention
| Category | Retention |
|---|---|
| Account data | While the account exists. If you delete your account, it is closed after a 30-day cancellation period; its personal data is then kept until you ask us to erase it at privacy@wevion.ai |
| Billing records | As required by tax law (typically 10 years under Italian fiscal law; longer where another applicable law requires) |
| Usage and audit logs | Up to the life of the account and, after it is closed, until you ask us to erase its personal data (aggregated analytics may be kept longer in anonymised form) |
| Support tickets | Up to the life of the account and, after it is closed, until you ask us to erase them |
| Marketing consent records | Until you ask us to erase them |
| Ad account data | Up to the life of the account and, after it is closed, until you ask us to erase it; disconnecting an ad account does not erase the data already synced |
| AI chat history | While the account exists, including archived conversations, unless you ask us to erase them |
| Conversion data sent to ad platforms (section 5) | We keep a delivery record for 90 days; each platform keeps what it receives under its own terms |
| Referral attribution and reward records | As accounting records, as required by tax law |
Your rights
8.1 Rights available in most jurisdictions
8.2 EU/UK/EEA (GDPR / UK GDPR)
You can exercise the rights below by contacting privacy@wevion.ai. Some can also be exercised in the app: you can delete your account in Settings → Account and control what the person who referred you can see in Settings → Privacy. We respond within one month, extendable by two further months for complex or numerous requests (Art. 12(3)); if we extend, we tell you why within the first month.
You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma; www.garanteprivacy.it). If you are in another EEA country or the UK, you may contact your local data protection authority instead.
8.3 California (CCPA/CPRA)
California residents have the rights listed below. We verify identity before fulfilling a request (we may ask you to log in or answer security questions) and respond within 45 days (extendable to 90). You may use an authorized agent with signed written authorization. See the California opt‑out section for "Do Not Sell or Share."
8.4 Other jurisdictions
Comparable rights apply under LGPD (Brazil), PIPEDA (Canada), APPI (Japan), PDPA (Singapore), and US state laws (VCDPA, CPA, CTDPA, UCPA and others). Contact us to exercise them.
- Access your personal data
- Correct inaccurate data
- Delete your data (subject to legitimate retention requirements)
- Portability — receive your data in a machine‑readable format
- Object to, or restrict, certain processing (Art. 18, 21)
- Withdraw consent at any time (Art. 7(3)) without affecting prior lawful processing
- Opt out of marketing communications
- Not be subject to automated decision‑making with legal or similarly significant effect (Art. 22)
- California: Know, Delete, Correct, Opt out of sale/sharing, Limit use of sensitive personal information, and Non‑discrimination for exercising rights
California: Do Not Sell or Share and notice at collection
This section applies to the extent the CCPA/CPRA applies to us. We do not sell personal information for money. Certain advertising cookies and tools (for example Meta Pixel and Google Ads) may qualify as a "share" for cross‑context behavioral advertising under the CPRA, even without payment.
You can reopen the "Manage cookie preferences" panel at the bottom of the Cookie Policy page in the app to review the cookie categories in use, and you can opt out of any "share" of your personal information by emailing privacy@wevion.ai. A self-service "Do Not Sell or Share My Personal Information" control and automated Global Privacy Control (GPC) handling are not available; we action opt-out requests received by email without undue delay and within the time limits set by applicable law.
The sign-up form links to this Policy. Sections 3, 4, 5 and 7 are our notice at collection: the categories we collect, the purposes, whether data is sold or shared, and how long we keep it.
AI features and automated decision‑making
Wevion's AI features assist you — for example by drafting copy, generating creative assets, or suggesting budget adjustments. They do not make automated decisions that produce legal or similarly significant effects on you under GDPR Art. 22. You always review AI output before it is published or acted on, and final decisions rest with you.
AI output is provided "as is"; you are responsible for reviewing it for accuracy, compliance, and rights clearance before use (see Terms of Service, section “AI features”). We do not sell your prompts or use them to train third‑party models without your consent.
California ADMT (effective 1 January 2026): to the extent any feature is treated as automated decision‑making technology under CPRA rules, California residents may opt out and request information about the logic involved by contacting privacy@wevion.ai.
Security
We use technical and organizational measures appropriate to the risk (GDPR Art. 32). No system is completely secure; in the event of a breach we notify affected users and authorities as required by applicable law.
- TLS encryption for connections between your browser or API client and the Service
- Encryption at rest of our main database (Amazon Aurora, with AWS KMS keys) and application-level encryption of the access tokens of connected ad accounts
- Production access is role-based and limited to authorised staff.
- Automated checks on every change, including secret scanning, before it reaches production
- Audit logs of administrative actions
- Database backups with point-in-time recovery
- GDPR Art. 33–34: notification to the supervisory authority within 72 hours where required, and to affected individuals without undue delay
- CCPA/CPRA and US state laws: notice without unreasonable delay, as mandated
Children's data
Wevion is a B2B service and is not directed at anyone under 18. We do not knowingly collect data from children under 13 (US COPPA). If you believe a child has provided us data, contact privacy@wevion.ai for removal.
Changes to this Privacy Policy
We may update this Policy from time to time. Material changes take effect 30 days after we notify you by email or in‑app notice. Non‑material updates (clarifications, new sub‑processors covered by SCCs) are published with an updated "Last updated" date. Each version is identified by a version number and effective date, and your acceptance is recorded against the specific version in force when you accept.
Contact
Privacy inquiries: privacy@wevion.ai
Bhblasted SRL SB — Attn: Privacy Via Boscofangone SNC, Zona ASI, Lotto C8, 80035 Nola (NA), Italy VAT IT08466861211