Data retention policy
Campaign content is retained indefinitely unless users request deletion. Dashboard tokens expire after 4 hours. Usage metrics are retained for 90 days (detailed logs) with aggregated data retained longer. Installation data is kept for duration of service plus 30 days. Slack tokens are encrypted at rest and retained for duration of installation. Users can request deletion at any time via admin@wovedigital.co.uk.
Data archiving and removal policy
Upon app uninstallation: OAuth tokens and session data are deleted immediately. Workspace configuration, usage tracking, and user associations are deleted within 30 days. Aggregated anonymous statistics and GDPR audit logs (retained 3 years per legal requirements) are kept. Generated content is retained until explicit deletion request to allow reinstallation access. Full deletion available via admin@wovedigital.co.uk.
Data storage policy
All customer data is stored in AWS eu-north-1 (Stockholm, Sweden) using DynamoDB with encryption at rest (AES-256). Sensitive data including OAuth tokens and Google refresh tokens are encrypted. We implement IAM roles with least-privilege access, Slack signature verification on all endpoints, per-workspace rate limiting, and CloudWatch monitoring for suspicious activity.
Data center location(s)
Sweden
Data hosting details
Cloud hosted on AWS serverless infrastructure (Lambda, DynamoDB, API Gateway, SQS). All services run in eu-north-1 (Stockholm, Sweden). No on-premise components. Infrastructure managed via Serverless Framework with infrastructure-as-code.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
OpenAI GPT-4o, GPT-4o-mini
LLM retention settings
OpenAI retains API inputs and outputs for up to 30 days for abuse and misuse monitoring, after which data is deleted. OpenAI does not use API data to train models. Adweaver caches generated results in our own database (AWS DynamoDB, EU) for user access.
LLM data tenancy policy
Adweaver uses OpenAI's API which operates in a shared tenancy model. Each API request is processed independently with no data persistence between requests. Customer prompts and outputs are isolated per-request. We do not use a dedicated or single-tenant.
LLM data residency policy
LLM processing occurs via OpenAI's API infrastructure located in the United States. Input prompts (product descriptions, keywords, audience info) are sent to OpenAI for processing and responses are returned to our EU-hosted infrastructure (AWS eu-north-1.