Privacy Policy & Data Governance

1. Preamble and Scope

1.1. WeaverFrame Inc. (“WeaverFrame”, “we”, “our”) provides an autonomous lead concierge and pipeline communication platform engineered for custom home building firms, luxury estate residential developers, and architecture studios (“Subscriber”, “Firm”).

1.2. In the custom residential construction sector, buyer identities, parcel locations, zoning classifications, and financial allocations constitute proprietary commercial assets. We operate under a strict data sovereignty architecture: your data remains exclusively yours, isolated to your organization.

2. Categories of Information Processed

2.1. We collect and process solely the information required to qualify inbound prospective home buyers and schedule consultations on behalf of the Subscriber:

• Prospective Buyer Data: Full name, verified email address, telephone contact, projected construction budget, parcel or municipal build location, architectural preferences, and inquiry transcripts.
• Subscriber Firm Data: Authorized staff names and email accounts, portfolio project descriptions, zoning rules, and third-party integration authorization tokens.
• System Diagnostics: Inbound webhook delivery receipts, sub-minute latency timestamps, email delivery status headers, and IP address sliding-window rate limit counters.

3. Zero Public Model Training Covenant

3.1. Absolute Prohibition: Under no circumstances are Subscriber floor plans, elevations, project estimates, client inquiries, or conversation histories used to train, retrain, fine-tune, or evaluate public machine learning or foundation artificial intelligence models.

3.2. All AI execution and qualification pipelines operate under enterprise commercial API terms (Google Cloud Enterprise and Groq Enterprise LPU) that legally guarantee zero data retention and strict zero-training covenants on all submitted inference prompts.

3.3. Custom rules, builder tone preferences, and zoning guardrails saved in the Concierge Directives workspace remain the exclusive trade secret property of the Subscriber.

4. Cryptographic Isolation and Storage Security

4.1. Encryption at Rest and in Transit: All data stored in PostgreSQL clusters is encrypted at rest using AES-256-GCM. All client-server transmissions, inbound webhooks, and API communications enforce TLS 1.3 encryption.

4.2. Multi-Tenant Scoping: Data is segregated at the database query layer via strict tenant identifiers (`builderId`). Cross-tenant queries are blocked at the ORM layer and verified against cryptographically signed JWT session cookies.

4.3. Token Protection: Third-party credentials, Google OAuth refresh tokens, and CRM API tokens are symmetrically encrypted using 256-bit keys before being committed to persistent storage. Plaintext credentials are never written to server logs.

4.4. Binary Assets: Architectural attachments, floor plan images, and lookbooks are hosted in Cloudflare R2 object storage with tamper-proof content-disposition controls.

5. Authorized Infrastructure Subprocessors

5.1. WeaverFrame maintains direct operational agreements with verified cloud infrastructure providers:

6. Data Ownership, Retention and Expunction

6.1. Subscriber Ownership: All client lead records, qualification notes, message histories, and scheduling data remain the exclusive property of the Subscriber. WeaverFrame does not sell, broker, or commercialize customer lead data.

6.2. Permanent Purge: Upon subscription cancellation or written request from an authorized builder principal, all prospective client records, message logs, and connected OAuth credentials will be permanently and irrevocably deleted from active database tables within thirty (30) calendar days.

7. Governance and Inquiries

7.1. For inquiries regarding our privacy standards, Data Processing Addendum (DPA) requests, or security disclosures, contact our compliance desk: