Privacy Policy

1. Our Commitment to Privacy

As we work with you to build better relationships, we are committed to protecting your privacy. For any personal data we collect as part of your journey with us, this Privacy Policy ("Policy") explains why we collect the data, what we do with the data, and your rights and choices when it comes to your personal data. For the avoidance of doubt, references in this Policy to data, personal information, or information, are all references to personal data.

When you use our mobile application ("App"), access our website ("Website"), or interact and communicate with us via our online or social media channels, this Policy will apply to you. For this policy, we will refer to all these touchpoints with you as our services ("Services").

So we can remain transparent about how we use your personal data, we will notify you when there are significant or material updates to this Policy.

2. Who is Collecting Your Data

You know us as Woven ("we", "our", "us") and we are the data controller. We decide what personal data is collected from you and how this data will be used.

Our Services may contain links to other websites such as Twitter, Facebook, and Instagram. These third-party organisations will have their own privacy policies, which you should read carefully before providing any of your personal data to them, as we do not accept any responsibility or liability for them.

3. How We Collect and Use Your Personal Data

Identity Information

When you use the App, we collect: your name and a unique user code we supply you with to allow you and your partner to connect your Apps; your device ID so that we are able to identify you as one of our users. We may also collect your email address to allow you to create an account with us.

Personal Information (username, profile photo, etc.)

You may decide to submit a cover photo, profile photo, username, couple anniversary date, and other relationship information in order to personalise your own profile. We may use this data to improve the level of personalisation of the App and relevance of content for you and your partner. This information is not required in order to use the app.

Activity Information

When you use the App, we collect: your responses to our check-ins and conversations so that we may share these answers and your progress with you, and your partner where you have chosen to connect your App; information about when you connect with your partner; your activity completion so that we may share your progress with you.

You may also choose to share photo or video content, for which you might give us permission to access your camera or photo album.

The responses, answers and photos that you provide to the App are seen by you (and your partner where you have connected your App). Woven may access your responses, answers and photos in an anonymised way for the limited purpose of analysing and understanding how to improve your experience via personalized recommendations, analysis, new features, greater guidance, and improved user-friendliness within the app.

Demographic Information

We may present the option for you to provide demographic information so we can provide you with relevant recommendations and tailor the content we provide in the App. Where we do so, we collect personal data such as age, gender, preferences, interests, and lifestyle information.

If you chose to provide us with information for tailoring content in the App which may be considered special category data, such as your sexual orientation, race or ethnicity, or health information, we have done so on the basis of your consent, and you have agreed to it being processed in accordance with this Policy. You may withdraw your consent at any time by deleting your preferences or contacting us at the email address provided at the end of this Policy.

Usage Information

When you use the Services, we collect: your responses to surveys so that we may improve the Services we offer; information about the time you spend and the activities you engage with in the App in order to better understand your needs and preferences and improve the user journey and experience; your IP address in order to know your general location so that we can manage the security of our platforms; and your device ID and email address so that we may communicate with you (via email or push notifications) about the activities you undertake as part of Services.

Support Information

When you use the Services, we collect: your email address when you contact us for support so that we are able to respond to you; your device information so that we can understand and fix technical issues that may occur with our platforms, and other personal data you provide about yourself anytime you contact us for support or general queries.

Subscription and Registration Information

When you subscribe to Woven Premium or register for an account, we collect: the details of your applicable subscription, registration information associated with setting up your account which includes an email address and password. We use your registration information to set up your account and to allow you to backup and restore your activity information.

Marketing Information

When you use the Services, we collect your email address so that we can deliver offers and promotions that may be of interest to you. We may use personal data to market our own products and services, which includes sending you information about Woven updates and features, our newsletter, and discounts on Woven Premium.

Technology Information

When you use our Services, we collect and store certain information via the use of technologies such as device identifiers, pixels and cookies. These technologies track information about you and enable us to: (i) remember you when using your computer or device so that we can personalise your user journey and (ii) advertise our Services to you and other relevant audiences.

4. Our Lawful Bases for the Use of Your Personal Data

Performance of a Contract with You

When we refer to performance of a contract with you as a legal basis, we refer to those circumstances where we need to use your personal data to comply with our contractual obligations to deliver the services you have engaged us to provide.

Legitimate Interest

When we refer to legitimate interest as a legal basis, we refer to those interests we have in running our business, developing our products and services, delivering and improving our products and services, and ensuring an excellent customer experience in a way which may reasonably be expected and don't infringe on your rights and freedoms.

Consent

If you provide information that may be classed as special or sensitive (e.g. health or sexual orientation) you consent to processing of that information in accordance with this Policy. You may withdraw your consent by deleting your content and contacting us at the address at the end of this Policy.

5. Information Sharing You Control

When Your App is Connected

We do not share your personal data with your partner but provide you with the ability to initiate this sharing. When you connect your instance of the App with your partner's instance of the App, you will be exercising your control to share your name and conversations with your partner. While your App is connected, all your conversations will be available for your partner to view until you choose to end the connection or by deleting your account.

6. Sharing Personal Data with Service Providers and Other Organisations

We never disclose your personal data to advertisers or other third parties for any compensation. However, we share the personal data we collect about you in order to provide our services in the ways described below.

Service Providers

We work with service providers that carry out certain functions on our behalf. These include, for example, companies that help us with network and technology services, payment processing, storing data, analysing data, managing mailing campaigns, running our support desk, and managing subscriptions. We only share the personal data necessary to enable our service providers to provide their services.

Sharing Personal Data with Other Organisations

We may share personal data with other organisations in the following circumstances:

• If the law or a public authority says we must share the personal data;
• If we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to our professional advisors); or
• To an organisation we sell or transfer (or enter into negotiations to sell or transfer) any of our businesses or any of our rights or obligations under any agreement we may have with you. If the transfer or sale goes ahead, the organisation receiving your personal data can use your personal data in the same way as us.

7. How We Protect Your Information and Where We Store It

Woven has physical, electronic, and procedural safeguards that comply with regulations to protect personal information about you. However, data transmissions over the internet cannot be guaranteed to be 100% secure. Consequently, Woven cannot ensure or warrant the security of information you provide over the internet to us.

The personal data we collect may be stored and processed on computers situated outside the United Kingdom or the European Economic Area ("EEA"). These countries may have data protection laws that are different from the laws of your country. If such a transfer or storage outside of the UK or EEA was to happen, this would only be done subject to the implementation of adequate contractual safeguards (e.g., the EU's Standard Contractual Clauses).

Woven limits access to personal information about you to employees who Woven reasonably believes need to come into contact with that information, to provide products or the Service to you, or in order to do their jobs.

8. How Long We Use Personal Data For

Your personal data won't be kept longer than is reasonably necessary, giving due regard to: initial purpose of collection; age of data; any legal/regulatory reason for us to keep it; and whether needed to protect you or us. We may retain and use your personal data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and rights, or if it is not technically reasonably feasible to remove it. To determine the appropriate retention period for personal data we consider the amount, nature and sensitivity of personal data, potential risk of harm from unauthorised use or disclosure and the purposes for which we process and whether we can achieve these purposes by other means in addition to the applicable legal and regulatory requirements.

9. Your Data Protection Rights – UK and EEA Residents

Below, we set out the rights you have under the UK / EU GDPR in relation to your personal data. Should you wish to exercise any of these rights, please write to us using the information provided under the "How to contact us" section of this Policy.

• Subject Access Rights: You have a right to see the personal data we hold about you and the circumstances of our processing activities.
• Right to have inaccurate information corrected: If you believe we hold inaccurate or missing information, please let us know and we will correct it.
• Right to object to our use of your personal data: We will consider your objection to our use of your personal data. If on balance, your rights outweigh our interests in using your personal data, then we will at your request either restrict our use of it or delete it.
• Right to object to direct marketing: Where we engage in direct marketing activities (after getting your consent), if you make such an objection, we will stop using your personal data for direct marketing purposes.
• Right to restrict our use of your personal data: You can restrict our use of your personal data, if you have successfully made a general objection, you are challenging the accuracy of the personal data we hold, or we have used your personal data unlawfully – but you do not want us to delete it.
• Right to have your personal data deleted: You can have us delete your personal data when: we no longer need to keep your personal data; you have successfully made a general objection; you have withdrawn your consent to us using your personal data (where we have relied on consent as the lawful basis for doing so); or we have unlawfully processed your personal data.
• Right to complain to the data protection regulator: We'd like the chance to resolve any complaints you have, however you also have the right to complain to the data protection regulator in the UK or EEA country where you receive our product about our use of your personal data. In the UK, the data protection regulator is the ICO and their website is at https://ico.org.uk.

10. Children's Data

Woven does not knowingly collect Personal Data from children under the age of 18. If you are under the age of 18, do not send any information about yourself to us, including your name, address, telephone numbers, or email address, unless you have your parent's or guardian's permission. Should we become aware that we are processing the personal data of any children, we will delete such personal data as soon as possible in accordance with applicable law.

11. International Privacy Laws

This Policy complements and does not replace applicable national data protection laws. Any applicable national data protection law will supersede this Policy where such law imposes stronger requirements and this Policy shall apply where there are no national data protection laws.

12. Advertising

We may partner with third party ad networks either to display advertising on our Website or Services or to manage our advertising on other sites. Our ad network partner may use cookies and web beacons to collect non-personally identifiable information about your activities on our Website or Services to provide you targeted advertising based upon your interests.

Please note opting out does not opt you out of being served advertising. You will continue to receive generic ads.

13. U.S. State Data Privacy

This section of our Policy contains information required by certain U.S. state data privacy laws. If you reside in California, Colorado, Connecticut, Utah, or Virginia, this section applies to you and supplements the rest of our Policy.

California Privacy Rights

The California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), requires us to provide California consumers with some additional information regarding how we collect, use, and disclose your personal information, and the rights available to California consumers under the CCPA.

As described above in Section 3, Woven may have collected the following categories of "personal information" (as that term is defined by the CCPA) about you through our Services within the last 12 months:

• Identifiers, such as your name, email address, and username;
• Personal information categories listed in the California Customer Records statute, such as your contact information and profile photo;
• Commercial information, such as transaction information and purchase history;
• Internet or network activity information, such as your browsing history and interactions with our Website;
• Geolocation data, such as your approximate location based on your IP address;
• Audio, electronic, visual, and similar information, such as content you may have uploaded;
• Your account log-in information; and
• Inferences drawn from any of the above personal information.

If you are a California resident, you may have the following rights under the CCPA:

• Know and Access: You have the right to request to know and access information about our data collection practices.
• Correct: You have the right to request that we correct any of your personal information that is inaccurate.
• Delete: You have the right to request that we delete personal information that we have collected from you.
• Opt-Out of Sales and Sharing: You have the right to request that we not "sell" or "share" your personal information with a third party.
• Non-Discrimination: You have the right to not be discriminated against for exercising any of your CCPA rights.

Colorado, Connecticut, Utah, and Virginia Privacy Rights

If you are a resident of Colorado, Connecticut, Utah, or Virginia, you may have similar rights concerning your personal data, including:

• Access: The right to confirm whether we are processing personal data about you and to access such personal data.
• Data Portability: The right to obtain your personal data in a portable and readily usable format.
• Correction: The right to request that we correct inaccuracies in your personal data.
• Deletion: The right to request deletion of your personal data.
• Opt-out: The right to opt out of targeted advertising.
• Appeal: The right to appeal a refusal to take action on your request.

Making Rights Requests

If you are a resident of one of the above U.S. states and would like to make a request to exercise one of the rights described above, please submit your rights request to kyang2124@gmail.com. To protect the personal data that we maintain, we may verify your identity when you make a request. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt.

14. How to Contact Us

If you have any questions about how we collect, store and use personal data or to exercise any of your rights set out above, please email us at kyang2124@gmail.com.