Privacy Policy

Weftia is a brand owned by Kanodi LLC. In this policy, “Weftia”, “we”, “us” and “our” refer to Kanodi LLC in connection with the Weftia services.

This policy explains how personal information is handled when you:

• visit the Weftia website or contact our team;

• use the designer dashboard and business tools, including as an invited team member;

• visit or buy through a designer storefront hosted by Weftia; or

• use the Weftia customer mobile app and marketplace to discover designers, arrange appointments, buy pieces, view orders or receive updates.

It covers both custom-made and ready-to-wear experiences, including clothing, bags and shoes. It also explains our role when designers use Weftia to keep information about clients who do not have their own Weftia account.

Company: Kanodi LLC

Registered jurisdiction: Wyoming, United States

Business mailing address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States

Privacy enquiries: [email protected]

For information we use to manage our relationship with you—such as your Weftia account, our subscription billing, support enquiries and the operation of our marketplace—Kanodi LLC acts as a data controller. This means we decide why and how that information is used.

Designers and other businesses using Weftia make their own decisions about their client relationships and business records. Where a designer instructs us to store and manage their client details, measurements, appointments, orders, invoices or team records, the designer acts as the controller and we act as their data processor, handling that information on their behalf.

A designer may also act as an independent controller when receiving information to fulfil an order or booking made through the marketplace. Their own privacy notice explains how they use information for their business. Our policy covers Weftia’s handling of that information; it does not replace the designer’s notice.

If your request concerns a record held on a designer’s behalf, you can contact that designer. You may also contact us so we can identify the relevant business and assist with the request. We remain responsible for responding to requests about processing we control ourselves.

The information involved depends on how you use Weftia and which features a designer uses.

Account and contact information — Information you give us to create or manage an account, such as your name, email address and login details; business contact details supplied by a designer; information supplied when a business invites a team member.

Designer and storefront information — Business information, catalogue entries, product images and contact details that a designer adds to their workspace or chooses to display in their storefront.

Client and measurement records — Client contact details, body measurements, custom measurement fields and information relevant to a commission, entered by a designer or supplied by the client.

Billing and transaction records — Designer subscription records, invoices, amounts paid, outstanding balances and transaction references generated through the services or supplied by designers and payment services.

Team and work records — Employee invitations, access permissions, assigned tasks, daily reports and leave records entered by a business or its team members.

Support and communications — Messages you send us, the information needed to respond and any newsletter or communication preferences you provide.

Notification and analytics information — Information processed through Google Firebase to deliver notifications and analyse use of Weftia.

Camera and photo content — Images you take or select using the app’s camera and photo-library features.

Technical information — Limited application-error, system-performance, device or browser information, security events and technical logs collected to operate, secure, monitor and improve the service.

Some information comes from a designer rather than directly from you—for example, when a designer records your measurements or invites you to an appointment. A team administrator may also supply information when inviting you into a business workspace.

If information is needed to create an account or carry out a requested transaction, we will identify it when we collect it. Without that information, we may be unable to provide the relevant service. We identify optional fields when requesting information.

Measurements and information requiring particular care — Measurements and commission details can be personal information. Please avoid including unrelated medical details or other sensitive information in messages or free-text fields.

Payment information — Weftia uses Stripe and Paystack for payment services. See Stripe’s Privacy Policy and Paystack’s Privacy & Cookie Policy. The provider involved in a transaction handles payment information in connection with that payment and may also process information for its own regulatory, security and fraud-prevention responsibilities.

We use information to provide the features you choose, communicate with you and administer Weftia. The purposes and legal bases for processing we control where UK or EEA data protection law applies are summarised below.

Create and administer your own Weftia account and provide the service you request — Account, contact and service records. Legal basis: Performance of our contract with you, or steps you request before entering a contract.

Administer a business account through its employees or representatives — Business contact, invitation and permission records. Legal basis: Legitimate interests in providing and administering the business’s service.

Operate your marketplace account and facilitate requested bookings and purchases — Account, booking, order and related communications. Legal basis: Performance of our contract with you, for the platform functions necessary to deliver it. The designer is responsible for establishing the basis for its own processing.

Administer designer subscriptions and payments due to Weftia — Subscription, invoice and payment records. Legal basis: Performance of contract; legal obligations for records we must keep.

Respond to questions and provide support — Contact, support and relevant account records. Legal basis: Performance of contract for account support; legitimate interests in answering general enquiries and resolving problems.

Protect accounts, investigate misuse and maintain reliable services — Relevant account, transaction and technical records. Legal basis: Legitimate interests in protecting users and the service; legal obligations where specifically applicable.

Deliver app notifications — Relevant app/device identifiers and notification content. Legal basis: Performance of contract for requested service updates; consent where required for optional notifications.

Understand use of Weftia through optional analytics — App/usage events and related identifiers. Legal basis: Consent where required for non-essential analytics.

Send optional marketing communications — Contact details and communication preferences. Legal basis: Consent where required by applicable privacy and marketing rules.

Comply with applicable obligations and handle legal claims — Records relevant to the obligation or claim. Legal basis: Legal obligation or legitimate interests in establishing, exercising or defending claims, as appropriate.

Where processing relies on consent, you can withdraw it without affecting processing that was lawful before withdrawal. We consider your rights and expectations when relying on legitimate interests.

Designers and their teams. When you contact, book with or buy from a designer, information relevant to that interaction is made available to that business. Team access depends on the permissions within its workspace.

Public storefront visitors. Information a designer chooses to publish in a storefront, such as their business description and product listings, is visible to visitors. Take care when publishing personal contact details or images of other people.

Service providers. We use Microsoft Azure for hosting, Google Firebase for notifications and analytics, Bunny.net for image storage, and Stripe and Paystack for payments. Cloudflare is also among our technology providers. Providers may handle information on our behalf or, for activities such as meeting their own legal obligations, act independently under their own privacy notices.

Image storage. Images uploaded to Weftia are stored using Bunny.net. Images may contain personal information, such as a person’s photograph. We use this storage to support the image features of our services. See Bunny.net’s Privacy & Data Policy for its own privacy information.

Legal and professional recipients. We may disclose relevant information where necessary to meet a legal obligation, respond to a valid legal process, obtain professional advice or establish or defend legal claims.

Business changes. If Kanodi LLC considers or completes a merger, sale or restructuring involving Weftia, relevant information may be disclosed to the parties and advisers involved, subject to applicable privacy requirements. We will explain a material change in the organisation responsible for your information.

We use Google Firebase for notifications and analytics. We collect limited technical and usage information to operate, secure, monitor and improve Weftia. This may include application errors, system performance information, device or browser information, security events and technical logs.

Monitoring technologies necessary for the operation, reliability and security of Weftia may operate without optional analytics consent where permitted by law. We also use optional analytics technologies to understand how people interact with Weftia and improve the product.

Where consent is required for non-essential analytics or cookies, we do not activate those technologies until you have provided consent. You may reject optional analytics without losing access to Weftia’s core functionality.

You can change your analytics or cookie preferences through the available preference controls. You may also contact [email protected] for help with your choices or withdrawing consent.

Camera, photos and other permissions — The Weftia app requests camera and photo-library access for its image features. You can review these permissions in your device settings. Refusing or withdrawing access may prevent the relevant camera or photo feature from working.

The app does not request access to your location or contacts.

Weftia supports communications relating to accounts, bookings and orders. Service messages about an action you have taken are distinct from optional promotional messages.

You can contact [email protected] to withdraw consent to Weftia marketing or object to its use of your information for direct marketing. This does not prevent necessary communications about your account, security or transactions.

Giving a designer information for an order does not by itself amount to permission for unrelated marketing. When a designer sends their own marketing, their privacy notice and the applicable choices govern that use.

Kanodi LLC is registered in the United States. Weftia’s core application infrastructure and databases are hosted using cloud service providers, including Microsoft Azure. Where reasonably possible, systems containing UK and European customers’ personal information are hosted in UK or European data centres.

Some third-party providers may process information outside the United Kingdom or European Economic Area, including in the United States. UK or European hosting of our core systems does not mean every provider processes information only in those locations.

Where required by applicable data protection law, we use recognised safeguards for international transfers. Depending on the transfer, these may include applicable adequacy decisions or regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses.

You can contact [email protected] for information about the safeguards relevant to your information and how to obtain a copy, subject to appropriate redaction.

How long we keep information — We retain personal information only for as long as necessary to provide the service, meet legal and regulatory obligations, maintain security, prevent fraud, resolve disputes and enforce agreements. Different categories of information may be retained for different periods.

Invoices, payment records and other accounting or transaction information may be retained for up to seven years where necessary for tax, accounting or legal purposes. This is not a blanket retention period for all personal information. A specific legal obligation or legal claim may require particular records to be retained for longer; we limit that retention to the relevant records and purpose.

Where businesses using Weftia create invoices for their own customers, those businesses are responsible for determining the appropriate retention period under applicable law. Where we hold these records on a business’s behalf, we handle them in accordance with its lawful instructions and the applicable processing agreement, except where law requires otherwise.

Account deletion and subscription cancellation — When you request account deletion, we remove or anonymise the personal information scheduled for deletion from active production systems without undue delay and within 30 days of receiving your request, or sooner where required by applicable law, subject to the specific retention exceptions explained in this section. Anonymised information must no longer identify you; simply disabling an account or replacing a name with an identifier is not the same as anonymisation.

This 30-day commitment does not replace the rules governing statutory privacy requests. For UK/EEA erasure requests, we respond without undue delay and normally within one calendar month of receipt. One calendar month is not always the same as 30 days. We erase information without undue delay where the right applies; where a lawful exception or permitted extension applies, we explain it within the applicable deadline.

Some information may remain after account deletion where necessary to comply with legal obligations, maintain financial or accounting records, prevent fraud, resolve disputes, or establish, exercise or defend legal claims. We retain only information needed for those purposes, rather than treating an exception as a reason to retain the whole account indefinitely.

Cancelling a designer subscription removes access to the dashboard. Cancellation is separate from account deletion. You can still contact [email protected] about your personal information or to request deletion.

Backups, recovery systems and restricted records — Deleted information may remain temporarily in encrypted backups, disaster-recovery systems, security logs or other restricted archives. Backup copies are retained according to our backup schedules and automatically deleted or overwritten as part of the normal backup lifecycle. Security logs and other archives have purpose-specific retention schedules; they are not automatically covered by the backup cycle.

Where a valid erasure request applies and no exception permits retention, backup data awaiting scheduled overwriting is put beyond use and is not used for another purpose. Information held solely in backups is kept out of routine use. Access is restricted to necessary disaster recovery, security or legal-compliance purposes. If a backup containing previously deleted information is restored, we take reasonable steps to reapply the relevant deletion or anonymisation before returning that information to ordinary use.

Third-party providers — Providers processing personal information on our behalf are required to handle, delete or return it in accordance with their contractual obligations and applicable data protection law. Some providers may retain limited information for their own legally required periods or in backups until those backups expire.

Our backup arrangements include encryption and restricted access, as described above. Please protect your account credentials and avoid including passwords or full payment-card details in support messages.

No online service can guarantee absolute security. If you believe someone has accessed your account without permission, contact us at [email protected].

Depending on the law that applies and our role in the processing, you may have rights to access your information, correct it, request deletion, restrict or object to processing, receive a portable copy, or withdraw consent.

You may object at any time to the use of your personal information for direct marketing. You may also have a right to object to processing based on legitimate interests, taking your circumstances into account.

To make a request, contact [email protected] and tell us what you would like to do. We may need proportionate information to verify your identity or an authorised representative’s authority. Please do not send passwords or full payment-card details. A request about records we hold on a designer’s behalf will be handled with that designer; a request about our own processing will be handled by Kanodi LLC.

For requests covered by UK/EEA data protection law, the usual response period is one month. Applicable law can permit an extension for complex or multiple requests; we will explain an extension within the required period. If we cannot fulfil a request, we will explain why and any available complaint route.

You may complain to the UK Information Commissioner’s Office at ico.org.uk or, in the EEA, to the supervisory authority in the country where you live or work, or where an alleged infringement occurred. You do not have to contact us first.

Where an applicable state privacy law covers our processing, residents may have additional rights to know/access, correct or delete information, obtain a portable copy, and opt out of specified sales, targeted advertising or certain consequential profiling. Some laws provide rights relating to sensitive information, authorised agents and appeals. Applicable rights depend on the state and the processing involved. We will not unlawfully discriminate against you for exercising them.

To ask about or exercise a right available to you, contact [email protected]. If an applicable law gives you a right to appeal our decision, you can use the same address to request a review and identify the decision you are appealing. We will explain the outcome and any applicable route for contacting your state regulator.

Adult accounts and purchases for children — Weftia accounts and direct use of the app and account-based services are for people aged 18 and over. Children must not create their own accounts or purchase through an account of their own.

A parent, guardian or appropriately authorised adult may use their own account to buy clothing, bags or shoes, or arrange a designer appointment, for a child. The adult is the purchaser and manages payment, messages, appointments, approvals and any return or complaint. The child is the recipient of the product or service, not the Weftia account holder. Adults should not give children their login credentials to use the service independently.

Information about a child supplied by an adult or designer — Designers may keep limited information about a child where necessary to carry out work arranged by an appropriately authorised adult. For example, a custom order may require measurements and relevant fitting details. A ready-to-wear purchase will ordinarily need the selected size and the adult’s contact and delivery information, rather than a separate child profile.

Adults supplying a child’s information must have appropriate authority to do so. The designer is responsible for establishing a lawful basis for the information they control, providing appropriate privacy information and meeting any additional requirements for sensitive information. Where Weftia processes records on the designer’s behalf, we do so under the designer’s lawful instructions; we remain responsible for processing we control ourselves.

Only information needed for the agreed work should be recorded. Unnecessary dates of birth, school details and direct contact details for a child should not be entered. Measurements, fitting notes and any necessary fitting photographs are private order or client information: access must be limited to authorised people who need it for the work. They must not be made public or reused for advertising or profiling as part of ordinary order fulfilment. Any separate proposed use requires its own assessment and appropriate authority, permissions and safeguards.

Rights, retention and underage accounts — Children’s information is subject to the retention and deletion rules described in this policy. Financial-record retention does not by itself justify keeping a child’s measurements or fitting photographs for the same period.

A child retains their own privacy rights. Where a parent, guardian or another representative contacts us or the designer about those rights, we may need to confirm their authority and consider the child’s rights and circumstances before acting.

If you believe a child has created an account, is using an adult’s account independently, or that a child’s information has been handled inappropriately, contact [email protected] so we can investigate and take appropriate action.

Weftia includes a feed. We do not currently provide recommendations or AI scanning.

Designers and external services may provide their own privacy notices for processing they control. Read those notices when using their services. This does not remove Kanodi LLC’s responsibilities for information it processes or discloses.

We may update this policy to reflect changes in Weftia or applicable requirements. The policy shows its last-updated date above. Where a change requires further notice or consent, we will provide that notice or request consent as required; continued use alone does not replace required consent.

Kanodi LLC — Weftia

Privacy email: [email protected]

Mailing address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States