Privacy Policy

We collect different categories of information depending on how you interact with the Service.

1.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials (password hash or OAuth tokens). If you sign in via Google or Microsoft, we receive your profile information as authorized during the OAuth flow.

1.2 Organization and Team Data

Organization administrators provide organizational structure information including team names, member names, roles, and reporting relationships. This may be entered manually, uploaded via CSV, or synchronized from an HRIS provider (BambooHR, Rippling, Gusto, or Workday).

1.3 Communication Data from Integrations

When your organization connects third-party services, we access the following data:

• Slack — Channel messages, message metadata (timestamps, channels, authors), reactions, thread structure, and workspace user profiles.
• Microsoft Teams — Channel messages, message metadata, meeting attendance and duration, and team membership.
• GitHub — Pull request activity, code review comments, issue discussions, commit metadata, and repository membership.
• Google Calendar — Meeting frequency, duration, attendee lists, and scheduling patterns. We do not access meeting content or attachments.

Communication data is processed to extract behavioral signals and is not stored permanently in its raw form. See Section 2 for details on how this data is processed.

1.4 Usage Data

We collect information about how you use the Service, including pages visited, features used, analysis runs, and API calls. This data is used to maintain and improve the Service.

1.5 Survey Responses

If your organization uses TeamWeaver's survey feature, we collect anonymous survey responses. Free-text responses are encrypted at rest using AES-256-GCM. Responses are de-identified and aggregated at the team level with k-anonymity protections — team breakdowns are suppressed when the number of responses falls below the minimum threshold.

TeamWeaver uses a five-stage pipeline to transform raw communication data into team-level insights:

1. Ingest — Raw data from connected integrations is normalized into a standard event format. We collect metadata (who, when, where, what type) and message content.
2. Extract — Behavioral signals are computed from the normalized events. This includes mathematical metrics (participation distribution, response latency, network centrality), semantic analysis (topic diversity, cognitive diversity), and AI-powered classification (message types, trust language, question frequency).
3. Detect — Pattern detectors combine multiple signals to identify team-level collaboration patterns and potential areas for improvement.
4. Generate — Human-readable insights and structured recommendations are produced from detected patterns.
5. Deliver — Insights are delivered through the dashboard, email briefings, webhook notifications, and the Basil AI coaching interface.

Raw message content is not stored permanently. Message text is held in memory during pipeline processing to extract behavioral features (such as question frequency, trust language indicators, and cognitive diversity markers). Once signal extraction is complete, raw content is discarded. Only the resulting numerical signal values and aggregated metrics are retained.

All insights are produced at the team level. Individual names are never included in insights, recommendations, or briefings. Where individual patterns are referenced, they are anonymized (e.g., "one person on your team").

TeamWeaver uses artificial intelligence for signal extraction, classification, and insight generation. Our AI architecture operates across four tiers:

• Tier 1 (Mathematical) — Statistical computations with no AI involvement (e.g., Gini coefficients, response latency calculations).
• Tier 2 (Embeddings) — Text embeddings for semantic similarity and topic diversity analysis.
• Tier 3 (Classification) — AI classifiers for message type detection, trust language identification, and content categorization.
• Tier 4 (Narrative) — Large language models for generating human-readable insights and coaching responses.

AI processing is subject to per-organization budget controls. Organizations can set daily and monthly spending limits, and all AI usage is tracked and auditable.

We retain different types of data for different periods:

When data is deleted, it is permanently removed from our active systems. Encrypted backups are purged within 30 days of deletion.

We implement industry-standard security measures to protect your data:

• Encryption at rest — Sensitive data is encrypted using AES-256-GCM with per-field encryption. This includes OAuth tokens, API keys, personal information, and free-text survey responses.
• Encryption in transit — All data transmitted between your browser and our servers, and between our servers and third-party APIs, uses TLS 1.2 or higher.
• Authentication — Session management uses cryptographically signed JWT tokens. Passwords are hashed with bcrypt (12 rounds). API keys are stored as SHA-256 hashes.
• Access control — Role-based access control (RBAC) restricts data access based on organizational role (owner, admin, member).
• Infrastructure — The Service runs on Azure Container Apps with managed infrastructure security, network isolation, and automatic patching.
• Audit logging — Security-relevant actions are logged for accountability and incident investigation.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

6.1 Right to Access

You can request a copy of all personal data we hold about you. The Service provides a self-service data export feature available in Settings > Privacy. This export includes your profile information, organization memberships, and chat conversation history.

6.2 Right to Deletion

You can delete your account at any time through Settings > Privacy. Account deletion permanently removes your user profile, revokes all active sessions, and deletes your chat conversation history. Organizational data (team structures, analysis results) is retained under the organization administrator's control.

6.3 Right to Portability

The data export feature provides your data in a structured, machine-readable JSON format that you can take to another service.

6.4 Right to Rectification

You can update your profile information at any time through the Service. Contact your organization administrator to correct organizational data.

6.5 Right to Object

Organization administrators can disconnect integrations at any time, immediately stopping data collection from that source. Individual team members who have concerns about data processing should contact their organization administrator.

6.6 For B2B Customers

TeamWeaver is a business-to-business service. Your organization's administrator controls data collection and processing on behalf of the organization. For questions about how your organization uses TeamWeaver, please contact your organization administrator. For requests that your administrator cannot fulfill, contact us directly at privacy@teamweaver.ai.

We use the following third-party services to operate the platform:

We require all third-party service providers to maintain appropriate security measures and to process data only as instructed by us.

TeamWeaver uses minimal cookies required for the Service to function:

• Session cookie (tw_session) — Identifies your authenticated session. Strictly necessary for the Service to operate. Expires when you sign out or after the session timeout period.
• Authentication cookies — Used during OAuth sign-in flows with Google and Microsoft. Temporary and removed after authentication completes.

We do not use advertising cookies, analytics trackers, or third-party tracking pixels. We do not share browsing data with advertisers or data brokers. We do not participate in cross-site tracking.

The Service is hosted in the United States on Microsoft Azure infrastructure. If you access the Service from outside the United States, your data will be transferred to and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission as the legal mechanism for data transfers. Our third-party service providers maintain appropriate transfer mechanisms for international data flows.

The Service is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify affected users by email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of the Service after changes to this policy constitutes acceptance of the updated terms.

If you have questions about this Privacy Policy or our data practices, please contact us:

We will respond to privacy-related inquiries within 30 days.