wevlo.com.au

Privacy Policy

Last updated: 8 May 2026

WEVLO is built on a simple principle: your data is yours. We collect only what is needed to provide the service, we ask before storing anything personal, and you can delete everything at any time.

Contents

1. Who we are 2. What we collect 3. Why we collect it 4. Health data 5. How we store it 6. Third-party services 7. Your rights 8. Data retention 9. Cookies 10. Children 11. Changes to this policy 12. Contact us

1. Who we are

WEVLO is an AI companion app operated at wevlo.com.au. We are based in Australia and subject to the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs).

For privacy enquiries, contact us at: support@wevlo.com.au

2. What we collect

We collect only the information needed to provide and improve the WEVLO service.

Account information

·Email address — required to create an account

·Name — optional, used to personalise your experience

·Timezone — auto-detected, used for reminders

·Password — stored as a secure hash, never readable by us

Conversation data

·Chat messages you send and receive

·Session titles and timestamps

·File uploads — processed for AI summaries, not permanently stored beyond your session

Memory (with your consent only)

·General preferences and goals — only if you enable general memory

·Health information — only if you separately enable health memory

·Nothing is stored in memory without your explicit opt-in

NDIS data (NDIS tier only)

·Goals, notes, appointments, budget, plan review responses

·Uploaded documents stored in private cloud storage

·NDIS participant number

3. Why we collect it

·To provide the WEVLO service — account creation, authentication, chat

·To personalise your experience using memory you have explicitly enabled

·To send transactional emails — verification, password reset, welcome

·To display accurate times and reminders in your timezone

·To improve the service — aggregated, anonymised usage only

·To comply with legal obligations under Australian law

We do not use your data to train AI models, sell to third parties, or serve advertising.

4. Health data (sensitive information)

Under the Australian Privacy Act, health information is classified as sensitive data and requires explicit consent.

Health data is only stored if you explicitly enable "Health information" in Privacy settings. It is never shared, never used to train AI models, and deletable at any time.

NDIS data is treated as sensitive information. Goals, notes, appointments, budget and plan review data are only accessible to you, protected by row-level database security, and never shared with the NDIA or any third party without your explicit action.

5. How we store your data

·All data is transmitted over HTTPS — encrypted in transit

·Database access protected by Row Level Security — only you can access your data

·Passwords are never stored in plain text

·API keys stored as environment variables, never in code

·Regular automated backups maintained

Our database is hosted by Supabase in Singapore (AWS ap-southeast-1). Supabase complies with SOC 2 Type II and ISO 27001. We plan to migrate to Australian infrastructure as the platform grows.

6. Third-party services

Each service receives only the minimum data needed for their function:

Supabase

Database, authentication and file storage

Data location: Singapore (AWS ap-southeast-1)

OpenAI

AI responses — messages sent to OpenAI API. OpenAI does not use API data to train models.

Data location: United States

Vercel

Web hosting and deployment

Data location: United States / Global CDN

Resend

Transactional email delivery

Data location: United States

Stripe

Payment processing — card details handled directly by Stripe, never seen by us

Data location: United States

Google Places API

Local search — query and approximate location sent when you use local search

Data location: United States

OpenWeatherMap

Weather data — location sent when you request weather information

Data location: United States / Global

We do not use Google Analytics, Facebook Pixel, or any advertising networks.

7. Your rights

·Access — view all data stored about you via /memory and Privacy settings

·Correction — update name, timezone and preferences via Account settings

·Deletion — delete memory items, clear all memory, or delete your entire account

·Export — download all your data as a JSON file from Privacy settings

·Withdrawal of consent — turn off any memory feature at any time

·Complaint — contact us at support@wevlo.com.au

To exercise any right, use the built-in controls or email support@wevlo.com.au. We respond within 30 days.

8. Data retention

·Account data — kept until you delete your account

·Chat history — kept until you delete sessions or your account

·Memory items — kept until deleted individually or account deleted

·NDIS data — kept until you delete your account

·Email logs — kept by Resend for up to 30 days

·Uploaded documents — kept until deleted or account deleted

When you delete your account, all data is permanently deleted immediately. Backups are purged within 30 days.

9. Cookies and tracking

·Session cookies — used by Supabase to keep you logged in. Essential for the app to function.

·No advertising cookies

·No third-party tracking cookies

·No analytics cookies

10. Children

WEVLO is not intended for children under 16. Contact us at support@wevlo.com.au if you believe a child under 16 has created an account.

11. Changes to this policy

·Update the Last updated date at the top of this page

·Send an email notification to all registered users

·Display an in-app notice on your next login

12. Contact us

App: wevlo.com.au

Email: support@wevlo.com.au

Response time: Within 30 days

If not satisfied, contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Privacy settings →Back to Wevlo →