Privacy Policy

1. Who We Are

WeFlair LLC ("WeFlair", "we", "us", "our") is a B2B growth marketing agency. Our registered address is 131 Continental Dr, Suite 305, Newark, DE 19713, United States. We are headquartered in Valencia, Spain, and operate as a remote-first team with a distributed workforce. We serve clients primarily in the B2B SaaS, B2B tech, e-commerce, and professional services sectors globally.

For the purposes of applicable data protection law (including the EU General Data Protection Regulation 2016/679 ("GDPR"), UK GDPR, and the California Consumer Privacy Act ("CCPA") as amended by the CPRA), WeFlair LLC is the data controller of the personal data described in this policy.

Our primary contact for privacy matters: steven@weflair.co

2. Data We Collect

2.1 Information you give us directly

• Contact enquiries: Name, business email address, company name, and a description of your marketing challenges or project brief submitted via our contact form.
• Newsletter / lead magnet sign-ups: Email address and (where provided) first name when you subscribe to our content.
• Gated content downloads: Email address and (where provided) company name when requesting case studies, playbooks, or the resource pack.
• Booking a call: When you book via cal.com/weflair, Cal.com collects your name, email, and calendar availability on our behalf.

2.2 Information collected automatically

• Usage data: Pages visited, time spent, scroll depth, click interactions, referral source, browser type, operating system, and approximate geographic location (city/country level, derived from IP address).
• Device data: Screen resolution, device type (desktop/mobile/tablet), language settings.
• Cookies and similar technologies: Session identifiers, persistent analytics cookies, and marketing pixels. See Section 6 for details.
• IP address: Collected temporarily for security and analytics purposes. We do not store raw IP addresses beyond what our analytics tools retain.

2.3 Information from third parties

• Sortlist Radar: If you visit our Sortlist profile and are referred to our website, Sortlist may share referral and profile-view data with us.
• LinkedIn / Meta / Google Ads: If you click a paid advertisement, the respective ad platform shares anonymised conversion data with us. We do not receive your personal profile data from these platforms.
• Factors.ai: Our intent-data and visitor identification tool may enrich visitor data with company-level firmographic information derived from IP address (e.g., company name, industry, estimated size). This is B2B intent data and typically does not constitute personal data under GDPR, but we disclose it here for full transparency.

3. How We Collect It

4. Why We Process Your Data (Legal Basis)

We only process personal data where we have a lawful basis. Under GDPR/UK GDPR, those bases are:

For California residents, the above purposes correspond to the CCPA categories of "business purposes" and do not constitute "selling" or "sharing" personal information for cross-context behavioural advertising beyond what is described in Section 6.

5. Third-Party Tools & Processors

We use the following sub-processors and third-party services. Each processes data only on our behalf and under contractual obligations consistent with applicable data protection law:

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website. Below is a summary of the cookie categories we use:

You can control or disable cookies through your browser settings. Disabling analytics or marketing cookies will not prevent you from using the website. For EU/UK residents, non-essential cookies are only activated following your consent where a consent mechanism is deployed.

To opt out of Google Analytics across the web, you can install the Google Analytics Opt-out Browser Add-on.

7. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

• Contact form submissions: Retained for up to 3 years to allow us to follow up and maintain a record of client enquiries. Submissions are stored in Netlify Forms and, where applicable, exported to our CRM.
• Email marketing subscribers: Until you unsubscribe or request deletion. We honour unsubscribe requests within 10 business days.
• Analytics data: Aggregated and anonymised data may be retained indefinitely. Individual-level analytics data is subject to the retention settings of the respective tool (Google Analytics default: 14 months).
• B2B intent / firmographic data: Subject to the retention policies of Factors.ai and Sortlist. WeFlair does not independently store raw visitor-level intent data beyond what appears in those platforms.
• Financial/billing records: Retained for 7 years in accordance with US tax and accounting regulations.

When data is no longer required, it is securely deleted or anonymised.

8. Your Rights

EU & UK residents (GDPR / UK GDPR)

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to restriction of processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive a copy of data you provided to us in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests (including direct marketing). We will stop unless we have compelling legitimate grounds.
• Rights related to automated decision-making: We do not use solely automated decision-making that produces legal or similarly significant effects on individuals.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email steven@weflair.co with the subject line "Data Subject Request". We will respond within 30 days (extendable by 2 further months for complex requests). We may need to verify your identity before actioning your request.

You also have the right to lodge a complaint with your local supervisory authority. In the EU, this is your national data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

California residents (CCPA / CPRA)

If you are a California resident, you have the following additional rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to delete: Request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell personal information. We do not share personal information for cross-context behavioural advertising beyond standard ad-network pixels described in Section 6.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email steven@weflair.co with "CCPA Request" in the subject line. We will respond within 45 days (extendable by an additional 45 days where reasonably necessary).

9. International Data Transfers

WeFlair LLC is based in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, your personal data will be transferred to and processed in the United States.

We rely on the following safeguards for such transfers:

• EU-US Data Privacy Framework: Where our processors are certified under the EU-US Data Privacy Framework (DPF), we rely on that adequacy decision.
• Standard Contractual Clauses (SCCs): Where DPF certification is not available, we use the European Commission's Standard Contractual Clauses as the transfer mechanism.
• UK International Data Transfer Agreements (IDTAs): Used for transfers from the UK where applicable.

All major processors listed in Section 5 (Google, Meta, LinkedIn, Netlify, Cal.com) are either DPF-certified or operate under SCCs.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• HTTPS encryption across all pages of the website
• Netlify Forms honeypot and reCAPTCHA spam protection on our contact form
• Access controls limiting who within WeFlair can access personal data
• Contractual data protection obligations with all sub-processors

No method of internet transmission or electronic storage is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify relevant supervisory authorities and affected individuals in accordance with applicable law.

11. Children's Privacy

Our website and services are directed exclusively at business professionals and are not intended for, nor do we knowingly collect personal data from, children under the age of 16 (or 13 in the United States). If you believe we have inadvertently collected data from a minor, please contact us at steven@weflair.co and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we do, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. For material changes, we will make reasonable efforts to notify you (for example, by posting a prominent notice on our website or, where we hold your email address, by sending you a notification).

Your continued use of our website after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related enquiries within 10 business days and to complete data subject requests within the applicable statutory timeframe (30 days for GDPR, 45 days for CCPA).