Privacy Policy

Last updated: October 6, 2026.

1. Who we are and what this covers

Weave is a product of Green State Restoration, Inc. ("GSR," "we," "us"), a Washington corporation in Monroe, Washington. This policy describes Weave's website and account services. GSR's restoration business and its other websites have their own privacy notices.

Home service companies (each a "Company") use Weave to run referral programs with their partners. The Company decides how to run its program; we handle its program information to provide Weave. The Company's privacy notice may also apply. Contact us even if you have no account but believe your information was entered by a Company or partner.

Some features shown on the website are planned or in development. The section about program features below applies only when those features are available and used. We will review this policy before enabling additional collection, payout providers or mobile services.

2. Information we collect

• Website visits: hosting and security systems may process your IP address, requested page, browser information, time of request and diagnostic records needed to deliver and protect the site. The current website has no advertising pixels or analytics cookies.
• Accounts and sign-up: name, email address, company and role information you provide, account status, and the versions of the Terms and Privacy Policy acknowledged at sign-up.
• Sign-in and security: password hashes, hashed verification and recovery tokens, sign-in attempts, session records, IP address, browser information and times. We do not store a readable copy of your password. Verification emails necessarily contain the code or link you request.
• Communications: contact details and the contents of support, demo, privacy or other messages you send us, and information needed to deliver account emails.
• Program features, when available: Company and partner contacts and roles; referrals, property contacts, addresses, photos, damage reports and job information; building contacts and Emergency Response Plans; reward plans, splits, Warranty Bank entries and payout records. These may come from you, a Company, a partner or an integration authorized by that Company.
• Payments, when available: provider references, permitted last-four identifiers, transaction status and reporting totals. Full bank account, card and tax ID details must be provided through the approved provider's secure process, not through Weave notes, messages or attachments.

3. Cookies and similar storage

We use essential first-party cookies for sign-in, email verification and the extra owner/admin sign-in check. Read the Cookie Policy for each cookie's name, purpose, contents and lifetime, or go to Cookie settings for browser controls.

The current website does not use advertising or analytics cookies, advertising pixels, or cross-site tracking. It does not store legal-page preferences in localStorage or sessionStorage. You can read the public pages without signing in. Blocking essential account cookies can prevent sign-in and verification from working.

4. How we use information

• To deliver the website, create accounts, verify email addresses and provide requested services.
• To protect accounts, limit guessing and abuse, investigate errors and maintain security records.
• To send requested sign-in codes, recovery links and service messages.
• To answer support and privacy requests, and respond to your company's inquiries about Weave.
• When program features are available, to carry out the Company's instructions: manage referrals, show job status, record rewards and Warranty Bank entries, and support approved payout processes.
• To meet applicable legal obligations, resolve disputes and protect people and our services.

5. How information is shared

We do not sell personal information or share it for cross-context behavioral advertising.

• Service providers: Vercel hosts the website; Supabase provides the database infrastructure; Resend delivers account email when configured. They receive the information necessary for those functions. Their handling is also subject to their agreements and applicable privacy notices.
• Program participants: when a program is enabled, Company administrators and authorized users see information permitted by their roles. A Company may move referral information into its own authorized business systems. Public building pages, if enabled, require separate review of what is suitable to make public.
• Payment providers, when enabled: the chosen provider receives information needed to process payments, verify identities and satisfy its own obligations. We will identify that provider and its terms before you submit payment or tax information.
• Legal obligations and protection: where required by law or reasonably necessary to address fraud, security incidents, disputes or threats to people or the service.
• Business transfers: in connection with a merger, sale or reorganization, subject to applicable law and protections for personal information.
• At your direction or with your permission.

6. Information entered by another person

Partners and Companies must have the right to submit information and obtain any required permission before referring someone to be contacted. Submitting a referral is not blanket permission for unrelated marketing. The Company receiving a referral is responsible for its contact practices.

If you were referred, you may contact that Company or use Privacy choices. We may pass a request to the Company where it controls the records. [TO CONFIRM: the contractual and operational restriction on GSR using another Company's referral data for its restoration business.]

7. Email, texts and notifications

We send requested account email such as sign-in codes and password recovery links. If you receive promotional email, use its unsubscribe option or contact us to ask that it stop. Service messages needed to provide a requested account function are handled separately.

Weave does not currently send text messages. Signing up does not by itself consent to marketing texts. Any future text-message or mobile-notification service will need its own appropriate notice, controls and consent before it is used.

8. How long we keep information

We retain information for the purposes described here, taking account of account status, the sensitivity of the information, security needs, disputes and applicable recordkeeping obligations. A browser cookie's expiration does not automatically delete related server records.

You can request deletion or account closure through Privacy choices. Some information may need to remain for legal, payment, tax, audit, fraud-prevention or dispute purposes. Corrections to financial records use additional entries so the transaction history remains intact; this does not mean all personal information must be kept forever.

9. Security

We use access controls, hashed passwords and tokens, and encrypted connections on the production website. Owners and admins must complete both a password and emailed-code check. A new sign-in ends the previous account session. These controls reduce risk but do not guarantee complete security. We will provide notice of a personal-information breach when applicable law requires it.

Never send us your password, sign-in code, full bank or card number, tax ID or identity document in an ordinary support or privacy email.

10. Your choices and rights

You can ask to access, receive a copy of, correct or delete your personal information, or to close your account. Use Privacy choices for the email address, phone number and request instructions. You do not have to be signed in. We may verify your identity and authority, and may involve the Company that controls the program's records.

Depending on the law that applies, you may have additional rights, including portability, restriction or objection to certain processing, an authorized-agent request or an appeal. We will respond within applicable legal deadlines and explain any limitations. We will not discriminate against you for exercising applicable privacy rights.

Because we do not sell personal information or share it for cross-context behavioral advertising, there is currently no such activity for a Global Privacy Control signal to opt out of. The current website has no advertising or analytics tracking for Do Not Track to disable. Essential account cookies remain necessary for requested sign-in functions.

11. Children

Weave's accounts are intended for business users aged 18 or older. We do not knowingly collect personal information from children under 18. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

12. Where information is processed

We operate from the United States. Our service providers may process information in the United States and other countries where they operate. Their locations depend on the service used; we do not limit all processing and storage to the United States.

13. Changes to this policy

We will update the date and document version when this policy changes. We will provide additional notice or obtain consent for changes when applicable law requires it. A new policy does not itself authorize new optional tracking or unrelated uses of information.

14. Contact

Green State Restoration, Inc., Monroe, Washington.

Email: info@greenstaterestoration.com. Phone: (425) 300-6431.

[TO CONFIRM: the postal notice address. GSR's sites list both 16642 146th St SE, Suite 101 and 14253 169th Dr SE, Suite 773, Monroe, WA 98272. Confirm the designated privacy contact before publication.]