WekLoop Privacy Policy

Current Version: 1.5.0 Last updated: 7 November 2026

This Privacy Policy explains how WekPlug Innovations, based in Kitwe, Zambia, collects, uses, stores, and protects personal data when you use the WekLoop mobile application, website, and WekLoop Assistant, in accordance with Zambia's Data Protection Act, 2021.

1. Scope and Age Assurance

WekLoop is designed exclusively for adults aged 18 years or older. During onboarding, we verify age eligibility using the date of birth you provide. We record the verification result, timestamp, and verification method without retaining unnecessary sensitive identification records.

2. Information We Collect

Guest Browsing: When you browse as a guest, the app maintains a pseudonymous session along with your local onboarding state, selected topic interests, theme preferences, and playback settings.

Account Information: When you register or sign in using Google, email and password, or phone verification, we process your verified account identifier, email address, phone number, username history, display name, biography, profile photo, and account security logs. Passwords are managed securely by our authentication provider and are never stored in plain text.

Device, Notification, Security, and Diagnostic Information: When the relevant features are enabled, we process device and app information, IP-derived security records, user-agent information, timestamps, push-notification tokens and delivery metadata, and crash or diagnostic reports. We use this information to authenticate requests, deliver notifications, detect abuse, investigate failures, and maintain service reliability. We do not use precise device location unless a feature clearly asks for it and you grant the required permission.

Content and Social Activity: We process videos, captions, thumbnails, audio selections, originality and AI disclosures, comments, voice comments, Direct Messages and message metadata, LIVE stream interactions, likes, saves, follows, blocks, safety reports, moderation appeal records, and message-privacy or read-receipt settings. Direct Message content is processed to deliver conversations, enforce safety controls, apply privacy settings, and support read-status features. Local projects created in WekStudio remain on your device until you choose to publish them.

Viewing and Discovery Signals: To power WekMOTION and WekSense discovery, we process video impressions, watch duration, completion rates, skips, engagement actions, and topic preferences in accordance with your personalization settings.

Business and Creator Transactions: When you use Creator Studio or the Advertiser Center, we process organization details, campaign creatives, budget and billing records, payment references, creator program applications, and payout details. For WPP, we may also process legal name, date of birth, a masked and hashed identity-document number, identity-document images, current residence declarations, residence evidence, document dates and types, verification decisions, reviewer audit records, payout-beneficiary checks, and risk signals such as suspected duplicate documents, VPN/proxy use, or inconsistent country signals. Nationality, phone number, profile country, GPS, and IP address alone are not treated as proof of current Zambia residence.

3. How We Use Personal Data and Your Choices

We process personal data to authenticate and secure accounts, deliver video feeds and LIVE streams, support creator tools, enforce our Community Guidelines, prevent fraud, fulfill statutory obligations, and respond to data subject requests.

You can manage your privacy preferences at any time in Settings and the Legal and Privacy Center, including toggling personalized recommendations, personalized advertising, marketing communications, and analytics diagnostics, or resetting your recommendation history. Disabling personalized recommendations or analytics stops those signals from being used for personalized ranking and clears the associated WekMOTION personalization state as implemented by the service.

4. WekLoop Assistant

When you ask a question in WekLoop Assistant, your prompt, recent conversation context, relevant policy passages, and necessary account status details are processed to generate an accurate response. Signed-in assistant messages are retained for up to 30 days unless you delete the conversation earlier. Guests may use the Assistant without signing in; guest prompts are processed to answer the request but are not saved as an account conversation. Guest rate-limit and service-usage records use a pseudonymous daily subject derived from the request IP and are retained only for the service's abuse-prevention and usage-accounting period. Do not submit passwords, financial credentials, or sensitive personal identification documents to the Assistant.

5. Service Providers and Infrastructure

WekLoop relies on service providers to operate the platform. Firebase Authentication verifies sign-in identities; Firebase Cloud Messaging delivers enabled push notifications; and Firebase Crashlytics may receive crash and diagnostic information when diagnostics are enabled. Supabase-hosted PostgreSQL stores structured application records through WekLoop's authenticated server API; the mobile app does not receive direct database credentials. Cloudflare R2 stores and delivers uploaded media. Lenco processes enabled payment transactions and references. Google Gemini processes the limited assistant prompt and context described above when WekLoop Assistant is enabled.

WPP identity and residence evidence is stored in a restricted private Cloudflare R2 area using encrypted transport and storage encryption. Ordinary moderators do not receive evidence-file access. Specifically authorized platform administrators receive only short-lived, no-store review links, and evidence views and decisions are audit logged.

We disclose information to these providers only for the relevant service purpose, and may disclose information when required by law, to protect users and the platform, or as part of a properly governed business transfer. Provider processing may occur outside Zambia depending on the configured service region and provider infrastructure. We do not sell personal data.

6. Data Retention and Deletion

Account and content records are generally retained while your account remains active. Feed interaction events are scheduled for cleanup after 90 days, and assistant conversation logs after 30 days. WPP identity and residence evidence is initially scheduled for deletion no later than 365 days after upload; after a final verification approval or rejection, the evidence is scheduled for deletion within 180 days. The service separately retains limited verification status, masked identifiers, document hashes, decisions, and audit records where needed to prevent fraud, administer WPP, meet financial or legal obligations, or resolve disputes. Financial, fraud-prevention, moderation, consent, and audit records may be retained longer where necessary for legal, security, accounting, or dispute purposes.

When you submit an account deletion request through the Legal and Privacy Center, WekLoop records the request for verification and processing. The request screen or confirmation does not by itself prove that every copy has already been erased. You will be informed through the available contact route when processing is complete or if limited information must be retained.

7. Your Rights Under Zambian Law

Under Zambia's Data Protection Act, 2021, you have the right to be informed, request access to and export of your personal data, correct inaccurate profile details, request erasure of your account, object to direct marketing, and lodge a complaint with the Office of the Data Protection Commissioner of Zambia.

8. Security and Updates

We employ encrypted transport, role-based access controls, authenticated media uploads, and continuous security monitoring to safeguard your information. Whenever we make material updates to this Privacy Policy, we update the Last updated date and notify users in the app.