Privacy policy clauses for Weaviate
Weaviate is an open-source vector database that stores and searches AI-generated vector embeddings alongside metadata. Websites use it to enable semantic search, recommendation systems, and AI-powered features by converting text and data into machine-readable vectors for fast retrieval.
Free scan · No signup · Results in 60 seconds
What data Weaviate collects
Your privacy policy must disclose each of the following data types when you use Weaviate.
When does Weaviate trigger privacy obligations?
Installation & Data Flow
The moment you deploy Weaviate—whether self-hosted or via Weaviate Cloud—you begin ingesting and storing vector embeddings. These embeddings are mathematical representations of text, images, or other content. The critical compliance trigger: if your source documents contain personal data (names, emails, user IDs, behavioral patterns), those embeddings encode that personal data, even though it is compressed and non-human-readable. This activates GDPR Articles 4(1) (definition of personal data) and 5(1)(a) (lawful processing basis) immediately.
Jurisdiction & Regulation
GDPR applies if: You process data of EU residents, regardless of where Weaviate runs. Weaviate B.V. is EU-based (Netherlands), so if you use Weaviate Cloud, Weaviate is your processor under GDPR Article 28, requiring a Data Processing Addendum (DPA).
CCPA applies if:
