Privacy

What we collect, why we collect it, who receives it, and how long we keep it. Access to weaponeer.io is granted to an approved entity and to named individuals at that entity, so a large part of what we hold is the record of that approval. That record is kept longer than your account, and this page says so plainly. It is not legal advice.

Who runs it, and who it is for

Operator: weaponeer.io. Privacy requests go to admin@weaponeer.io.

The Service is sold to approved organizations and to verified individual U.S. Persons acting in a professional capacity. A Foreign Person is considered only as set out in the Access Eligibility policy. It is not offered to unidentified purchasers, and it is not offered to or directed at individuals under 18. There is no self-service signup. Who may hold a seat is set out in that policy.

Categories of personal information we collect

• Account and identity data. Your name, email address, a password hash, whether the address has been verified, your role on this install, which entitlements are on, any evaluation expiry, and the organization and seat state your account inherits.
• Entity and onboarding data. Submitted on an access request, and depending on the route claimed: the legal entity name, country and state of organization, registered and operating addresses, website, tax and registration identifiers including CAGE or UEI, disclosed beneficial owners at or above 25%, any foreign ownership, control or influence, the described intended use, the requesting official’s own name, title, business email and phone, and the specific statements affirmed at submission. Where eligibility is claimed under a DD Form 2345, the CAGE code and the certification expiry date. A declined request is kept as a record; it is not discarded.
• Individual eligibility data. Where a person applies as an individual U.S. person rather than through an organization: the type of government-issued document relied on, its issuing state or authority, its expiry date, and the last four characters of the document number. We do not collect or store the full document number, and we do not store an image of the document. The document itself is shown on a live video call and is not stored. What we retain from that is the determination recorded in the approval memo.
• Named-seat data. For each seat: full legal name, business email, position, a declaration of U.S. Person status, and the record of how that status was determined — the determination recorded in the approval memo. We store the determination, not an image of your identity document.
• Restricted-party screening data. The queries we run against government denied-party lists — the subject name and country for the entity, each disclosed beneficial owner and each named seat — and the full result, the lists searched, the number of hits, and the written human adjudication of each hit.
• Document-acceptance records. When you accept the Terms, the Access Eligibility policy, the Acceptable Use Policy and the Disclaimer, we record your user id, your email address stored alongside it, your organization, which document, its version, a SHA-256 hash of the exact acknowledgment text you were shown, the timestamp, your IP address and your user agent. The hash is what lets us show later precisely what wording you agreed to.
• Technical and session metadata. Session records with the IP address and user agent captured at sign-in, expiry and refresh times, rate-limit counters, and the IP address and user agent recorded on an access request, a contract request and a bug report. The host uses the country associated with the connecting IP at the edge to decide whether to serve the site. We do not store that country, a geolocation, a network provider, or a device fingerprint.
• Support and billing data. Contract and invoice requests (organization, the entitlement asked for, an optional note, a contact address); a log of transactional email we attempted (recipient, subject, template, delivery status and any provider error); and bug reports (your comment, the page you were on, browser details, recent console errors, and a workbench snapshot only if you ticked that box).
• Content you submit. Saved setups: a name plus the JSON snapshot of workbench state — payloads, surrogate, scene, catalogue edits. Setups are scoped to your account and every query for them is filtered to the signed-in user.

Why we collect it

Operating the Service and keeping your saved work; authenticating you and keeping the account secure; billing and collecting payment; answering support and fixing what you report; and export-compliance screening, eligibility determination, access control and recordkeeping.

That last purpose is why we keep session metadata. IP address and user-agent are retained for export-compliance purposes: they are how we evidence that a named, screened person accessed the Service, and they are the evidence we would have to produce if a voluntary disclosure were ever filed. The country used to decide whether to serve a request is evaluated at the edge and is not stored. We do not derive a stored geolocation, device fingerprint, or network-provider record from the IP. We do not use them to profile you or to advertise.

Who receives it

We use a small number of service providers, each for one job. We do not sell your information to any of them and none of them may use it for their own purposes.

• Vercel — hosting and delivery of the application, including the country associated with the connecting IP used at the edge to decide whether to serve the request.
• Our Postgres provider — the managed database where everything described above is stored.
• Resend — transactional email to you (address confirmation, password reset). Resend receives the recipient address and the message.
• Polar — not used for payment. Access is sold by invoice. Card checkout is not offered, so Polar does not receive a card or act as merchant of record.
• Microsoft 365 — the operator mailbox. Mail addressed to a weaponeer.io inbox (an access request, a contract request, a bug report) is delivered through it, which means the contents of that notification pass through Microsoft.
• U.S. government Consolidated Screening List — restricted-party screening, queried at trade.gov, operated by the International Trade Administration. The query includes the subject’s name and country, for the entity, each disclosed beneficial owner and each named seat.

We also disclose information where the law requires it, to a government agency exercising authority over the Service or over an export matter, and to professional advisers under a duty of confidence.

How long we keep it

• Account and profile data — for as long as the account exists, then removed on deletion.
• Saved setups — until you delete them, or until the account is deleted.
• Sessions — until they expire or you sign out; removed with the account.
• Email delivery log — kept for support and deduplication; rows addressed to your address are removed when the account is deleted.
• Compliance records — onboarding files and access requests including declined ones, screening results and their adjudications, U.S. Person determinations and seat history, document acceptances, and the access and acceptance logs that go with them: a minimum of five years, and they survive deletion of the account.

The five-year floor is not a preference. If the operator is or becomes a registrant under 22 C.F.R. Part 122, § 122.5 requires those records to be kept for five years, and a record we deleted on request is a record we cannot produce. So the compliance record is deliberately segregated from the customer-facing data model: it does not hang off your user row by a cascading foreign key, and an acceptance stores your email address alongside the reference to your account precisely so the row still identifies who accepted after the account is gone. Deleting a user cannot reach it.

Deletion, and your choices

Settings → Delete account asks for your current password, then removes your profile data and saved setups — the user record, its sessions and credentials, every setup you saved, and the email-log rows addressed to you. Bug reports and contract requests you filed stay, detached from your identity.

It does not remove the compliance record: the access request your entity submitted, the screening runs and adjudications, the U.S. Person determination on your seat, your document acceptances, or the access logs tied to them. Those exist to evidence a regulated access decision and we are required to be able to produce them. Deleting your account also does not by itself end your entity’s subscription or its other seats — an authorized official has to ask for that.

You can correct your name in Settings. Email is the named seat and cannot be changed there; a new address is a new seat, requested and approved. You can export or delete individual setups from the workbench at any time.

California notice at collection

For California residents under the CCPA as amended by the CPRA, the categories above map to identifiers, customer records, professional and employment information, internet and network activity (IP address and user-agent), and — in the citizenship or status declaration collected for a named seat — information that may be treated as sensitive personal information. We collect it for the purposes named above and for no other, and we do not use sensitive personal information to infer characteristics.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have never done so. There is no advertising, no ad network, and no third-party tracker on this Service.

You have the right to know what we hold and how it is used, to have it deleted, to correct it, and not to be discriminated against for exercising any of those rights. Make a request to admin@weaponeer.io from the address on your account; we verify identity by confirming control of that address and, where the request touches entity or seat records, by confirming with an authorized official at your organization. We answer within the statutory period.

A deletion request is subject to the compliance carve-out above. Retention required to comply with a legal obligation is an exception the statute recognizes; we will delete everything the exception does not cover and tell you specifically what was retained and why.

Security

We apply commercially reasonable administrative, technical and physical safeguards: access is granted only to screened named seats, passwords are stored hashed, operator credentials held in the database are stored encrypted, sensitive values are stripped from bug reports before they are sent, sign-in and account-change endpoints are rate limited, and admin functions are decided on the server rather than by a flag the browser can set.

If we become aware of a security incident affecting your personal information, we will notify you and, where required, the relevant authority, without undue delay and with what we know at the time. No safeguard is perfect, and we do not warrant that the Service is free of vulnerabilities.

Where the Service is offered

The Service is not a consumer offering. It is not marketed to the public in the European Union or the United Kingdom, we do not price in their currencies, and we do not monitor behaviour there to advertise. Data is stored and processed in the United States. A named seat for a person in those countries is considered only as set out in the Access Eligibility policy: through an organization, under a cooperative program, and only with the U.S. government approvals that program requires. That is not a consumer checkout.

Cookies and local storage

One cookie: the session cookie set by our authentication layer when you sign in. It is strictly necessary — without it there is no way to stay signed in — so there is nothing to consent to and no banner.

There are no analytics, advertising, or third-party scripts on this Service, and our email templates carry no images and no tracking pixels. The workbench does keep your current working state in your browser’s local storage so a reload does not lose it; that copy stays on your machine and only reaches us when you save a setup. An Enterprise On-Prem copy keeps working state on your machine and does not send it here. Your acceptance of the Terms and the other required documents is not a browser flag — it is recorded on the server as described above, which is the only form of it that is evidence of anything.

Changes and contact

If we change this page materially we will bump the version below and tell account holders. Questions, requests and complaints go to admin@weaponeer.io. Related pages: Terms, Access Eligibility, Acceptable Use, and the Disclaimer.

Version 1.7 · Effective 2026-09-11