← WeLink

WeLink Privacy Policy

Version 2026-10 · Effective 4 October 2026

WeLink is a professional networking app operated by WeLink AI HK Limited ("we", "us"). It introduces people looking for a job referral to people who may be able to give one. This policy explains what we collect, why, who receives it and the choices you have. It is also our Personal Information Collection Statement under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486). Questions: [email protected].

WeLink is for adults only. You must be 18 or over to use it.

What we collect

We do not use advertising identifiers, ad networks or third-party analytics. We do not sell personal data, and we do not use it for direct marketing.

Why we collect it

We use your data to:

The profile details marked as required in the app are needed to use WeLink. Without them we cannot show you to other users or match you. Everything else is optional.

Who can see what

Before a match, any signed-in WeLink user can see your profile card: your initials, headline, job title, bio, skills, verified-skill badges, experience band, industry, the roles you want, target company, location, job-search status, employer category, education level, what you are on WeLink for, your availability grid, your archetype, whether you have uploaded a CV, and your current company if you entered one. Write your bio and headline with that in mind: they are public to other users, and a detail like an employer next to a job title can identify you.

After a mutual match, that person can also see your name, photo, voice introduction, email address and CV. Your messages and coffee chats are visible only to the two people in the conversation.

These limits are enforced by our server's access rules, not just by the app. Your photo, voice introduction and CV are stored at unguessable addresses, and those addresses are kept in a part of your profile that only you and your matches can read.

Your swipes, who you have reported or blocked, your push tokens, your Google token and your Apple token are never visible to other users.

Your archetype

As the last step of setting up your profile, you can take a 20-question test. Each question asks you to choose between two options, and your answers place you on four two-sided scales, giving one of 16 work-style archetypes.

AI features

Some optional features use an AI model: CV suggestions, elevator pitch, outreach drafts, headline drafts, conversation openers, match explanations, referee suggestions and skill quizzes. When you use one, our server sends the text that feature needs to OpenRouter, which passes it to an AI model provider to generate a response. Nothing is sent until you use a feature.

Depending on the feature, that text can include your own profile details, the profile details of the person you are viewing or matched with (including their name once you have matched), what you type into the feature, or the text of your CV when you ask for CV suggestions. A skill quiz sends only the skill name. If a recruiter account ranks candidates for a job, the candidates' names, titles, skills and bios are sent. Google Calendar data is never sent to an AI provider.

AI output can be wrong. Read it before you use it.

Google Calendar

Connecting Google Calendar is optional. If you connect it, WeLink requests:

We store a Google refresh token, the connected Google email address and when you connected, so that Meet links can be created when the other person accepts, which may happen while you are not using the app. No app user, including you, can read this record. Busy times are fetched when you open the availability editor and are not stored.

Limited Use. WeLink's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the scheduling features described above. It is not sold, not used for advertising, not sent to any AI service, not used to train AI models, and not read by humans except with your consent, for security purposes, or where required by law.

You can disconnect Google Calendar at any time in the app's settings, which deletes the stored token and revokes WeLink's access. You can also revoke access at myaccount.google.com/permissions.

Notifications

If you allow notifications, we send them through Expo's push service, which passes them to Apple or Google for delivery to your phone. A message notification contains the sender's first name and up to 140 characters of the message. Match and coffee-chat notifications contain the other person's first name and the proposed time. You can turn notifications off in your phone's settings.

Reports, blocking and unmatching

You can report, block or unmatch anyone. When you report someone, we record who reported whom, the reason you give and any optional details you add. If the report concerns a conversation, we also keep a copy of the most recent messages in that conversation (up to 30), for 12 months, so the report can still be reviewed if the conversation is later removed by a block or unmatch. Reports are reviewed by our team so we can act on breaches of our Terms of Use. The person you report is not told who reported them. Blocking and unmatching are not shown to the other person as such; they simply stop seeing you.

Payments

Premium is bought through the Apple App Store or Google Play. We never see your card details. We use RevenueCat to manage subscriptions: it receives your purchase and subscription status, the store's transaction identifiers and your WeLink account ID (we identify you to RevenueCat by that ID, not by your name or email), and tells us whether you have Premium. We store only that yes/no Premium status on your account.

Crash reporting

We use Sentry to find and fix crashes. A crash report contains technical details of the error, the app version, and your device model and operating system version. We set it up not to include your name, email, profile or messages, and we do not use it to track you.

Service providers and where data is stored

These companies process data for us, only to provide the service. All of them process it in the United States, so your data is transferred outside Hong Kong.

We may also disclose data where Hong Kong law requires it.

How long we keep it

We keep your account data while your account exists, and you can correct most of it in the app at any time. When you delete your account it is removed as described below. Some records sit outside WeLink and follow their own retention:

Deleting your account

You can delete your account at any time in the app under Settings → Delete Account, or by email as described on our account deletion page.

Deleting from the app takes effect immediately. It removes your login, profile, photo, voice introduction, CV, swipes (and your appearance in other people's swipe history), matches, coffee chats, assessment results, push tokens and stored Google and Apple tokens, and revokes WeLink's Google Calendar and Sign in with Apple access. Your conversations are deleted too, including the messages in them from both sides, so the people you matched with no longer see them. Deleting your account does not cancel a Premium subscription; cancel that in the App Store or Google Play. Requests by email are completed within 30 days.

Your rights

Under the Personal Data (Privacy) Ordinance you can ask for a copy of the personal data we hold about you (a data access request) and ask us to correct it (a data correction request). Email [email protected] from the address on your account. We will respond within 40 days, as the Ordinance requires. We may charge a fee for a copy of your data, as the Ordinance allows, and will tell you the amount first. You can view and edit most of your data directly in the app.

If you are unhappy with how we handle your data, please contact us first. You can also complain to the Office of the Privacy Commissioner for Personal Data.

Security

Data is encrypted in transit and at rest by our hosting provider. Server-side access rules decide who can read each record, so private details can only be retrieved by the people entitled to see them. Server credentials such as the AI and Google keys are held only on our servers. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

Changes

If we make material changes to this policy, we will update the version and date above and tell you in the app before they take effect.