The policy states that personal data is retained only as long as necessary for the described purposes or as required by law, and that upon expiration of that necessity, data will be deleted, anonymized, or securely isolated, with a carve-out for data that cannot be immediately deleted from backup systems.
This analysis describes what Weights & Biases's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision does not specify fixed retention periods for any category of personal data, instead applying a purpose-necessity standard with a backup system carve-out. The absence of specific retention schedules may complicate enterprise customers' data mapping and audit obligations under GDPR and CPRA, which encourage or require specific retention period documentation.
Under this clause, CoreWeave retains personal data for purposes-based periods without specifying fixed timelines, and data held in backup systems may be retained beyond the standard deletion trigger until backup cycles allow deletion. Users may contact privacy@coreweave.com with data retention questions.
Cross-platform context
See how other platforms handle Data Retention Policy and similar clauses.
Compare across platforms →"We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer have a legitimate business need or legal obligation to process personal data, we will delete, anonymize, or securely isolate such data. If deletion is not immediately possible (for example, due to backup systems), the data will be securely stored and isolated until deletion is feasible.Excerpt from Weights & Biases's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification no longer than necessary for processing purposes and recommends that controllers establish specific retention periods.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision does not specify fixed retention periods for any category of personal data, instead applying a purpose-necessity standard with a backup system carve-out. The absence of specific retention schedules may complicate enterprise customers' data mapping and audit obligations under GDPR and CPRA, which encourage or require specific retention period documentation.
Under this clause, CoreWeave retains personal data for purposes-based periods without specifying fixed timelines, and data held in backup systems may be retained beyond the standard deletion trigger until backup cycles allow deletion. Users may contact privacy@coreweave.com with data retention questions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Weights & Biases.