Privacy Policy

Version 2026-10-27.1 · Updated 27 October 2026

DRAFT — owner and professional legal approval required before commercial reliance. Missing details and unverified safeguards are explicitly identified below.

Operator and roles

[OWNER REQUIRED: verified legal entity, registration number, physical address, privacy email, telephone and Information Officer]. WHALE operates from South Africa. WHALE determines processing of account, billing administration and security data. Business customers determine purposes for visitor support conversations; WHALE processes these on their instructions. These roles require confirmation in the customer DPA.

Information and purposes

Email, authentication identifiers, optional Google profile information and organisation membership support accounts and access. Business content, website URLs, FAQs and text-file contents are stored as knowledge sources and chunks with embeddings. Visitor messages, assistant replies, hashed visitor identifiers, timestamps, internal notes and excerpts support responses and customer intelligence. Usage counts and billing identifiers support quotas and subscriptions. Do not submit sensitive information or children’s personal information.

Recipients and AI

Supabase receives account and application records. OpenAI receives knowledge text for embeddings, questions, retrieved context and selected conversation text for customer intelligence. Responses requests disable application response storage with store:false; this does not disable provider abuse-monitoring retention. Google receives authentication traffic when selected. Paddle handles checkout, tax, invoices and payment details as merchant of record. WHALE stores subscription and transaction identifiers, not complete card numbers or CVVs. Hosting and email delivery providers remain to be verified.

Authorisation and international processing

Account processing may rely on contract; security on documented legitimate interests or POPIA justification; statutory records on legal obligation. Customers must identify authority for visitor support and analysis and give their own privacy notice. Consent is used only where genuinely appropriate. Provider regions, transfer assessments and signed safeguards are unverified: no claim is made that international-transfer arrangements are complete.

Retention and deletion

Organisations currently default to 365 days for conversations. New chat expiry follows the organisation retention_days value. Expiry rejects further messages but is not proof of erasure; a verified purge scheduler is still required. Knowledge remains until removed; chunk deletion cascades. Insights and excerpts can retain personal information separately. Backups, logs and Paddle/provider records follow separate schedules still requiring verification. No instant or complete-erasure promise is made.

Rights, requests and complaints

Depending on applicable law, request access, correction, deletion, objection, restriction, portability or withdrawal of consent through [OWNER REQUIRED: verified privacy contact]. We verify identity proportionately and route visitor requests through the relevant business. Do not send identity documents by default. Escalate unresolved South African complaints to the Information Regulator; EU/UK residents may contact their competent authority. Withdrawal does not invalidate earlier lawful processing.

Security and changes

Source code includes organisation-scoped RLS, server-held privileged keys, origin checks and signed widget sessions. Deployed controls and recovery processes require verification. No service guarantees absolute security. Material changes will be communicated through a verified account channel before implementation where required; a new contract acceptance is separate from privacy notice delivery.