W

Privacy Policy

This policy explains how Whystle collects, uses, and shares your personal data when you use our website and personal assistant.

What we collect

• Your name, phone number, email, and the chat accounts you text Whystle from.
• Your messages, files, and calls through Whystle, its replies, and what it remembers.
• Cards, bank details, and passwords you save on Whystle's secure pages, encrypted.
• Your sign-ins on the websites Whystle uses for you.
• Who invited you and whom you invite.
• Server logs: time, page, status, and account ID. The site sets one sign-in cookie and no trackers.

We use it to provide and improve Whystle's features, keep it secure, and contact you about your account, based on our agreement with you, your consent for Google, and our interest in keeping Whystle secure and reliable. We don't sell your data, show ads, or train AI models on it.

Google data

If you connect Google:

• Gmail: Whystle searches and reads the emails a request is about. It sends or drafts the emails you ask for, archives, labels, or moves to Trash the mail you name, and unsubscribes you from the lists you name. It keeps attachments you ask it to save. It checks the sender, subject, and opening lines of new emails to tell you about ones you'd want to know, such as a delayed flight. It never deletes mail permanently.
• Calendar: Whystle reads your calendars and events, and adds, changes, or deletes an event or answers an invite when you ask.

Google data is used to provide and improve these features. It passes through Composio, which connects to Google and holds your Google tokens, and the AI model providers that read it to answer you. Our message providers deliver replies that contain it, and our search providers receive searches drawn from it. When a task you ask for needs a detail or file from your email, the website, business, or person it is for gets it, through our browser, phone, or email providers. We share Google data with no one else except for security or the law, and our team reads individual Google-derived content only when you ask us to or security or the law requires it.

To improve reliability, the AI records broad failure categories during existing tasks. Our team sees only anonymized statistics combined across accounts, with added statistical noise. These statistics contain no messages, names, or individual reports and remain after account deletion.

We keep no copy of your mailbox or calendar: only Whystle's replies, short notes of what it found, attachments you asked it to save, and a record of each action it took (the recipient or count, and the subject). Card, ID, and password numbers are filtered out of emails before an AI model reads them.

Whystle's use and transfer to any other app of information received from Google APIs, including data derived from it, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Disconnect at any time in your Google Account; access stops at once.

Who gets your data

• The websites, businesses, and people Whystle contacts for you.
• Message and SMS delivery providers.
• AI model providers, directly or through routing services.
• Composio: Google connection.
• Browser, phone call, and web search providers.
• Our payment processor.
• Ad platforms: click IDs and hashed signup details, to measure our ads.
• Amazon Web Services: hosting in Frankfurt and email intake in Ireland.
• Authorities, when the law requires it.

Our AI routing account excludes providers listed as training on paid data. Each provider's own terms also apply.

Some providers process data outside the EU, including in the US, under Standard Contractual Clauses; ask us for a copy or for the current list of providers.

Security and retention

Data travels encrypted, and only our team can reach our servers. Closing your account stops ordinary messages and new tasks immediately. We aim to remove ordinary account data within 72 hours and report the outcome within one calendar month. Backup copies stay isolated until scheduled expiry, and deletion records prevent a restored backup from reopening your account.

We keep server logs for 14 days, a minimal deletion receipt for 12 months, verification and Admin session metadata for 30 days, and a contact digest until you explicitly rejoin. Required company accounting records are kept for seven years from the relevant financial-year end. Specific evidence needed for a legal claim or binding preservation request is held separately until its recorded expiry or release condition, with review at least every 90 days. We tell you about applicable exceptions and any unresolved exported copies. We do not keep a general account archive for possible future police requests.

Your rights

You can access, correct, delete, or get a copy of your data, restrict or object to how we use it, and withdraw your consent, such as by disconnecting Google. Ask Whystle or email us. You can also complain to your data protection authority.

Contact

Whystle is operated by LOLSEO OÜ ("we", "us"), the controller of your personal data. For privacy questions or requests, email support@getwhystle.com, or text Whystle.