WhisperStackSign in

Privacy policy

Last updated [DATE]

Who is responsible

The controller for this website and the WhisperStack app is [LEGAL NAME], [POSTAL ADDRESS], email [EMAIL]. Full details are in the imprint.

What WhisperStack never takes

When you connect a Supabase project, WhisperStack runs only its own fixed aggregate queries through read-only access. Each query returns a total, such as a count of weekly active users. We store those totals, the metric definitions and the weeks they belong to. We do not copy or store rows from your tables, and we do not store the emails or other personal data of your customers. An AI model writes the weekly briefing and alert notes from those totals only; it never sees rows from your tables.

Data we process and why

  • Visiting the website. IP address, browser, time and requested page in server logs, to deliver the site and keep it secure. Legal basis: Art. 6 (1) (f) GDPR. Kept for [RETENTION PERIOD].
  • Waitlist. Your email address, where you signed up and when, so we can invite you. Legal basis: [CONFIRM LEGAL BASIS]. Deleted when you ask us or [RETENTION PERIOD] after the waitlist closes.
  • Account and sign-in. Email address, name, and profile picture if you sign in with Google, plus one-time sign-in codes and a session. Legal basis: Art. 6 (1) (b) GDPR. Kept while your account exists.
  • Connected projects. The access token for your Supabase project, stored encrypted, the project name, and the aggregate totals described above. Legal basis: Art. 6 (1) (b) GDPR. Deleted when you disconnect the project or close your account.
  • Emails. Your email address and the content of pulse emails and alerts, if your plan includes them. Legal basis: Art. 6 (1) (b) GDPR.
  • Payments. Stripe processes your payment details. We keep only a customer reference, your plan and invoice records, for as long as tax law requires. Legal basis: Art. 6 (1) (b) and (c) GDPR.

Cookies and local storage

We set one session cookie when you sign in. It is strictly necessary for the app to work (§ 25 (2) TDDDG). Your light or dark mode choice is kept in your browser's local storage. We use no analytics cookies and no advertising trackers.

Processors

These service providers process data for us under data processing agreements:

  • Vercel Inc.: Hosting of the website and the app, server logs. USA, EU-US Data Privacy Framework and standard contractual clauses.
  • Supabase Inc.: Our application database (accounts, waitlist, aggregate totals). Database region [CONFIRM REGION].
  • Amazon Web Services EMEA SARL (AWS SES): Sending sign-in codes, invites, pulse emails and alerts. EU, region eu-central-1 (Frankfurt).
  • Trigger.dev: Running the scheduled jobs that compute each pulse. [CONFIRM ENTITY AND REGION].
  • Stripe Payments Europe, Limited: Payments and invoices for Pro. Ireland, with transfers to Stripe Inc. (USA).
  • Anthropic: Writing the AI briefing and alert notes from aggregate totals only, never rows from your tables. [CONFIRM ENTITY AND REGION].
  • Google Ireland Limited: Sign in with Google, if you choose it. Ireland, with transfers to Google LLC (USA).

Where data leaves the EU, the transfer relies on an adequacy decision such as the EU-US Data Privacy Framework or on standard contractual clauses.

If you connect your own product

For the aggregate queries we run on your database, we act as your processor. A data processing agreement is available on request at [EMAIL].

Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and you can object to processing based on legitimate interests (Art. 15 to 21 GDPR). Write to [EMAIL]. You can also complain to a data protection authority, for example [SUPERVISORY AUTHORITY].