Privacy Policy

The controller responsible for processing your personal data is:

We collect the following categories of data:

• Identification data: first name, last name, email address;
• Connection data: IP address, login dates and times, technical logs;
• Usage data: conversations, generations (images, videos, music), Whale and Flow configurations;
• Payment data: billing information processed by our provider Stripe (we do not store card numbers);
• Credit data: transaction history and credit consumption.

Your data is processed for the following purposes:

Exception: Google user data. Data received from Google APIs (Gmail, Google Calendar, Google Drive) is used only to provide or improve the Whalli and Whalli Bot features you use. It is never used for marketing communications or for any other purpose listed above. See section 6.

Your data is retained for the duration of your subscription, then for 3 years from account closure for proof and legal compliance purposes.

Google user data is not subject to this 3-year retention: it is deleted as described in section 6, and at the latest when your account is deleted.

Payment data is retained in accordance with accounting legal obligations (10 years).

Generated content (images, videos, etc.) is retained while your account is active. You can delete it at any time.

Your data may be shared with the following sub-processors, in compliance with the GDPR:

• Stripe — payment processing (USA, standard contractual clauses);
• AI model providers (OpenAI, Anthropic, Google, Mistral, etc.) — processing user requests (prompts are transmitted to the APIs of the selected providers);
• OpenRouter — routing requests to AI model providers (USA, standard contractual clauses);
• Neon / hosting provider — data storage;
• Minio / object storage provider — storage of generated files.

We never sell your data to third parties for commercial purposes.

If you connect your Google account to Whalli or Whalli Bot (Account page → Linked accounts, or Profile → Integrations in Whalli Bot), Whalli accesses some of your Google account data through Google APIs, with the consent you give on Google's authorization screen. Each service (Gmail, Google Calendar, Google Drive) is authorized separately: you can connect just one. Plain "Sign in with Google" only uses your name, email address and profile picture.

Whalli uses Google user data only to provide and improve the user-facing features of Whalli and Whalli Bot that you use, as described below. It is not used for any other purpose.

Permissions requested and how we use them

• gmail.readonly — search and read your emails (sender, subject, date, content) when you ask the assistant (e.g. "do I have unread emails?") or when an automation you set up reads emails, and find the email to reply to;
• gmail.send — send an email or a reply from your Gmail address, at your request or through an automation you set up;
• calendar.events.owned — list the events on your primary calendar (title, times, location) to answer questions about your schedule, and create, update or delete events on it at your request. Calendars shared with you by others are not accessible;
• drive.readonly — search your files by name, read a file's content (Google Docs exported as text, Sheets as CSV) and import a file you pick into your Whalli file library as an attachment;
• drive.file — create a new file in your Drive (e.g. generated notes or a report), at your request.

When we access it

Only when you ask for it in a conversation (the assistant then calls the matching Gmail, Calendar or Drive tool), when you import a file from the Google Drive picker, or when an automation or scheduled task that you created yourself runs. Whalli does not scan, index or sync your mailbox, calendar or Drive in the background.

Storage and retention

• OAuth tokens (access token and refresh token): stored in our database with the linked account and used only to call Google APIs on your behalf. They are kept until you disconnect the Google account or your Whalli account is deleted.
• Content accessed: Whalli does not keep a copy of your mailbox, calendar or Drive. Results returned in a conversation (a list of emails with excerpts, events, the content of a file that was read) are saved with that conversation's history, and an automation's results in its run history. They are kept until you delete the conversation, the automation or your account.
• Files imported from Google Drive: a copy of the file is saved in your file library (object storage) and kept until you delete it from the library or your account is deleted.
• Account deletion: deleting your Whalli account erases your linked Google accounts, tokens, conversations, automations and their run history, and your file library.

Sharing

• AI model providers: to answer your request, the retrieved content (e.g. the email or file that was read) is sent, together with your message, to the provider of the AI model you selected (OpenAI, Anthropic, Google, Mistral, DeepSeek, etc.), through our model router OpenRouter, solely to generate the response or carry out the action you asked for. Once you have linked a Google account, your requests are only routed to model hosts that neither retain prompts nor use them to train models. Your Google user data is not sent to any other AI service: while a Google account is linked, speech and transcription are not offered to the assistant or to automations, and the assistant's web search uses regular search engines.
• Hosting and storage: the sub-processors listed in section 5, to store the data described above.
• We do not sell your Google user data and do not transfer it to any other third party, except where required by law.

What we don't do

• We do not use your Google user data for advertising, including targeted advertising, or to build advertising profiles.
• We do not use your Google user data for our marketing communications, or for any purpose other than providing or improving the features you use.
• We do not use your Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• No one at Whalli reads your Google user data, except with your explicit consent (e.g. for a support request), when needed for security purposes (investigating abuse), or to comply with the law.
• We do not create aggregated or anonymized datasets from your Google user data.

Data protection

• All traffic between your device, Whalli, Google and AI model providers is encrypted in transit (HTTPS/TLS).
• OAuth tokens are kept server-side, in a database that is not exposed to the internet. They are never sent to your browser or to AI model providers.
• Access to production systems is restricted to authorized Whalli personnel.

Revoking access

• In Whalli: Account page → Linked accounts (or Profile → Integrations in Whalli Bot), then "Disconnect". Disconnecting in Whalli revokes Whalli's access with Google and deletes the stored tokens.
• At any time from your Google account: Google Account › Security › Third-party apps & services (myaccount.google.com/connections).

Revoking access does not erase conversations or files already imported: delete them in Whalli or write to us at hello@whalli.com.

Limited Use

Whalli's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Some of our sub-processors (notably AI model providers and Stripe) are based in the United States. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Article 46 GDPR.

Under the GDPR, you have the following rights:

• Right of access (Art. 15);
• Right to rectification (Art. 16);
• Right to erasure (Art. 17);
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20);
• Right to object (Art. 21).

To exercise your rights, contact us at hello@whalli.com. We will respond within one (1) month. For more details, see our GDPR page.

For more information on cookies, please see our Cookie Policy.

For any question relating to the protection of your data: hello@whalli.com

You may also lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr