Privacy Policy

1. Scope

This Policy applies to all visitors, registered users, and paid subscribers of the Service. It should be read together with our Terms of Service, Disclaimer, Refund Policy, and Cookie Policy.

2. Information We Collect

We collect the following categories of personal information:

a) Information you provide:

• Account data: email address and display name; if you sign in with Google, your Google profile name and avatar. Authentication and passwords are handled by our identity provider (Google Firebase Authentication) — we do not store your password.
• Billing data: payment confirmation and subscription status from Stripe. Billing name, address, and card details are collected and held directly by Stripe under its own terms; we do not collect or store your billing address or full payment card numbers.
• Communications: messages you send to support, survey responses, and content you submit.

b) Information collected automatically:

• Usage data: features used, pages viewed, indicators accessed, session times, clickstream.
• Device and technical data: IP address, browser type, operating system, device identifiers, approximate location derived from IP.
• Cookies and similar technologies (see Section 9).
• Referral/attribution: a referral code if you arrive through a referral or affiliate link.

c) Information from third parties:

• Authentication providers (if you sign in via a third-party login), affiliate/referral partners, and analytics providers.

We do not intentionally collect special categories of data (e.g., health, biometric, racial or ethnic data) and ask that you do not submit such data to us.

3. How We Use Your Information

We use personal information to:

• create and administer your account and provide the Service;
• process subscriptions, billing, renewals, and refunds;
• provide customer support and respond to requests;
• send service/transactional messages (e.g., trial reminders, renewal notices, security alerts);
• send marketing communications where permitted and with consent where required (see Section 8);
• maintain security, prevent fraud and abuse, and enforce our Terms;
• analyze and improve the Service;
• comply with legal obligations and respond to lawful requests.

4. Legal Bases for Processing (EU/UK – GDPR)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract: to provide the Service and process your subscription.
• Legitimate interests: to secure, analyze, and improve the Service, and to prevent fraud (balanced against your rights).
• Consent: for non-essential cookies and certain marketing communications. You may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, and other laws.

5. How We Share Information

We share personal information only as follows, and we do not sell your personal information:

• Service providers / processors: payment processors, cloud hosting and database infrastructure, market-data providers, analytics, email delivery, and customer-support tools, acting under contract on our behalf.
• Legal and safety: to comply with law, enforce our Terms, or protect the rights, property, or safety of WhaleClues, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent.

6. International Data Transfers

We are based in Canada, and your information may be processed in countries other than your own. For transfers of personal data from the EEA or UK, we rely on the European Commission's adequacy decision recognizing Canada's protection for personal data processed by commercial organizations under PIPEDA, and, where that adequacy decision does not apply, on Standard Contractual Clauses (SCCs) or equivalent safeguards.

7. Data Retention

We retain personal information for as long as your account is active. After your account is closed, we retain your personal information for up to 5 years for legal, dispute-resolution, and record-keeping purposes, after which it is deleted or anonymized — except where a longer retention period is required by applicable law (for example, tax and accounting records, which Canadian law generally requires to be kept for approximately six years), in which case we retain those specific records for the legally required period.

8. Marketing & Anti-Spam (incl. CASL)

We send commercial electronic messages only where permitted by law. For users in Canada, Canada's Anti-Spam Legislation (CASL) applies: we send commercial emails based on express or implied consent, identify ourselves clearly, and include a working unsubscribe mechanism in every commercial message. You can opt out of marketing emails at any time via the unsubscribe link or by emailing [email protected]. Opting out of marketing does not stop essential service/transactional messages.

9. Cookies and Similar Technologies

We use strictly necessary cookies to operate the Service, and (with consent where required) analytics and preference cookies. EU/UK visitors are shown a cookie consent banner allowing them to accept or reject non-essential cookies. See our Cookie Policy for details and controls.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. To exercise them, email [email protected]; we will verify your identity and respond within the time required by applicable law.

a) EU / UK (GDPR): access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing (including direct marketing); withdrawal of consent; and the right to lodge a complaint with your supervisory authority (e.g., your national Data Protection Authority or the UK ICO).

b) Canada (PIPEDA): access to and correction of your personal information; withdrawal of consent (subject to legal/contractual limits); and the right to complain to the Office of the Privacy Commissioner of Canada.

c) California (CCPA/CPRA): the right to know/access; delete; correct; opt out of "sale" or "sharing" of personal information (note: we do not sell or share personal information as defined by the CCPA/CPRA); limit use of sensitive personal information; and non-discrimination for exercising your rights. You may use an authorized agent to submit requests.

We honor all legally mandated rights even where not listed above.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information (e.g., encryption in transit and access controls); authentication and passwords are managed by our identity provider (Google Firebase Authentication). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Children's Privacy

The Service is intended for adults. We do not knowingly collect personal information from anyone under 18 (or under 16 in the EU/UK). If you believe a minor has provided us data, contact [email protected] and we will delete it.

13. Third-Party Links and Services

The Service may link to or integrate third-party sites and tools (e.g., payment processors, social platforms). Their privacy practices are governed by their own policies, not this one.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by posting the updated Policy with a new "Last Updated" date and, where required, by additional notice. Continued use of the Service after changes take effect constitutes acceptance.