Privacy Policy

Effective October 1, 2026

This Privacy Policy explains what information DataWhisperer collects, how we use it, who we share it with, and the choices you have. It applies to the DataWhisperer website at datawhisperer.co and any related services (the "Service"). The data controller is DataWhisperer LLC("DataWhisperer", "we", "us", "our"). For privacy or data-rights requests, see Section 12 — the contact form works on every plan, with or without an account.

The short version

We collect only what we need to run the Service and bill you.
We don't sell your data and we don't use your uploaded files to train AI models.
You can delete your files — and your account — at any time.
DataWhisperer is decision support, not decision-making. AI output can be wrong — verify the numbers before sharing or acting.

1. Information we collect

Account information

DataWhisperer uses its own email-and-password account system. When you sign up, we collect your email address and a password (stored only as a cryptographic hash — we never store your password itself). If, while exploring the research samples without an account, you enter the email address required to unlock them, we collect that address; it is treated the same as an account email under this policy.

Billing information

When you subscribe to a paid plan, Stripe collects and stores your payment details in its hosted checkout. We do not receive or store full card numbers — we store a Stripe customer ID and billing metadata (plan, subscription status, last 4 digits, etc.) returned by Stripe.

Your uploaded data

When you upload a file, we store parsed data, metadata (column types, row count, filename, timestamps), your analysis questions and saved results in managed PostgreSQL. The exact original file bytes are stored separately in private App Storage; the database holds their storage reference and metadata. Original-file downloads check account ownership. This is "Your Data" as described in our Terms.

Usage and technical data

We collect basic technical data automatically: IP address, browser type, pages visited, actions taken in the app, and timestamps. Product analytics records content-free events, such as actions, outcomes and plan information, rather than uploaded rows or question text. Browser identifiers and signed-in user IDs can connect events to an account; content-free does not mean anonymous. This is separate from the files, results and messages stored to provide the Service. We use technical and usage data for security, debugging and improvement.

The website and server-rendered guide pages also include Google Analytics code. Analytics is configured on datawhisperer.co and www.datawhisperer.co. When configured, Google can receive page views and usage events, page URLs and referrers, browser and device information, and analytics identifiers. Network requests also expose technical information such as IP address to Google. URLs and referrers can contain personal or confidential information; these events should not be assumed to be anonymous.

Messages you send us

When you open a support ticket (two-way, on every paid plan), send Feedback (signed-in accounts, one-way), or use the Questions? chat (any plan, AI), we store your message and the context attached to it (page URL, optional file reference) so we can reply or follow up. When you use the public contact form, we store your message, email address and any name you provide, so we can handle the request and reply by email.

2. How we use your information

Provide and operate the Service (Brief, Ask, computed Tables, supported Stats, and read-only data-quality checks).
Authenticate you and keep your account secure.
Process payments and manage subscriptions.
Send guides when you subscribe to guides, and product tips, usage reminders, offers and retention follow-ups only with separate product-email permission.
Respond to your support requests and feedback.
Detect and prevent fraud, abuse, and security incidents.
Improve the Service by analyzing usage patterns and product outcomes.
Comply with legal obligations.

Guide subscriptions do not opt you into product emails. Both are optional and never required to start Free. You can change either choice in account email preferences or unsubscribe from that category's emails. Requested result or reminder links, verification, password resets and essential billing notices do not require marketing permission.

We do not use Your Data to train AI models — ours or anyone else's. We do not sell your personal information.

3. Who we share information with (sub-processors)

We rely on a small number of trusted third-party providers to run the Service. They only process your data on our behalf, under contract, for the purposes listed below.

StripePayment processing, subscription management, invoices

ResendAccount and billing email, requested links, and permission-based guide and product email

OpenAIAI processing of your uploaded file data to generate briefs and answer questions

PostHog (when enabled)Product analytics using browser identifiers and signed-in user IDs; session recording and automatic interaction capture are disabled

ReplitApplication hosting, infrastructure and private App Storage for original uploaded file bytes

Neon (PostgreSQL)Database hosting

Separately, the website includes Google's Google Analytics code for website usage measurement. When analytics is configured, Google receives the usage and technical information described in Section 1. See Section 9 for its browser-storage behavior.

Public result links

If you create a share link, anyone with the link can read the shared result without signing in, copy it, and forward the link to others. A shared result does not expose the entire raw file or provide an original-file download, but it can include questions, dataset names, labels, figures and result text that reveal sensitive information. Review the result before sharing. Revoking a link stops future access through that link; it does not recall copies, screenshots or downloads already made by recipients.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of DataWhisperer, our users, or others.

4. AI processing

When you request AI-assisted analysis or use Questions?, relevant context (such as column structure, computed summaries, selected rows or text, your question and conversation history) is sent to OpenAI for processing. OpenAI processes the request and returns a response. Per OpenAI's API terms, content sent through their API is not used to train OpenAI models. We don't send Your Data to OpenAI for any purpose other than answering your specific request.

AI output is decision support, not decision-making. Briefs and Ask answers can be wrong, incomplete, or out of date. Outputs are designed to cite numbers from your file so you can verify them — please do, before quoting externally or acting on the result. Certain categories of decisions — medical, legal-case, and named-personnel decisions — are prohibited and require a qualified professional, not this Service; see our Terms for the full disclaimer.

5. Data retention

Files: retained until you delete them or close your account.
Account data: retained while your account is active; some records may need to remain after closure for billing, security or legal obligations.
Billing records: retained as required by applicable tax and accounting laws.
Backups: may retain copies of deleted data according to the infrastructure providers' retention and deletion processes.
Logs: retained for operational, security and legal needs. Contact us for information about a specific deletion request; we do not promise a fixed backup or log deletion window here.

6. Your choices and rights

Depending on where you live (e.g. EEA/UK under GDPR, California under CCPA), you may have rights to:

Access the personal information we hold about you.
Correct inaccurate information.
Delete your information ("right to be forgotten").
Export your information in a portable format.
Object to or restrict certain processing.
Withdraw consent where processing relies on consent.

To export your data, go to Settings → Account and choose "Download my data" for a JSON export. Where an original file is available, the export includes an owner-only download link rather than embedding its bytes in the JSON. You can delete individual files from the Files page, or delete your entire account from Settings → Account.

For access requests beyond the export, correction, objection or restriction requests, or help exercising any privacy right, use our contact form. The form also accepts legal and account-deletion requests, without an account or a paid plan. Paid-plan support tickets are a separate channel for product issues; they are not required to exercise privacy rights.

7. Security

We use industry-standard measures to protect your data: encryption in transit (HTTPS/TLS), encryption at rest for database and backup storage, scoped access controls, and passwords stored only as salted cryptographic hashes. No system is perfectly secure — if you ever suspect your account has been compromised, contact us immediately.

8. International transfers

Our sub-processors are primarily based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. We rely on our service providers to process information across these locations. Contact us for information about the safeguards applicable to your data; this policy does not claim a certification or a specific contractual transfer mechanism.

9. Cookies and similar technologies

We use cookies to keep you signed in and maintain guest sessions. We also use local and session storage for product analytics identifiers and attribution. When PostHog analytics is enabled, it uses local storage and cookies and can identify signed-in users by user ID. These analytics identifiers are distinct from authentication cookies.

The Google Analytics tag is loaded in the website and server-rendered guide pages, including on other hostnames, but its analytics configuration is limited to datawhisperer.co and www.datawhisperer.co. When configured, Google Analytics may set analytics cookies or use similar browser storage; actual behavior depends on Google's configuration and browser settings. We do not use third-party advertising cookies. Stripe may set its own cookies as part of payment processing — see Stripe's privacy policy for details.

10. Children

DataWhisperer is not directed at children under 16, and we don't knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we'll delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date at the top and, where appropriate, notify you in the app.

12. Contact

For privacy questions or to exercise your rights, you can reach us at:

Privacy, data-rights, account-deletion and legal requests: use the public contact form on any plan, or without an account.
Product issues: sign in and open a support ticket from the sidebar (included on every paid plan). This paid product-support channel is separate from privacy and legal requests.
Contact form (legal and privacy matters included): datawhisperer.co/contact

You do not need a DataWhisperer account or a paid plan to exercise your privacy rights through the contact form. Privacy rights are honored regardless of plan.

Home · Help · Contact