WhereTheyTalk Privacy Policy

Account Information

When you register, we collect your email address and a password (handled via Supabase Auth) and any other details you provide (such as name or organization). Purpose: To create and manage your user account, authenticate you, and provide our services. Legal Basis: Performance of a contract – we need this data to provide the Service you signed up for (GDPR Art. 6(1)(b)).

Contact and Support Data

If you join a waitlist, subscribe to updates, or contact us for support, we collect your email and any information you choose to provide in your request. Purpose: To communicate with you, send you service-related emails (e.g. confirmations, updates), and respond to inquiries. Legal Basis: Your consent (for waitlist/newsletter sign-ups) or our legitimate interest in providing customer support (GDPR Art. 6(1)(a) or 6(1)(f), as applicable).

Service Usage Data

When you use WhereTheyTalk, we collect data about your interactions with the platform. This includes features you use, search queries or keywords you monitor, and logs of user actions. Purpose: To operate and personalize the Service (e.g. show relevant results), to maintain security, and to improve the platform's features. Legal Basis: Performance of contract (for providing core service features) and legitimate interests (to secure and enhance the Service) – GDPR Art. 6(1)(b) and 6(1)(f).

Analytics Data

We use analytics tools (PostHog) to automatically collect technical information about your device and usage when you interact with our web app. This may include your IP address (which we may anonymize), browser type, pages viewed, and click events. Purpose: To understand user behavior, debug issues, and improve our product's usability. Legal Basis: Your consent, which we obtain via our cookie banner (GDPR Art. 6(1)(a)). We do not run analytics unless you have allowed analytics cookies.

Cookies and Similar Technologies

We use cookies to remember your session and preferences, and to collect analytics (with consent). Purpose: Some cookies are strictly necessary for the Service to function (for example, the authentication cookie that keeps you logged in). Other cookies (like those for analytics) are optional and used only if you consent, in order to help us improve the product. Legal Basis: For necessary cookies, our legitimate interest in providing a functioning service (these do not require consent under ePrivacy laws as they are essential). For analytics cookies, consent (GDPR Art. 6(1)(a)). (See Cookies section below for more detail.)

Providing the Service

We use account and profile data to create your account, authenticate you, and enable you to use WhereTheyTalk's core features. This processing is necessary to perform our contract with you as a user of the Service (Art. 6(1)(b) GDPR). Without this information, we can't provide you with an account or the Service functionality.

Communication

We use your email to send critical notifications (for example, email verification, password reset, essential product updates, or administrative messages). The legal basis is contract necessity (to provide support and inform you of issues with the Service) and/or our legitimate interests in ensuring effective customer service (Art. 6(1)(f) GDPR). If you signed up to our waitlist or newsletter, we send you updates based on your consent (Art. 6(1)(a)); you can unsubscribe any time.

Analytics and Product Improvement

If you consent, we use analytics data (via PostHog) to understand how our users engage with features. This helps us identify trends or problems and improve the platform. The legal basis for analytics is consent (Art. 6(1)(a)), as indicated by your choice on the cookie banner. You can withdraw consent at any time via the cookie settings, and we will stop collecting your analytics data. We ensure that any analytics data we collect is pseudonymized and does not directly identify you (PostHog can be configured to avoid capturing personally identifiable information).

Security and Abuse Prevention

We may process certain data (like IP addresses, log-ins, and user activity logs) to maintain the security of our service, troubleshoot access issues, and prevent misuse of the platform. The legal basis for this is our legitimate interest (Art. 6(1)(f)) in protecting our Service and users, as well as compliance with legal obligations related to security. For example, we might log IP addresses to detect multiple failed login attempts (to guard against fraud or hacking).

Legal Compliance

In rare cases, we may need to process or retain personal data to comply with a legal obligation, such as a law enforcement request or tax/legal record-keeping requirements (Art. 6(1)(c) GDPR). We only do so when required by law and will inform you if permitted.

Supabase (Supabase Inc.)

We use Supabase as our cloud database and authentication provider. Supabase stores all the data that backs our Service – this includes your account information (email and hashed password), content you generate within the app (like saved searches or settings), and other metadata. Supabase also provides the authentication cookies and session management for logging you in. Our Supabase database is hosted in an EU data center (for example, in eu-west-1) to keep data within Europe. Supabase, as a company, is based in the U.S., but we have signed their Data Processing Addendum (DPA) to ensure GDPR compliance. This means Supabase is contractually bound to protect your data, and if any transfer of data to the U.S. occurs (for maintenance or support), it will be under EU Standard Contractual Clauses or equivalent safeguards.

PostHog (PostHog, Inc.)

We use PostHog for product analytics. PostHog helps us understand how users navigate our application (e.g., which features are most used). We have configured PostHog in a privacy-friendly manner: we do not send it any personal identifiers like your name or email, and we respect the cookie consent (PostHog only runs if you've agreed to analytics). We have opted to use PostHog's EU cloud infrastructure whenever possible, meaning analytics data is stored on servers in Frankfurt, Germany. PostHog is GDPR-compliant and offers features to anonymize data. If PostHog data is ever processed outside the EU, it will be protected via Standard Contractual Clauses. You can opt out of PostHog analytics at any time through the cookie settings, as noted above.

Mailjet (Pathwire/Sinch)

We use Mailjet to send out transactional emails and other communications (for example, verification emails, password reset emails, or any email notifications you opt into). When we send you an email, your email address and the email content go through Mailjet's platform. Mailjet is an email service based in the EU (France) and stores data on servers in the European Union (in Frankfurt, Germany and Saint-Ghislain, Belgium). Mailjet is fully GDPR-compliant and does not access or use your email data except as needed to send messages on our behalf. We have a DPA in place with Mailjet as well. According to Mailjet, your contact lists and personal data remain confidential and are not disclosed to third parties.

No selling of data

We do not sell, rent, or exchange your personal data with any third-party for marketing or any other purposes. The only instances where we share your data are with the service providers listed above, and each of those is acting on our instructions (as "data processors") to support our Service delivery.

Legal disclosures

We might have to share personal data if required by law or lawful requests by public authorities (e.g., to comply with a court order or regulatory requirement). In such cases, we will only share the minimum data necessary and, if possible, inform you of the request.

Business transfers

If in the future WhereTheyTalk or Perjan Professional Product Partners FlexKapG undergoes a business transaction (such as a merger, acquisition, or asset sale), user data could be transferred to a successor or new owner. If that happens, we will ensure the new owner has to respect the same privacy commitments described in this policy, and we will notify you of any change in data control.

International data transfers

Our primary operations are based in Austria, and we aim to store personal data in the European Union whenever feasible. For instance, as noted, our databases and email servers are EU-hosted. However, some of our service providers are companies located outside the EU (e.g., Supabase and PostHog are headquartered in the United States). This means personal data may be accessed or processed in countries outside the European Economic Area (EEA).

Whenever we transfer or allow access to your personal data outside the EEA, we take appropriate safeguards to ensure it remains protected. These safeguards include: (1) ensuring the recipient is in a country with an EU adequacy decision (if applicable), or more typically, (2) signing the European Commission's Standard Contractual Clauses (SCCs) with the non-EU service provider, which contractually require them to protect your data to EU standards. We also rely on measures like data encryption and pseudonymization where possible when transferring data.

For example, Supabase and PostHog are both subject to SCCs and robust encryption protocols in transit and at rest. PostHog additionally allows EU-only event storage which we utilize. Mailjet's data stays in the EU, so no cross-border transfer is involved in that case.

If you'd like more information about our international data transfer safeguards, feel free to contact us (see the Contact Us section below). We will happily provide you with further details, such as copies of relevant contractual clauses upon request.

Account Data

We retain your account information (like your email and profile info) for as long as you maintain an account with us. If you delete your account or request deletion, we will remove or anonymize your personal data within a reasonable timeframe (unless we are required to keep it for legal reasons – see below). Backup copies of data might persist for a short period (due to routine backup and archiving), but will be overwritten or destroyed in the normal course of business.

Waitlist/Newsletter Data

If you provided your email for a waitlist or newsletter and you haven't created a full account yet, we retain that information until we have sent you an invitation or relevant updates. If you choose not to join and ask for deletion, or if our invite email bounces, we may remove your email from our records. You can also unsubscribe from newsletters at any time, and we will stop sending and delete or suppress your contact info accordingly.

Analytics Data

Analytics information collected via PostHog is retained for internal analysis. We typically retain granular analytics data for a limited period (e.g. 12-14 months) and may retain aggregated, non-identifiable data for longer to spot long-term trends. If you withdraw consent for analytics, no new analytics data will be collected, and we will stop processing your previously collected analytics data (we may continue to use aggregate statistics that no longer identify any individual).

Logs and Security Data

Server logs, which may include IP addresses and usage logs for security, are generally retained for a short period (a few weeks up to a few months) unless we need to keep them longer to investigate specific incidents (for example, a security breach). We remove or anonymize logs when they are no longer needed for security or analysis.

Legal Obligations

In some cases, we might need to retain certain data for a longer period if required by law. For example, if you made any purchases or there are financial records, we might keep billing records for accounting and tax purposes for the duration required by Austrian law. Also, if a dispute arises or we receive a legal request, we would preserve relevant data until the issue is resolved.

Access Your Data

You can request a copy of the personal data we hold about you, and information about how we process it. This is often called a Subject Access Request. We will provide you with a summary of your data, and we typically do so within one month of your request.

Rectification

If any of your personal data is inaccurate or incomplete, you have the right to have it corrected or updated. For example, if you change email addresses or notice an error in your profile information, you can update it in your account settings or ask us to update it.

Erasure (Right to be Forgotten)

You may request that we delete your personal data. If you no longer want to use WhereTheyTalk, you can delete your account via the settings (where available) or contact us to request deletion. We will then erase your personal data from our systems, provided we don't have a legitimate reason to keep it (such as a legal obligation or a compelling legitimate interest).

Restriction of Processing

You can ask us to restrict (temporarily halt) the processing of your data in certain circumstances – for instance, if you contest the accuracy of data or have objected to processing and we are evaluating that request. When processing is restricted, we will still store your data but not use it until the issue is resolved.

Data Portability

You have the right to obtain your personal data that you provided to us in a structured, commonly used, machine-readable format, and you have the right to transmit that data to another controller. In practice, if you request it, we can export data such as your account details and any content you've contributed in a CSV or similar format for you.

Object to Processing

You have the right to object to our processing of your data in certain scenarios. In particular, you can object to processing that we base on legitimate interests (Art. 6(1)(f)), such as any direct marketing or certain analytics. If you lodge an objection, we will evaluate whether our legitimate grounds override your privacy rights. If they do not, we will stop the processing in question. You also have an absolute right to object to any direct marketing use of your data (currently, we do not use your data for third-party marketing, and any product-related emails are sent based on either contract necessity or your opt-in consent).

Withdraw Consent

Where we rely on your consent to process data (e.g., for optional analytics or for sending a newsletter), you have the right to withdraw that consent at any time. Withdrawing consent will not affect the legality of any processing done before the withdrawal, but it means we will stop the specific processing going forward. For example, you can turn off analytics cookies, and we will stop collecting analytics data about you; or you can unsubscribe from our newsletter, and we will stop emailing you.

Not be subject to Automated Decisions

We do not make any legal or similarly significant decisions about you using purely automated processing (like profiling algorithms). If that ever changes, you would have rights related to such automated decision-making (including the right to human intervention).

Lodge a Complaint

If you believe we have infringed your data protection rights, you have the right to file a complaint with a supervisory authority, particularly in the EU country where you live or work, or where the issue occurred. For example, in Austria the supervisory authority is the Österreichische Datenschutzbehörde. We encourage you to contact us first so we can address your concerns directly, but you are free to reach out to the authorities at any time.