Contents
- Who we are
- Data we collect
- How we use it
- Connected accounts
- Google user data
- Meta user data
- AI processing
- Legal bases
- Who we share it with
- International transfers
- How long we keep it
- Security
- Cookies and browser storage
- Your rights
- California residents
- Deleting your data
- Children
- Changes to this policy
- Contact us
1. Who we are
Whistle Commerce (whistlecommerce.com) is an AI agent for e-commerce sellers. It is operated by [COMPANY LEGAL NAME], a company incorporated in Hong Kong, with its registered address at [COMPANY ADDRESS] ("Whistle Commerce", "we", "us").
We are the data controller for the personal data described in this policy. If you have any question about it, write to hello@whistlecommerce.com.
This policy applies to our website, our web app and the integrations you connect to it (together, the "Service"). It should be read together with our Terms of Service.
2. Data we collect
Data you give us
- Account data: your name, email address and login details.
- Billing data: your subscription status, plan, invoices and billing country. Card payments are handled by our payment processor, Stripe. We never see or store your full card number.
- Chat content: the messages, prompts, files and images you send to the agent, and the answers it gives you.
- Workspace content: the files, code and store pages the agent creates for you in your private per-chat workspace.
- Support messages: anything you send us by email or through the Service.
Data from accounts you connect
If you choose to connect Shopify, Meta or Google Ads, we receive the data those platforms allow under the permissions you approve. Section 4 explains exactly what that is.
Data collected automatically
- Usage data: which features you use, the amount of AI usage you consume against your monthly cap, and error logs.
- Technical data: IP address, browser type, device type and approximate location derived from your IP address, used for security and fraud prevention.
Public web data
When you ask the agent to research products, competitors or ads, it reads publicly available web pages and public data sources such as the Meta Ad Library and Google Trends, sometimes through third-party web data providers. This data is about products and businesses, not about you.
3. How we use your data
- To create and run your account and provide the features you ask for.
- To run the AI agent: process your messages, research the web, and build files, code and store pages in your workspace.
- To read data from accounts you connect, only when you ask for something that needs it.
- To take payment, manage your subscription and keep billing records.
- To measure usage against fair use limits and the monthly AI usage cap.
- To keep the Service secure, prevent abuse and fix bugs.
- To answer support requests and send you service messages (for example billing receipts or important changes). We only send marketing emails if you agree, and you can unsubscribe at any time.
- To meet our legal obligations.
We do not sell your personal data. We do not use your data for advertising. We do not use your content or connected account data to train AI models.
4. Connected accounts
Connecting an account is optional. You connect each integration with your own login on that platform, and you can disconnect it at any time from the Service or from the platform itself.
| Integration | What we access and why |
|---|---|
| Shopify | Store data such as products, collections, orders, themes and store settings, so the agent can analyse your store and answer your questions. The agent makes changes to your store (for example editing a product or a page) only when you explicitly tell it to. |
| Meta Marketing API | Read-only ad account insights (the ads_read permission): campaigns, ad sets, ads and their performance metrics, so the agent can review and explain your ad results. |
| Google Ads API | Read-only campaign performance data, so the agent can review and explain your Google Ads results. |
For every integration:
- Access tokens are stored encrypted and are never shown to other users.
- We use the data only to provide the features you request.
- We never sell it, never use it for advertising and never use it to train AI models.
- When you disconnect, we delete the stored token and stop accessing the account. Data already pulled into your chats stays there until you delete those chats or your account.
5. Google user data (Limited Use)
Whistle Commerce's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, data we receive from Google APIs (such as Google Ads campaign data):
- is used only to provide or improve user-facing features that are visible and prominent in the Service and that you have asked for;
- is not transferred to others, except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you;
- is not used or transferred to serve advertising, including retargeting, personalised or interest-based ads;
- is not used to train AI or machine learning models, whether generalised or personalised;
- is not read by humans unless you give us explicit permission for specific data, it is needed for security purposes (such as investigating abuse), it is required by law, or it is aggregated and anonymised for internal operations.
You can revoke our access at any time from the Service or at myaccount.google.com/permissions.
6. Meta user data
We access Meta Platform data only with the permissions you grant when you connect your Meta account, and we use it only to show and analyse your own ad account data at your request. We follow the Meta Platform Terms and do not sell, license or share Meta Platform data with data brokers or for advertising.
You can remove our access at any time in your Facebook settings under Apps and websites, or by disconnecting Meta in the Service. To have your data deleted, follow the steps on our Data Deletion Instructions page.
7. AI processing
To answer your requests, your messages, workspace files and the relevant data from connected accounts are sent to our AI model providers for processing. They act as our service providers (processors), process this data only to return results to us, and are not permitted to use it to train their models.
Each chat has its own isolated workspace. Files and code the agent creates in one chat are not shared with other users.
AI answers can be wrong or incomplete. Please check important results before you rely on them. See our Terms of Service for more.
8. Legal bases (EEA and UK)
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR:
- Contract: to provide the Service you subscribed to, including the AI agent and the integrations you connect.
- Legitimate interests: to keep the Service secure, prevent abuse, enforce fair use and improve the product, where these interests are not overridden by your rights.
- Legal obligation: to keep billing and tax records and respond to lawful requests.
- Consent: for optional marketing emails. You can withdraw consent at any time.
10. International transfers
We are based in Hong Kong and our providers may process data in other countries, including the United States. When we transfer personal data from the EEA or the UK to a country without an adequacy decision, we use safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. We also comply with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486).
11. How long we keep data
- Account data, chats and workspace content: for as long as your account is active. When you delete a chat or your account, we delete the related data from our systems within 30 days.
- Connected account tokens: until you disconnect the integration or delete your account.
- Billing records: for as long as tax and accounting laws require (in Hong Kong, generally 7 years).
- Security and error logs: up to 90 days, unless needed longer to investigate abuse.
Copies in encrypted backups are removed in our normal backup cycle.
12. Security
We use encryption in transit (HTTPS) and encrypt access tokens at rest. Access to production systems is limited to people who need it. Each chat runs in an isolated workspace. No system is perfectly secure, so please use a strong password and tell us at once at hello@whistlecommerce.com if you think your account has been compromised.
14. Your rights
Depending on where you live, including under the GDPR and UK GDPR, you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent;
- complain to your local data protection authority (in the UK, the Information Commissioner's Office). In Hong Kong you can contact the Office of the Privacy Commissioner for Personal Data.
To use any of these rights, email hello@whistlecommerce.com from the email address on your account. We will reply within one month. We may ask you to confirm your identity before we act on a request.
15. California residents
If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, use and disclose, to request deletion and correction, and not to be discriminated against for using these rights.
- The categories of personal information we collect are listed in section 2: identifiers, commercial information (subscription and billing), internet activity (usage data), and the content you provide.
- We use and disclose it only for the business purposes in sections 3 and 9.
- We do not sell or share your personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.
To make a request, email hello@whistlecommerce.com. You may use an authorised agent, and we will verify the request before acting on it.
16. Deleting your data
You can delete your account and all related data at any time in your account settings, or by emailing hello@whistlecommerce.com from your account email. We complete deletion within 30 days. Full step-by-step instructions, including how to remove data received from Meta, Shopify and Google, are on our Data Deletion Instructions page.
17. Children
The Service is for businesses and adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
18. Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above, and if the changes are significant we will tell you by email or in the app before they take effect.
19. Contact us
[COMPANY LEGAL NAME]
[COMPANY ADDRESS]
Email: hello@whistlecommerce.com
Website: whistlecommerce.com