Privacy Policy

Section 1. Overview

Onlywhales AI operates a B2B API platform that enables businesses ("Customers") to integrate AI-powered companion and conversational experiences into their own products. This Privacy Policy describes how Onlywhales AI collects, uses, processes, and protects information in connection with our Services.

If you are an End User of a Customer's product, your primary privacy rights should be exercised with that Customer, who controls how your data is collected and used in their product.

Section 2. Who We Are

Onlywhales AI, Inc. is the data controller for information collected from Customers (businesses and developers) using the platform.

Registered address: Wilmington, Delaware, USA

Privacy inquiries: contact@onlywhales.ai
Data Protection Officer (DPO): contact@onlywhales.ai

Section 3. Scope & Controller / Processor Roles

3.1 This Policy Applies To:

• Visitors to our website and documentation portal;
• Customers who register for and use our API and developer services;
• Business contacts at Customer organizations.

3.2 This Policy Does Not Govern:

The privacy practices of our Customers with respect to their own End Users. Each Customer operates its own product and is independently responsible for its privacy disclosures to End Users. When a Customer submits End User data to our API, the Customer is the data controller of that data, and Onlywhales AI processes it solely on the Customer's behalf as a data processor.

Role Summary

Section 4. Data We Collect

4.1 Account & Registration Data

When you register, we collect: full name, business email address, company name, country, phone number, and payment/billing information (processed by our payment provider; we do not store raw card numbers).

4.2 API Usage Data

We automatically collect technical metadata related to your API interactions, including: API key identifiers (hashed), request timestamps, endpoint called, token counts (input/output), latency metrics, HTTP status codes, and IP addresses.

We do not log the content of API Inputs or Outputs by default.

4.3 Website & Portal Data

When you visit our website or developer portal, we collect: IP address, browser type and version, operating system, pages visited, time on page, referrer URL, and cookie identifiers.

4.4 Customer Data (API Content)

By default, we do not retain the content of Inputs or Outputs beyond the time needed to process and return the API response. Customers who opt into features such as persistent memory or conversation history may have session data stored as configured. Any such storage is governed by the Customer's subscription plan and our Data Processing Agreement.

4.5 Communications Data

If you contact us via email, support tickets, or feedback forms, we collect the content of those communications and associated metadata.

4.6 Data We Do Not Collect

We do not intentionally collect sensitive categories of personal data (health data, biometric data, political opinions, religious beliefs, etc.) from our Customers or End Users. Customers bear responsibility for ensuring lawful processing of any sensitive data submitted through the API as part of conversation content.

Section 5. How We Use Data

5.1 No Training on Customer Data (Default)

We do not use Customer Data (conversation content submitted via the API) to train or fine-tune our general AI models without your explicit written consent. Opt-in model training programs are available for Enterprise customers.

Section 6. Legal Bases for Processing (GDPR)

For individuals in the EEA, United Kingdom, and Switzerland, we process personal data under the following legal bases:

Contract Performance (Art. 6(1)(b))

Processing necessary to provide the Services you have contracted for, including account management and API delivery.

Legitimate Interests (Art. 6(1)(f))

Security monitoring, fraud prevention, service improvement, and direct marketing to existing customers — balanced against your fundamental rights.

Legal Obligation (Art. 6(1)(c))

Compliance with applicable laws, regulatory requests, and court orders.

Consent (Art. 6(1)(a))

Marketing to prospective customers; optional model training programs. Consent may be withdrawn at any time without affecting prior lawful processing.

Section 7. Sharing & Disclosure

We do not sell personal data. We do not share personal data with third parties for their own marketing purposes. We may share data in the following limited circumstances:

7.1 Service Providers

We engage trusted third-party vendors bound by data processing agreements:

• Cloud infrastructure (e.g., AWS, GCP): Hosting and compute
• Payment processors (e.g., Stripe): Billing and payments
• Analytics providers: Anonymized usage metrics only
• Email / CRM platforms: Communications and support
• Security vendors: DDoS protection, monitoring

7.2 Legal Requirements

We may disclose data when required by law, court order, or governmental authority, or to protect our rights, property, or safety, or that of others.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, Customer data may be transferred to the acquiring entity subject to equivalent privacy protections. We will provide advance notice.

7.4 With Your Consent

We may share data with third parties when you have explicitly consented to such sharing.

Section 8. International Data Transfers

Onlywhales AI is based in the United States. If you access our Services from outside the United States, your data will be transferred to, stored, and processed in the United States and other countries where our service providers operate.

For transfers of personal data from the EEA, UK, or Switzerland to countries not recognized as providing adequate protection, we rely on:

• Standard Contractual Clauses (SCCs): EU Commission-approved transfer mechanisms incorporated in our DPA;
• EU-US Data Privacy Framework: Where applicable and where our sub-processors are certified;
• UK IDTA: For transfers from the United Kingdom.

Section 9. Data Retention

When retention periods expire, data is securely deleted or anonymized. Customers may request earlier deletion through the developer dashboard or at contact@onlywhales.ai.

Section 10. Security

We implement technical and organizational measures including:

• Encryption in transit: All API communications use TLS 1.2+
• Encryption at rest: AES-256 for stored data
• Access controls: RBAC, principle of least privilege, MFA
• API key security: Keys are hashed server-side; plaintext keys are never stored
• Vulnerability management: Regular penetration testing, dependency scanning, security audits
• Incident response: Documented plan with defined timelines

No method of electronic storage or transmission is 100% secure. Please report suspected security vulnerabilities promptly to contact@onlywhales.ai.

10.1 Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify affected Customers without undue delay and no later than 72 hours after we become aware of the breach.

Section 11. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion where we no longer have a lawful basis to retain your data.
• Right to Restriction: Request that we restrict processing in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including direct marketing.
• Rights re. Automated Decision-Making: Right not to be subject to solely automated decisions with significant effects, including profiling.
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing, without affecting prior lawful processing.

How to Exercise Your Rights

Submit a request to contact@onlywhales.ai with subject line "Privacy Rights Request." We will respond within 30 days (extendable to 90 days for complex requests, with notice). We will verify your identity before processing requests. Requests are free of charge unless manifestly unfounded or excessive.

Right to Lodge a Complaint

If you are in the EEA or UK and believe we have not complied with applicable data protection law, you have the right to lodge a complaint with your local supervisory authority.

Section 12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Categories and specific pieces of personal information collected, sources, business purpose, and third parties with whom it is shared.
• Right to Delete: Request deletion, subject to exceptions.
• Right to Correct: Request correction of inaccurate data.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond permitted purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Personal Information Collected (California)

Section 13. Children's Privacy

Our Services are intended solely for use by businesses and professionals aged 18 and over. We do not knowingly collect personal information from children under the age of 13 (or the applicable age of digital consent in relevant jurisdictions).

We do not permit the use of our API to create products directed at children without appropriate parental consent mechanisms as required by COPPA and similar laws. Customers deploying applications that may be accessed by minors are solely responsible for compliance with COPPA, GDPR provisions for children's data, and all other applicable laws.

If we become aware that we have inadvertently collected personal information from a child under the relevant age of consent, we will take immediate steps to delete that information. Please contact contact@onlywhales.ai if you have concerns.

Section 14. Cookies & Tracking Technologies

We use cookies and similar technologies on our website and developer portal:

• Strictly Necessary: Session management, authentication, security (CSRF protection). Required for Services to function; cannot be disabled.
• Functional: Remembering preferences (language, dashboard settings). Can be disabled via cookie settings.
• Analytics: Understanding portal usage; improving user experience. Can be opted out via cookie banner or opt-out link.
• Marketing: Targeted advertising on third-party platforms. Requires consent in the EEA/UK.

The API itself does not use cookies.

Section 15. Third-Party Services & Links

Our website and documentation may contain links to third-party websites. We are not responsible for the privacy practices or content of such third parties. We encourage you to review their privacy policies independently.

Our Services may integrate with third-party tools (e.g., authentication providers, monitoring services). These are subject to their respective privacy policies. We select vendors who provide appropriate data protection guarantees.

Section 16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending an email to the registered account email address;
• Posting a prominent notice in the developer portal; and/or
• Updating the "Last Updated" date at the top of this page.

Material changes will be communicated at least 30 days before they take effect. Your continued use of the Services after the effective date constitutes acceptance of the changes.

To request a prior version of this Privacy Policy, contact contact@onlywhales.ai.

Section 17. Contact Us & Data Protection Officer