Privacy Policy
Last updated: Avril 2026
1. Data controller
The controller responsible for processing your personal data is:
Whalli
19 mail Haroun Tazieff, 44300 Nantes, France
Email: hello@whalli.com
2. Data collected
We collect the following categories of data:
- Identification data: first name, last name, email address;
- Connection data: IP address, login dates and times, technical logs;
- Usage data: conversations, generations (images, videos, music), Whale and Flow configurations;
- Payment data: billing information processed by our provider Stripe (we do not store card numbers);
- Credit data: transaction history and credit consumption.
3. Purposes and legal bases
Your data is processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| Account creation and management | Contract performance |
| AI service delivery | Contract performance |
| Billing and payment | Contract performance / legal obligation |
| Platform improvement | Legitimate interest |
| Transactional communications | Contract performance |
| Marketing communications | Consent |
| Fraud prevention and security | Legitimate interest / legal obligation |
4. Retention periods
Your data is retained for the duration of your subscription, then for 3 years from account closure for proof and legal compliance purposes.
Payment data is retained in accordance with accounting legal obligations (10 years).
Generated content (images, videos, etc.) is retained while your account is active. You can delete it at any time.
5. Data recipients
Your data may be shared with the following sub-processors, in compliance with the GDPR:
- Stripe — payment processing (USA, standard contractual clauses);
- AI model providers (OpenAI, Anthropic, Google, Mistral, etc.) — processing user requests (prompts are transmitted to the APIs of the selected providers);
- Neon / hosting provider — data storage;
- Minio / object storage provider — storage of generated files.
We never sell your data to third parties for commercial purposes.
6. International transfers
Some of our sub-processors (notably AI model providers and Stripe) are based in the United States. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Article 46 GDPR.
7. Your rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15);
- Right to rectification (Art. 16);
- Right to erasure (Art. 17);
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20);
- Right to object (Art. 21).
To exercise your rights, contact us at hello@whalli.com. We will respond within one (1) month. For more details, see our GDPR page.
8. Cookies
For more information on cookies, please see our Cookie Policy.
9. Contact and complaints
For any question relating to the protection of your data: hello@whalli.com
You may also lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr