GDPR & Your rights
Last updated: Avril 2026
The General Data Protection Regulation
Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) grants you fundamental rights over your personal data. Whalli is committed to fully respecting these rights.
Your rights
Art. 15
Right of access
You can obtain confirmation that your data is being processed and receive a copy of it.
Art. 16
Right to rectification
You can request the correction of inaccurate or incomplete data concerning you.
Art. 17
Right to erasure
You can request the deletion of your data under the conditions provided for by the GDPR.
Art. 18
Right to restriction
You can request suspension of the processing of your data in certain situations.
Art. 20
Right to portability
You can receive your data in a structured, machine-readable format.
Art. 21
Right to object
You can object to the processing of your data based on legitimate interest.
How to exercise your rights?
To exercise any of your rights:
- Send an email to hello@whalli.com with the subject line "GDPR rights request";
- State your identity (account email address) and the right you wish to exercise;
- We may ask for proof of identity to verify who you are before processing your request;
- We will respond within one (1) month of receiving your request. This period may be extended by two additional months for complex requests.
Sub-processors (indicative list)
In providing the service, Whalli uses the following sub-processors who process personal data:
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe | Payment and billing | USA (SCC) |
| OpenAI | LLM / image request processing | USA (SCC) |
| Anthropic | LLM request processing | USA (SCC) |
| LLM / image request processing | USA (SCC) | |
| Mistral AI | LLM request processing | France (EU) |
| Neon | Database hosting | EU |
SCC = Standard Contractual Clauses of the European Commission. The complete and up-to-date list is available on request at hello@whalli.com.
International transfers
Some sub-processors are based in the United States. Pursuant to Article 46 GDPR, these transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, providing appropriate safeguards for the protection of your data.
Complaint to the supervisory authority
If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority:
- Website: www.cnil.fr
- Address: 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
- Phone: +33 1 53 73 22 22
Contact
For any question regarding your rights or the processing of your data: hello@whalli.com