Privacy Policy
Introduction
Whaleform Inc. DBA Whalesync is a software as a service that enables businesses to sync data across other third-party tools.
We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes Whalesync's policies and practices regarding its collection and use of your personal data and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.
Data Protection Officer
Whalesync is headquartered in Miami, Florida in the United States. Whalesync has appointed an internal data protection officer for you to contact if you have any questions or concerns about Whalesync's personal data policies or practices. If you would like to exercise your privacy rights, please direct your query to Whalesync's data protection officer. Whalesync's data protection officer's name and contact information are as follows:
Curtis Fonger
390 NE 191st St STE 8026
Miami, FL 33179
United States
privacy@whalesync.com
Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- European Union (EU)
If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/12931220194.
How we collect and use (process) your personal information
Whalesync collects personal information about its website visitors and customers. With a few exceptions, this information is generally limited to:
- name
- job title
- employer name
- work address
- work email
- work phone number
We use this information to provide prospects and customers with services.
We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.
From time to time, Whalesync receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. We may also collect your personal data from a third party website (e.g. LinkedIn).
Use of the Whalesync website
As is true of most other websites, Whalesync's website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of Whalesync's website, including a history of the pages you view. We use this information to help us design our site to better suit our users' needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.
Whalesync has a legitimate interest in understanding how members, customers and potential customers use its website. This assists Whalesync with providing more relevant products and services, with communicating value to our sponsors and corporate members, and with providing appropriate staffing to meet member and customer needs.
Cookies and tracking technologies
We use cookies and similar technologies on our website. Non-essential cookies — in the functional, analytics, and marketing categories — load only with your consent, which you provide through the cookie banner shown on your first visit. You can change or withdraw your consent at any time using the "Cookie preferences" link in the website footer. Strictly necessary cookies, which the site needs to function, are always active.
For the full list of cookies, the categories they fall into, and the third parties involved, please see our Cookie Policy.
When and how we share information with third parties
The personal information Whalesync collects from you is stored in one or more databases hosted by third parties located in the United States. These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval. On occasion, Whalesync engages third parties to send information to you, including information about our products, services, and events.
A list of our third party subprocessors can be found here: https://security.whalesync.com/subprocessors. As Whalesync grows and changes, this list might change.
We do not otherwise reveal your personal data to non-Whalesync persons or businesses for their independent use unless: (1) you request or authorize it; (2) it's in connection with Whalesync-hosted and Whalesync co-sponsored conferences as described above; (3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) to address emergencies or acts of God; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.
The Whalesync website connects with third party services such as Facebook, LinkedIn, Twitter and others. If you choose to share information from the Whalesync website through these services, you should review the privacy policy of that service. If you are a member of a third party service, the aforementioned connections may allow that service to connect your visit to our site to your personal data.
Google user data
This section explains how Whalesync accesses, uses, stores, shares and deletes the data we receive from Google APIs ("Google user data") when you sign in with Google or connect a Google account. For Google user data, this section takes precedence over the rest of this policy. In particular, the aggregated data and marketing disclosures under When and how we share information with third parties and Processing activities, and the retention terms under Data storage and retention, do not apply to it.
Whalesync's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we access.
- Sign in with Google. We receive your name, email address and profile picture, and use them only to create your Whalesync account and sign you in.
- Google Sheets. We access only the spreadsheets you connect to a sync or a Live Export: their titles, tabs, column headers and cell values. As your settings direct, we read, add, change and delete rows, tabs and columns, and Live Export can create a new spreadsheet for you. We add an ID column and column settings that keep records matched between your apps. For syncs, we also receive the email address of the Google account you connect, so we can tell you which account needs access to a spreadsheet.
- Google BigQuery. If you connect BigQuery as a Live Export destination, we list the projects and datasets your account can access so you can choose one. We create tables in the dataset you choose, and read, add, change and delete rows only in the tables Whalesync creates.
How we use it. We use Google user data only to provide and improve the features you set up and see in Whalesync: syncing records between Google and your other apps, exporting records with Live Export, showing you your data, sync history and errors, and helping you set up syncs and fix sync problems.
Some of these features use Google Cloud's Vertex AI (Gemini). To suggest how to map columns, we send it the names of your tables and columns, such as a spreadsheet's title, tab names and column headers. To suggest how to fix a sync problem, we may send it the details of the error, which can include the record values involved. Google Cloud processes this data on our behalf and does not use it to train its models.
We do not sell Google user data or use it for advertising, and we do not use it to determine credit-worthiness or for lending. We do not use Google user data, including data obtained through Google Workspace APIs such as Google Sheets, to develop, improve or train generalized or non-personalized AI or machine learning models.
How we share it. We share Google user data only:
- with the apps you connect to Whalesync, as your sync and Live Export settings direct;
- with the service providers that host and run Whalesync for us, listed on our subprocessors page, and only as needed to provide, secure and support the service;
- with an AI assistant you connect to your Whalesync account yourself, such as through our MCP server, which can then read your synced records at your direction;
- when the law requires it; or
- as part of a merger, acquisition or sale of assets, and only after getting your explicit consent.
We do not transfer Google user data to advertising platforms, data brokers or other information resellers.
Who can see it. Whalesync staff do not view your Google user data unless you ask us to (for example, when you contact support about a sync), we need to investigate a bug, security incident or abuse, or the law requires it.
How we protect it. We store Google user data on Google Cloud, in the United States and, for Live Export, in Belgium. It is encrypted at rest, and we exchange it with Google over encrypted connections. We also encrypt your Google access tokens with our own keys before storing them. Access to production systems is limited to staff who need it to run the service.
How long we keep it.
- We keep the Google user data a sync or Live Export uses for as long as that sync or Live Export exists. Detailed sync history is kept for 7 days.
- When you delete a sync or Live Export, we delete the Google user data it holds within 30 days. We delete a Google access token within 30 days of deleting the last sync or Live Export that uses it.
- When you delete your Whalesync account, we stop your syncs and delete the Google access tokens they use within 24 hours, and delete the rest of your data, including your Live Exports, within 60 days of your request.
- Deleted data can remain in our encrypted backups and system logs until they expire.
- You can ask us to delete your Google user data at any time by emailing privacy@whalesync.com.
Revoking access. You can remove Whalesync's access to your Google account at any time at https://myaccount.google.com/permissions. Your syncs with Google stop working once you do. Removing access does not delete the data we already hold; to delete it, delete the sync or your account, or email us.
Transferring personal data to the U.S.
Whalesync has its headquarters in the United States. Information we collect about you will be processed in the United States. By using Whalesync's services, you acknowledge that your personal information will be processed in the United States. The United States has not sought nor received a finding of "adequacy" from the European Union under Article 45 of the GDPR. Pursuant to Article 46 of the GDPR, Whalesync is providing for appropriate safeguards by entering binding, standard data protection clauses, enforceable by data subjects in the EEA and the UK. These clauses have been enhanced based on the guidance of the European Data Protection Board and will be updated when the new draft model clauses are approved.
Depending on the circumstance, Whalesync also collects and transfers to the U.S. personal data with consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Whalesync in a manner that does not outweigh your rights and freedoms. Whalesync endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Whalesync and the practices described in this Privacy Statement. Whalesync also enters into data processing agreements and model clauses with its vendors whenever feasible and appropriate. Since it was founded, Whalesync has received zero government requests for information.
For more information or if you have any questions, please contact us at privacy@whalesync.com.
Data Subject rights
The European Union's General Data Protection Regulation (GDPR), the UK GDPR, and other countries' privacy laws provide certain rights for data subjects. Data Subject rights under the GDPR include the following:
- Right to be informed
- Right of access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right of data portability
- Right to object
- Rights related to automated decision making including profiling
This Privacy Notice is intended to provide you with information about what personal data Whalesync collects about you and how it is used.
If you wish to confirm that Whalesync is processing your personal data, or to have access to the personal data Whalesync may have about you, please contact us at privacy@whalesync.com.
You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Whalesync might have received the data from Whalesync; what the source of the information was (if you didn't provide it directly to Whalesync); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Whalesync if it is inaccurate. You may request that Whalesync erase that data or cease processing it, subject to certain exceptions. You may also request that Whalesync cease using your data for direct marketing purposes. When technically feasible, Whalesync will — at your request — provide your personal data to you.
Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, Whalesync will provide you with a date when the information will be provided. If for some reason access is denied, Whalesync will provide an explanation as to why access has been denied.
Your right to complain. If you have concerns about how Whalesync handles your personal data, you have the right to complain.
Complain to us first. We would like the chance to put things right, so we encourage you to raise any complaint with us directly before, or at the same time as, contacting a regulator. To make a complaint, email us at privacy@whalesync.com with "Data protection complaint" in the subject line, or write to our Data Protection Officer at the address above. Please describe what happened and what you would like us to do. When you complain to us, we will:
- acknowledge your complaint within 30 days of receiving it;
- investigate it and take appropriate steps to respond; and
- tell you the outcome, and our reasons, without undue delay.
You also have the right to complain to a supervisory authority:
- United Kingdom: under the Data (Use and Access) Act 2025 you have the right to complain to us directly, as described above. This does not affect your right to complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/, or by calling 0303 123 1113 — though we would appreciate the opportunity to resolve your concerns first.
- European Union / EEA: you may complain to the European Data Protection Supervisor or to your nation's data protection authority (a list is available at https://www.edpb.europa.eu/about-edpb/our-members_en).
- Elsewhere: you may contact the data protection or privacy regulator in your country of residence.
Security of your information
Whalesync implements appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, but we work to safeguard your information and review our practices as our services evolve. You can learn more about our security program at https://security.whalesync.com/.
Data storage and retention
Your personal data is stored by Whalesync on its servers, and on the servers of the cloud-based database management services Whalesync engages, located in the United States. Whalesync retains service data for the duration of the customer's business relationship with Whalesync and for a period of time thereafter, to analyze the data for Whalesync's own operations, and for historical and archiving purposes associated with Whalesync's services. Whalesync retains prospect data until such time as it no longer has business value and is purged from Whalesync systems. All personal data that Whalesync controls may be deleted upon verified request from Data Subjects or their authorized agents. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at privacy@whalesync.com.
Children's data
We do not knowingly attempt to solicit or receive information from children.
Processing activities
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or home address. We (or service providers on our behalf) may then send communications and marketing to these email or home addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.
Questions, concerns, or complaints
If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at:
Whalesync
390 NE 191st St STE 8026
Miami, FL 33179
United States
privacy@whalesync.com
