Privacy policy

1. Website, contact form and newsletter

Contacting WhatSake

Our contact form asks for your full name, email address and message. We use those details to answer your enquiry and continue the conversation by email. Messages are delivered through Google services to our Google Workspace mailbox. Sending a contact message does not subscribe you to the newsletter.

We use limited submission records to help prevent spam, repeated submissions and duplicate notifications. Please avoid including passwords, payment details or sensitive personal information in your message.

Newsletter subscriptions

When you subscribe, your email address is sent to Mailchimp, which manages our newsletter audience and email delivery. Mailchimp may also process technical information associated with the signup, such as your IP address, signup time and subscription status. Depending on our email settings, newsletter engagement information may include whether you open an email or click a link.

We use your subscription details to send WhatSake stories, brewery discoveries, travel ideas and app updates, based on your consent. You can withdraw that consent using the unsubscribe link in any marketing email or by contacting us. We may retain a limited record of an unsubscribe request so we can respect your preference.

Read Mailchimp’s privacy information for details about its processing.

Website delivery and external resources

Our website is hosted through ChatGPT Sites and its hosting infrastructure. Hosting providers may process technical request information, including IP addresses, browser details and access logs, to deliver pages, protect the service and diagnose problems. Some pages load fonts from Google Fonts, which involves requests to Google. Read the OpenAI privacy policy, Cloudflare privacy policy and Google privacy policy for information about those providers.

The website does not require an app account to read its articles. Clicking an Instagram or app-store link takes you to that provider’s service, where its privacy policy applies.

2. Information collected by the app and services

The information we process depends on the features you use, the details you provide and the permissions you grant. The application disclosures in this policy retain the scope described in our existing app privacy notice.

Information you provide

When you register, contact us, make a purchase or participate in the services, information may include your name, phone number, email address, mailing or billing address, username, password, and other contact or authentication details. We do not ask you to send passwords through the website contact form.

Our existing notice states that we do not process sensitive personal information. Please provide accurate account information and update it when it changes.

Payments

Purchases may involve payment details needed to complete the transaction, such as payment instrument information. Payment data is handled by payment providers identified in our existing notice: Stripe, Apple Pay and Google Pay. See their privacy information: Stripe, Apple Pay and Google Pay.

Device permissions and app information

• Location: location-based features may request access to your device location. The precision and frequency depend on the feature and your permission settings. You can refuse or revoke access in your device settings.
• Device features: the app may request access to features such as the camera, storage, calendar or reminders where relevant to a service. You control those permissions in your device settings.
• Push notifications: you can manage or switch off notifications in your device settings.
• Device and usage data: technical information may include device identifiers, model and manufacturer, operating system, browser type, app version, IP address, mobile carrier, language, referring pages, access times, features used and diagnostic or crash information.

This information supports the operation, security, troubleshooting and analysis of the services. Location permissions may affect the availability of location-based features.

3. How we use information

Depending on your interaction with WhatSake, we use personal information to:

• Create, authenticate and manage accounts, and provide requested services.
• Answer questions, provide support, send service notices and request feedback.
• Manage orders, payments, returns and exchanges where those features are available.
• Enable communications or public contributions that you choose to make.
• Send marketing in accordance with your preferences and measure its effectiveness.
• Understand usage, improve the services and, where applicable, personalise content or advertising.
• Protect the services, prevent fraud, diagnose faults and comply with legal obligations.
• Protect a person’s vital interests where necessary, such as preventing harm.

4. Legal bases for processing

For people in the UK and EEA, we process personal information where an applicable legal basis permits it. These bases may include:

• Consent: for example, when you choose to subscribe to marketing or grant a relevant permission. You can withdraw consent.
• Contract: to provide a service you request or take steps at your request before entering a contract.
• Legitimate interests: such as answering enquiries, securing and improving our services, preventing fraud, understanding usage and supporting our business, provided those interests do not override your rights.
• Legal obligations: where processing is needed to comply with law, cooperate with authorities or establish, exercise or defend legal rights.
• Vital interests: where necessary to protect someone’s vital interests.

Whatsake Ltd acts as the data controller for the processing described here. Where we process information solely on behalf of a customer as a processor, that customer’s privacy notice governs the processing and requests should be directed to them.

For people in Canada, we rely on express or implied consent where applicable. Limited exceptions may permit processing without consent, including legally required disclosures, certain investigations and fraud prevention, qualifying business transactions, emergency situations, and other exceptions recognised by applicable law.

5. Sharing and service providers

We share information with providers that need it to perform services for us, subject to appropriate arrangements. The categories described in our existing notice include cloud computing, hosting and storage; account registration and authentication; communications; analytics and performance monitoring; testing; sales and marketing; advertising networks; payment processing, finance and accounting; and order fulfilment.

For the website, the relevant services include our hosting infrastructure, Google Workspace for enquiries, and Mailchimp for newsletter subscriptions. Providers may process information in countries outside your own. Contact us for information about the providers involved in your request and applicable transfer safeguards.

Other sharing described in our app notice

• Business transfers: information may be shared during a merger, financing, asset sale or acquisition.
• Affiliates and business partners: information may be shared for the purposes described in this policy, with affiliates required to honour it.
• Public areas: profile information, comments and other contributions you make public may be visible to other people and outside the services.
• Google Analytics: where used by the services, technical and usage information may support analytics and advertising features. See Google’s Analytics opt-out tool and privacy information. This app disclosure does not mean Analytics is installed on every website page.
• Google Maps Platform: location-specific requests may involve sending location information to Maps or Places services and storing location data on your device. Manage permissions in your device settings or contact us to withdraw consent.
• Offer walls: where an app feature offers third-party promotions or rewards, choosing an offer may send you to an external service and share a user identifier so the provider can prevent fraud and credit the reward.

6. Cookies and similar technologies

Cookies are small files stored by your browser. Similar technologies can include pixels, web beacons and device storage. Our existing app and service notice describes their use for operating the services, storing information and, where applicable, analytics and marketing.

The current website’s own page scripts do not set analytics or advertising cookies. Hosting or sign-in services may use cookies required to provide secure access. External services you interact with, including Mailchimp, Instagram and app stores, have their own cookie practices. Newsletter emails may contain engagement tracking depending on the email settings.

You can manage cookies through your browser settings and app permissions through your device settings. Blocking necessary cookies may affect access or functionality. Where consent is required for optional tracking, that tracking must be subject to your choice; a privacy notice alone does not provide consent.

Our existing notice states that the services do not currently respond to Do-Not-Track browser signals. This does not remove privacy rights or opt-out choices available under applicable law.

7. Social logins and external websites

If an app feature lets you register or sign in through a social account, the provider may share profile information with us. Depending on the provider and your settings, this can include your name, email address, profile picture, friends list or other information you make available. We use it for the purposes described here or explained at the time.

External websites, social networks, advertisers and payment services operate under their own privacy policies. A link from WhatSake does not make us responsible for their collection or use of information. Review their notices before providing information.

8. Retention and security

We retain information for as long as needed for the purposes described in this policy, unless law requires or permits a longer period. App account information is generally retained while you have an account. Some records may be retained afterwards for legal, tax, accounting, security, fraud-prevention or dispute-resolution purposes.

Contact correspondence is retained as needed to handle your enquiry and related follow-up. Newsletter details are retained to manage your subscription and preferences, including limited suppression information needed to honour an unsubscribe request.

When information is no longer needed, we delete or anonymise it. If immediate deletion is not possible, for example in backups, we isolate it from further processing until deletion is possible.

We use reasonable technical and organisational measures to protect personal information. No electronic transmission or storage system can be guaranteed completely secure. Use secure devices and connections when accessing the services.

9. Children’s information

Our existing notice states that we do not knowingly solicit personal information from, or market to, children under 18. If we learn that a child under 18 has provided personal information, we will take reasonable steps to deactivate the relevant account and delete the information. Please contact hello@whatsake.com if you believe this has happened.

10. Your privacy rights and choices

Your rights depend on where you live and the law that applies. In the UK, EEA, Switzerland and Canada, these may include access to your information, correction, deletion, restriction, portability, objection to certain processing, and protections concerning automated decision-making.

You can request changes through your app account settings where available, or contact us to review, update or delete information. We consider requests under applicable law. Account deletion may not require the immediate removal of records that must be retained for legal or security reasons.

Consent and marketing

You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal, or processing based on another lawful ground. To stop marketing emails, use the unsubscribe link, an in-app unsubscribe option where available, or email us. We may still send essential account or service messages and replies to your enquiries.

Complaints

You may complain to the relevant supervisory authority. UK residents can contact the Information Commissioner’s Office. EEA residents can contact their local data protection authority; Swiss residents can contact the Federal Data Protection and Information Commissioner.

11. Information for US residents

Our existing notice describes additional rights for residents of California, Colorado, Connecticut, Utah and Virginia. Other state laws may also provide rights where applicable. These rights are subject to legal conditions and exceptions.

Categories described in the existing app notice

The following table restates the category disclosures in the app notice dated 22 February 2024. It does not mean that each website visitor provides all of these categories.

The existing notice describes retaining categories A, B, C, D, G and K while a user has an account. It also identifies category K as disclosed to providers for business purposes and states that no personal information was sold or shared for a business or commercial purpose in the twelve months preceding that notice. The general collection and sharing sections above explain information processed by the services.

Requests and verification

Depending on applicable law, you may request access, details of categories, sources, purposes and recipients, correction, deletion, a portable copy, or an opt-out of sale, sharing, targeted advertising or certain profiling. We will not discriminate against you for exercising a privacy right. Where applicable, you may designate an authorised agent; we may request proof of their authority.

We may verify your identity using information already held or a contact method previously provided. Additional information requested solely for verification is used for that purpose and deleted when verification is complete. We do not need to re-identify de-identified data to respond to a request.

California

California residents may exercise applicable CCPA rights, including rights to know, delete, correct and opt out, subject to statutory exceptions. California’s “Shine the Light” law may also allow a written request, once a year without charge, about disclosures for third-party direct marketing. Registered California users under 18 can request removal of content they posted publicly; copies in backups or other systems may not be completely removed. Our existing notice commits to acting on applicable sale or sharing opt-out requests as soon as feasible and no later than 15 days.

Colorado, Connecticut, Utah and Virginia

Applicable rights can include access, deletion, portability and opt-outs of targeted advertising or sale. Colorado, Connecticut and Virginia also provide correction rights and opt-outs of qualifying profiling. If a request is declined, you can ask us about an appeal where the applicable law provides one.

The existing notice specifies a 45-day appeal response for Colorado, and a 60-day appeal response for Connecticut and Virginia. For Virginia requests, it specifies an initial response within 45 days, with a possible additional 45 days when reasonably necessary and notice of the extension. We will follow any shorter deadline or additional right required by applicable law. If a Virginia appeal is denied, you may complain to the Attorney General.

12. Other regional rights

Residents of Australia and New Zealand may have rights under Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020, including requesting access to and correction of personal information. If you do not provide information needed for a requested service, we may be unable to deliver it, answer a request, manage your account or verify your identity.

You can complain to the Office of the Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner if you believe your information has been handled unlawfully. People in other regions may have additional rights under their local law.

13. Policy updates

We may update this policy when our services, practices or legal requirements change. The date at the top identifies the relevant update. If we make material changes, we may provide a prominent notice or contact you directly. Please revisit this page to stay informed.

14. Contact and data requests

To ask a privacy question, withdraw consent, make a complaint, or request access, correction or deletion, email hello@whatsake.com or use the contact form. You can also use the contact option in your app profile.

Whatsake Ltd
35 Lammas Park Road
London W5 5JD
England, United Kingdom

Our existing notice names Robin Sola as the privacy contact for the UK, EEA and Switzerland. You can contact Robin at robin@whatsake.com or at the postal address above.

Include enough information for us to identify the account or enquiry concerned. We will assess and respond to your request in accordance with applicable data protection law.