Privacy Policy for Whale Dashboard

Last updated: February 28, 2026

1. Who we are

Whale Dashboard (“we”, “our”) operates the Whale Dashboard service and related websites and applications. This policy describes how we collect, use, and protect your information.

2. Information we collect

Account and identity: When you sign up or log in, we receive information from our identity provider (Auth0), such as email address, name, and profile identifiers, as needed to provide the service.
Billing: Payment and subscription information is processed by Stripe. We do not store full payment card numbers; we may store billing-related identifiers (e.g. Stripe customer ID) to manage your subscription.
Usage and product data: We collect and store data you provide in the product (e.g. orders, products, business data) and how you use the service (logs, analytics) to operate, improve, and secure the service.
Webhook and bot data: When you connect external tools (e.g. AYCD Inbox or other checkout bots), we receive order and checkout data sent to us via webhooks. This may include order details and related identifiers we use to match and reconcile orders.
Email integration: If you use our email integration, we collect and store email credentials (e.g. app passwords) that allow us to access your inbox via IMAP. We use these to read email content (order confirmations, shipping notices) and extract order and shipment information. We use this data solely for order tracking and reconciliation.
Card transaction data: If you upload credit or debit card statement files, we process them to match transactions against orders. We do not store full card numbers; we may retain transaction identifiers or summarized data needed for reconciliation, as described when you upload.
Third-party buying group credentials: When you connect buying group platforms (e.g. BuyingGroup, Points4Days, BuyGetRewards), we collect and store the credentials you provide (usernames, passwords, or API tokens) so we can access those services on your behalf for order and receipt sync.

3. How we use your information

We use the information to: provide and maintain Whale Dashboard; process subscriptions and payments via Stripe; authenticate you via Auth0; improve our service and support; send important service-related communications; and comply with legal obligations.

Specifically for connected services: we use your email credentials to run ongoing server-side monitoring of your inbox (via IMAP) and extract order and shipment data. We use your card statement data to match transactions against orders for reconciliation. We use your buying group credentials to call those platforms’ APIs on your behalf (e.g. to push tracking numbers, sync receipts, or retrieve order status). We do not use these credentials or data for marketing or any purpose other than providing the service you requested.

4. Sharing of information

Auth0: Used for authentication; see Auth0 Privacy.
Stripe: Used for payment processing; see Stripe Privacy.
Cloudflare, Inc.: We use Cloudflare for network infrastructure (tunnels, DNS proxying, DDoS protection, and access control). All traffic to and from our services passes through Cloudflare’s network; they may process requests, IP addresses, and other connection data in the course of providing these services. See Cloudflare Privacy Policy.
Google: Our marketing site and app may load fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). When your browser requests these resources, Google may receive your IP address and standard browser information. See Google Privacy Policy.
Buying group platforms: When you connect buying group services (e.g. BuyingGroup, Points4Days, BuyGetRewards), we send requests to their APIs using the credentials you provided. Those platforms receive the data necessary to fulfill the request (e.g. tracking numbers, order identifiers) in line with their own privacy and terms.

We do not sell your personal information. We may disclose information where required by law or to protect our rights and safety.

5. Data retention

We retain your account and product data while your account is active and as needed for billing, legal, and legitimate business purposes after closure, in line with applicable law.

Email and buying group credentials are retained until you remove the connection in the product or close your account; we do not use them after you revoke access. Uploaded card statement files are processed for reconciliation; we may retain only the transaction or summary data needed for that purpose (not the full file) for as long as your account is active, unless you request deletion. You can remove connected credentials and request deletion of stored data via the app or by contacting us.

6. Security

We use industry-standard measures to protect your data (e.g. encryption, access controls, secure providers). Our traffic is routed through Cloudflare for DDoS protection, tunnel encryption, and access control as an additional security layer. Payment data is handled by Stripe in line with PCI requirements.

Because we store email and buying group credentials that grant access to your accounts, we treat them as highly sensitive. We encrypt them at rest and in transit, limit access to systems that need them to provide the service, and use them only for the purposes described in this policy. We do not store full payment card numbers from statement uploads; we retain only what is necessary for transaction matching.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your data, or to object to or restrict processing. To exercise these, contact us using the details below. You can also manage account and billing preferences in the app and via Stripe.

You can revoke or remove stored email credentials and buying group connections at any time in the product; we will stop using them and delete them as described in Section 5. For deletion of other data or to exercise your legal rights, contact us.

8. Cookies and similar technologies

We use cookies and similar technologies for authentication, session management, and security. Our identity provider (Auth0) stores session and access tokens in your browser’s localStorage so you can stay signed in; we do not use this storage for tracking. Our identity and payment providers (Auth0, Stripe) may set their own cookies in line with their privacy policies.

Our app may register a service worker that caches app assets and data locally on your device to improve performance and offline use. Cached data is stored on your device and is not sent to us beyond normal product usage.

9. Changes

We may update this policy from time to time. We will post the updated policy at this URL and update the “Last updated” date. Continued use after changes constitutes acceptance.

10. Contact

For privacy-related questions or requests: Contact Support.