Privacy Policy

This Privacy Policy explains how Whobela (“we,” “us,” “our”) collects, uses, shares, and protects information when you use whobela.com and any related services (collectively, the “Service”). It applies to Users who create accounts and to Visitors who view or interact with invitation pages created on Whobela.

Whobela is operated by [Your full legal name], a sole trader based at [Your business address], Poland. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), that person is the data controller for the personal data described below, and can be reached at [email protected].

1. Information We Collect

1.1 Account data

Email address, hashed password, account preferences, and any information you provide when creating or managing your account.

1.2 Profile data

Name, profile photos, interests, social links, preferences, and any other information you choose to add to your profile or invitation page.

1.3 Booking data (information about Visitors)

When a Visitor responds to an invitation page, we store what they enter: their name, the contact details they choose to give (Instagram, WhatsApp, phone, or email), an optional message, the date and time they picked, and any preferences they selected.

If you are a Visitor: this information is collected so the person who sent you the invitation can reply to you, and it is visible to them in their dashboard. The controller named above is responsible for it, you have all the rights described in Section 8, and you can ask us to delete it at any time by emailing [email protected] — you do not need an account to make that request.

1.4 Technical data

Whobela does not run analytics, advertising, or tracking software, and does not build a profile of what you do on the site. Our servers keep short-lived operational logs in the ordinary course of running a web service, and we set a cookie to keep you signed in. We do not store your IP address against your account, and we do not track you across other websites.

1.5 Push notifications

If you turn on notifications, your browser gives us an address for that specific browser or device, plus two keys used to encrypt messages to it. We store these so we can tell you when someone answers your invitation. Delivery goes through the push service run by your browser's maker — Google, Apple, or Mozilla — which necessarily receives that address. Turning notifications off in your browser, or deleting your account, removes it.

1.6 Signup country and acquisition source

When you create an account we record the country your request came from, derived at our content-delivery network from your IP address. We store the two-letter country code only. We do not store the IP address it was derived from, and we do not record your city, region, or any more precise location. We also record how you first reached the site (the referring website and any campaign parameters in the link you followed).

We use this solely to understand, in aggregate, which countries and channels our users come from. It is never used to target you individually and is never shared with advertisers.

1.7 Payment data

Whobela is free and we do not collect payment data. When we previously offered a paid subscription, payments were processed by Stripe and/or PayPal; we never stored full payment card numbers or bank details, and we retain only limited historical billing metadata (such as subscription status and history) for accounting and support purposes.

2. How We Use Information

We use the information described above to:

• Provide and operate the Service, including creating, hosting, and delivering invitation pages;
• Process bookings, responses, and contact details submitted through your pages;
• Send transactional notifications by email and — if you turn them on — browser push (e.g., someone answered your invitation, security alerts);
• Maintain, secure, and improve the Service, including diagnosing technical issues;
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms & Conditions;
• Communicate with you about your account, updates to our policies, or — where you have consented — product news.

3. Legal Basis for Processing (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract necessity — processing needed to create your account, build your pages, and deliver the Service you requested;
• Consent — for optional features such as marketing emails or non-essential cookies, which you can withdraw at any time;
• Legitimate interests — for security, fraud prevention, analytics, and improving the Service, balanced against your rights and interests;
• Legal obligation — where we must retain or disclose information to comply with the law.

4. Data Sharing

We share information with the following categories of third parties, only as needed to operate the Service:

• Hetzner — the German hosting provider whose server runs Whobela and stores its database and uploaded photos;
• Cloudflare — sits in front of the site to route traffic, provide HTTPS, and pass on the two-letter country code described in Section 1.6;
• Resend — sends account and booking emails;
• Browser push services (Google, Apple, Mozilla) — deliver notifications to your device, as described in Section 1.5;
• Stripe and PayPal — historically processed subscription payments. No new payments are processed and no payment details are collected.

We do not use analytics or advertising services, and no third party receives your data for its own marketing purposes.

We do not sell your personal data. We may disclose information if required by law, court order, or governmental request, or to protect the rights, safety, or property of Whobela, our users, or the public.

5. User-Generated Content and Public Pages

Your invitation page is published at a public address built from your username, such as yourname.whobela.com. Anything you put on it — photos, your name, your interests — is visible to anyone who opens that address. The address is predictable rather than secret, and there is currently no password or visibility setting available. We ask search engines not to index invitation pages, but that is a request rather than an access control.

Only put things on a page that you are comfortable being seen by someone other than the person you send it to. See Terms & Conditions §5.

6. Cookies

We use one essential cookie, to keep you signed in, and your browser's local storage to remember how you first reached the site. We do not use analytics or advertising cookies. See our Cookie Policy for detail.

7. Data Retention

We retain personal data for as long as your account is active, plus a limited period afterward to comply with legal, accounting, or security obligations. Specifically:

• Account deletion — when you delete your account, we delete or anonymize your personal data within a reasonable period, except data we are required to retain by law (e.g., billing records) or data contained in backups, which are deleted on our standard backup rotation schedule;
• Backup systems — data may persist in encrypted backups for a limited time after deletion from production systems;
• Legal requirements — we may retain certain data longer where required by tax, accounting, or other applicable law.

8. Your Rights

If GDPR or a similar law applies to you, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data (“right to be forgotten”), subject to legal retention requirements;
• Export your data in a portable format;
• Restrict or object to certain processing, including processing based on legitimate interests or for direct marketing;
• Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact [email protected]. We will respond within the timeframe required by applicable law. If you are in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.

9. International Transfers

Whobela uses infrastructure and service providers that may process data outside your country of residence, including outside the European Economic Area. Where we transfer personal data internationally, we use appropriate safeguards required by applicable law (such as Standard Contractual Clauses) to protect your data.

10. Security

We use industry-standard measures to protect your data, including encryption of data in transit, access controls restricting who can view personal data internally, hashed password storage, and regular review of our security practices. No system is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

Whobela is not directed at individuals under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact [email protected] so we can investigate and remove it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service before they take effect.

13. Contact

Questions about this Privacy Policy or how we handle your data can be sent to [email protected].