Privacy Policy
Last updated: June 13, 2026
This Privacy Policy explains how CleverDevel ("WhisperAsk", "we", "us", "our") collects, uses, shares, and protects personal data when you visit whisperask.com, create an account, host a session, or join a session as an audience member (together, the "Service"). It is written to satisfy our obligations under the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the UK Privacy and Electronic Communications Regulations, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other applicable privacy laws.
If you have any questions or want to exercise any of the rights described below, contact us at [email protected].
1. Who is responsible for your personal data
Account holders, visitors, and prospective customers. CleverDevel is the controller of personal data we collect about you when you visit our website, create an account, communicate with us, or pay for the Service. Our contact details are at the end of this policy.
Audience response data. When you (as an account holder) host a Session and your audience members submit responses, questions, or upvotes, you are the controller of that personal data and we act as your processor. Section 11 below describes the processor terms that apply between us in that role.
2. Personal data we collect
2.1 Information you provide
- Account details — email address (required), name (optional), password (stored only as a bcrypt hash; we never see or retain plaintext passwords).
- Team and billing details — team name, billing email, billing address, country, VAT or tax-identification number where you provide one.
- Payment data — your card number, expiry, CVC, and other payment details are entered directly into Stripe Elements and transmitted to Stripe; we do not see, store, or process them. We receive a Stripe customer reference, the last four digits of your card, the card brand, and the expiry month and year for display in your billing settings.
- Customer Content — polls, questions, prompts, branding, and any other material you submit through the Service.
- Communications — the contents of emails or in-app feedback you send us, and any product-feedback responses you choose to provide.
2.2 Information from audience members
- A signed participant token scoped to the Session and to the /24 prefix of the audience member's IP address. The token is not linked to a name or email.
- Responses submitted to polls, questions submitted to a Q&A, and upvotes cast.
- Display name, where the audience member chooses to provide one for a particular Session.
2.3 Information collected automatically
- Server logs — request method and path, response status, response time, truncated client IP (last octet stripped), and user-agent. Retained for 14 days for debugging and security.
- Authentication audit trail — IP address and user-agent at sign-in, password reset, and other security-sensitive events. Retained for 90 days.
- Error reports — sent to Honeybadger when an unexpected error occurs. May include the URL, stack trace, request parameters (with passwords and session join codes redacted), and your User ID if you are signed in.
- Analytics — collected by Fathom Analytics. Fathom is cookieless, does not store IP addresses, and does not track visitors across sites; it records aggregate page-view counts and approximate country.
- Cookies and similar technologies — see our Cookie Policy.
3. Sources of personal data
We collect personal data directly from you, automatically when you use the Service, and from our payment processor Stripe (which provides us with your customer reference, billing-address country, tax status, subscription state, and the metadata about your payment method described in Section 2.1).
4. Why we use your personal data and our legal bases
| Purpose | Legal basis (UK GDPR / GDPR) |
|---|---|
| Create and manage your Account, host Sessions, and provide support | Performance of a contract (Art. 6(1)(b)) |
| Process payments, manage subscriptions, issue invoices, and detect fraudulent payment activity | Performance of a contract (Art. 6(1)(b)); compliance with legal obligations including tax law (Art. 6(1)(c)); legitimate interest in fraud prevention (Art. 6(1)(f)) |
| Send transactional emails such as password resets, team invitations, billing notices, and security alerts | Performance of a contract (Art. 6(1)(b)) |
| Diagnose errors, monitor and secure the Service, prevent abuse, enforce our Terms | Legitimate interest in operating a reliable and secure service (Art. 6(1)(f)) |
| Privacy-preserving analytics | Legitimate interest in understanding aggregate usage (Art. 6(1)(f)) — no cookies are set |
| Comply with our legal, accounting, and regulatory obligations | Compliance with legal obligations (Art. 6(1)(c)) |
| Send product updates and other marketing communications, where you have opted in | Consent (Art. 6(1)(a)); withdrawable at any time |
Where we rely on legitimate interests, we have completed a balancing test and concluded that our interests are not overridden by your rights or interests. You may object to processing based on legitimate interests as described in Section 7.
5. We do not sell or "share" your personal data
We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising as those terms are defined in the CCPA. We do not use your personal data for advertising of any kind.
6. Who we share data with
We disclose personal data only to (a) sub-processors that help us run the Service, (b) professional advisers and authorities where legally required, and (c) acquirers in the event of a corporate transaction.
6.1 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway Corporation | Application and database hosting | EU region where available; otherwise US |
| Stripe Payments Europe, Ltd. | Payment processing and tax calculation | Ireland (Stripe affiliates in US) |
| MailPace Ltd. | Transactional email delivery | United Kingdom and EU |
| Honeybadger Industries LLC | Error monitoring | United States |
| Fathom Analytics | Cookieless web analytics | Canada and EU |
An up-to-date list of sub-processors is available on request. We will notify Customers of material changes to this list at least 30 days in advance, giving them an opportunity to object.
6.2 Legal disclosures
We may disclose personal data where we are required to do so by law, regulation, or a binding order from a competent authority, or where disclosure is reasonably necessary to (a) enforce our Terms, (b) protect the rights, property, or safety of WhisperAsk, our users, or the public, or (c) detect, prevent, or address fraud, security, or technical issues. We will challenge requests we consider overbroad or unlawful and, where lawful, notify the affected user.
6.3 Corporate transactions
If we are involved in a merger, acquisition, financing, or sale of all or part of our business, personal data may be transferred as part of that transaction. We will provide notice and choices to affected users where required by law.
7. International transfers
Some of our sub-processors are located outside the UK and the European Economic Area, including in the United States. Where we transfer personal data to a country that has not received an adequacy decision from the relevant authority, we put in place appropriate safeguards as required by Article 46 of the UK GDPR and the GDPR. These typically take the form of the European Commission's Standard Contractual Clauses (SCCs) supplemented by the UK International Data Transfer Addendum, together with a transfer impact assessment and appropriate technical safeguards (encryption in transit and at rest). A copy of the safeguards we use is available on request.
8. Your rights
Subject to the conditions and exceptions in applicable law, you have the following rights:
- Access — to be told what personal data we hold about you and to receive a copy.
- Rectification — to ask us to correct inaccurate personal data and complete incomplete data.
- Erasure — to ask us to delete your personal data, subject to legal-retention obligations.
- Restriction — to ask us to limit how we process your personal data while a query is investigated.
- Portability — to receive personal data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller. Signed-in account holders can download their data at any time from Profile › Edit profile › Your data; the file is JSON.
- Objection — to object to processing carried out on the basis of legitimate interests, including profiling, and to object at any time to processing for direct marketing.
- Withdrawal of consent — to withdraw any consent you have given us at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Complaint — to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk); in EEA countries it is your local data-protection authority.
- California-specific rights (CCPA/CPRA) — to know the categories of personal data we collected about you, the sources, the business purposes for collecting it, and the categories of third parties to whom we disclosed it; to delete personal data; to correct inaccurate personal data; to opt out of any sale or sharing (we do not sell or share); and to be free from discrimination for exercising these rights.
To exercise any of these rights, email [email protected]. We will respond within one month of receiving a verifiable request and may extend this by a further two months for complex or numerous requests, in which case we will tell you within the first month. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive. We may need to verify your identity before responding.
For audience-response data we hold on behalf of a session host, please direct your request to the host. We will help the host respond.
9. Retention
| Category | Retention period |
|---|---|
| Account profile and team data | For the life of the account; deleted within 30 days of account closure |
| Customer Content (polls, questions, branding) | For the life of the account, or until you delete it; backups purged within 35 days |
| Audience participant tokens, responses, Q&A questions, and upvotes | Permanently deleted when a Session is archived — 7 days after it closes. After archiving, only an aggregate, anonymised results snapshot is kept (no participant tokens, no individual responses). Sessions auto-close 7 days after creation unless you close or extend them sooner. |
| Archived Session results snapshot (aggregate, anonymised) | Deleted with the Session at the end of your plan's retention period measured from close — Free 14 days, Pro 90 days, Team 180 days, Enterprise 365 days. We email the Session owner 7 days before deletion. |
| Server logs | 14 days |
| Authentication audit trail | 90 days |
| Error reports (Honeybadger) | 30 days |
| Billing records and invoices | As required by tax and accounting law (typically 7 years in the UK and EU) |
| Email correspondence | 2 years from the last interaction, unless still relevant to an ongoing matter |
10. Security
We implement the technical and organisational measures appropriate to the risks of our processing, including: TLS 1.2+ for all data in transit; AES-256 encryption for data at rest in our database and backups; bcrypt password hashing; signed and rotated session cookies; per-row authorisation enforced through Pundit; CSRF protection on all state-changing requests; rate-limiting on authentication endpoints; principle-of-least-privilege access to production systems with mandatory two-factor authentication; centralised logging and monitoring; regular dependency updates and automated security scanning; and quarterly access reviews. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We will notify affected users and supervisory authorities of personal-data breaches in accordance with Articles 33 and 34 of the UK GDPR and the GDPR (typically within 72 hours of becoming aware of a notifiable breach).
11. Processing on your behalf (data-processor terms)
This Section 11 applies where you, as an account holder, submit personal data of audience members or other third parties to the Service ("Customer Personal Data"). To the extent we process Customer Personal Data on your behalf, we agree:
- to process Customer Personal Data only on your documented instructions, including the instructions in your configuration of the Service, except where required by law (in which case we will tell you, unless the law prohibits this);
- to ensure that personnel authorised to process Customer Personal Data are bound by an obligation of confidentiality;
- to implement the technical and organisational measures described in Section 10;
- to engage sub-processors only as listed in Section 6, with notice of changes as described there, and to flow down equivalent data-protection terms;
- to assist you, taking into account the nature of the processing, with your obligations to respond to data-subject requests and to maintain the security of personal data, conduct data-protection impact assessments, and consult with supervisory authorities;
- at your choice, to delete or return Customer Personal Data at the end of the Service, except where retention is required by law;
- to make available to you the information necessary to demonstrate compliance with these obligations and to allow audits as required by Article 28(3)(h) of the UK GDPR and the GDPR (subject to reasonable confidentiality and security restrictions).
You instruct us to process Customer Personal Data as necessary to provide the Service to you and to comply with applicable law. The subject-matter is the operation of the Service; the duration is the term of your subscription; the nature and purpose are as described in this Privacy Policy and our Terms; the categories of data subjects are your audience members and other third parties whose data you submit; and the categories of personal data are as described in Section 2.2 (and any other personal data you choose to submit).
12. Marketing
We may send you product updates, tips, and other marketing emails only where you have opted in. You can withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by emailing [email protected]. Withdrawal does not affect transactional or service emails (for example, password resets, billing notices, or security alerts), which we send on the basis of contractual necessity.
13. Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing, including profiling.
14. Children
The Service is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact [email protected] and we will take prompt steps to delete it.
15. Changes to this policy
We may update this Privacy Policy from time to time. If we make a material change, we will notify account holders by email at the address associated with the Account, or by an in-app notice, at least 30 days before the change takes effect (except where a shorter period is required by law). The "Last updated" date at the top of this page always reflects the current version. Earlier versions are available on request.
16. Contact
For privacy questions, requests, or complaints:
- Email: [email protected]
- Postal address available on request.
You can also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EEA supervisory authority. We would, however, appreciate the chance to address your concerns first.