1. Data Controller

The data controller responsible for your personal data is:

Ece Vural (trading as Whisprice)

KVK number: 97772305

Address: Kingsfordweg 151, 1043GR Amsterdam, the Netherlands

Email: support@whisprice.com

Whisprice does not have a formally designated Data Protection Officer (DPO), as we do not meet the thresholds requiring one under Article 37 GDPR. All data-related requests are handled directly by the contact details above.

2. Information We Collect

We collect only the data necessary to provide and improve the Whisprice service. Below is a full description of the personal data we process:

2.1 Account Data

• Name: can be updated by you at any time. We do not retain historical values.

• Email address: cannot be changed after registration.

• Account creation method (Apple or Google): cannot be changed after registration.

• Profile picture: stored via Firebase and can be updated at any time.

• We do not store any passwords. Login and registration are handled entirely by Apple Sign-In and Google Sign-In.

2.2 URL Tracking and Purchase Data

• URLs you submit for price tracking, along with associated notification and language preferences.

• Saved purchase information including product name, purchase date, and purchase price, used to calculate and display savings insights.

• Current price and first-tracked price, used solely to calculate your savings.

• Product links may be converted to affiliate links where the retailer is one of our partners. This is disclosed via an information icon on every product detail page. Whisprice may earn a commission when you visit a retailer through a tracked link. This does not affect the price you pay.

2.3 Product Notes

• You may add private notes to tracked products. These notes are stored in Firebase and are not shared with other users.

• Private notes may be accessed by Whisprice in strictly limited circumstances, such as when required by law or to investigate a serious technical or security issue. Notes are never used for marketing or analytics purposes.

2.4 Device and Technical Data

• Device brand, model, and app version, used for analytics and customer support.

• IP address: processed transiently to determine your country for accurate price tracking. Only the derived country is stored. The IP address itself is not retained.

• System language and notification token, used to deliver push notifications in your preferred language.

2.5 Local Storage (On-Device)

• App language setting

• Chosen preferences such as default filters and product rating criteria

• Login session token

• Notification preferences

No sensitive personal data is stored in local storage beyond what is essential for secure and smooth app operation.

2.6 Subscription Data

• Subscription plan tier (e.g. Flexible or Smart Saver), start date, end date, and active status.

• Payment processing is handled entirely by the Apple App Store or Google Play Store via RevenueCat. We receive only confirmation of your payment status. We do not store credit card or financial account data.

2.7 Analytics and Session Data

Login activity and session behavior, processed via Google Analytics, Elastic, and our in-house event logging system.

2.8 Support Communications

If you contact us with a complaint or support request, we may use your email address to respond. We do not initiate unsolicited contact via email.

2.9 External Links and Third-Party Sites

Whisprice allows you to navigate to external retailer pages. Once you leave the app, the privacy practices of those sites are governed by their own privacy policies. We are not responsible for the data practices of external websites.

3. Legal Basis for Processing

We process your personal data under the following legal bases as defined in Article 6 GDPR:

Contract performance (Article 6(1)(b)): Account data, URL tracking data, saved purchase data, device data, subscription data, and notification tokens are processed because they are necessary to deliver the service you have signed up for.

Legitimate interests (Article 6(1)(f)): Analytics and session data, device and app version information, and affiliate link conversion are processed on the basis of our legitimate interest in operating, improving, and financially sustaining the Whisprice service. We apply appropriate safeguards including data minimization and defined retention limits.

 Consent (Article 6(1)(a)): Marketing push notifications and marketing emails are sent only where you have explicitly opted in. You may withdraw consent at any time through your in-app notification preferences.

 Legal obligation (Article 6(1)(c)): Subscription transaction records are retained for 7 years to comply with Dutch tax and accounting obligations.

4. How We Use Your Information

We use the data we collect exclusively to:

• Deliver and personalise the Whisprice experience, including account management, price tracking, and savings insights

• Send price change and stock alerts (enabled by default as core service features)

• Send Feature Update notifications (enabled by default; you may opt out at any time)

• Send marketing push notifications and emails, where you have explicitly opted in

• Display affiliate brand suggestions within the app (affiliate relationships will be clearly disclosed when this feature launches)

• Analyse app performance and diagnose technical issues

• Determine your country from your IP address to improve price tracking accuracy

• Manage and validate your subscription status

• Respond to support requests, complaints and feature requests via email

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

• Account data (name, email, account type, profile picture): retained for the duration of your account. Accounts with no login activity for more than 12 months are scheduled for deletion. All account data is deleted within 90 days of account closure.

• URL tracking data and saved purchase information: retained until you explicitly delete the tracked item or close your account. Deletion is permanent and no historical URL data is retained afterwards.

• Private notes: retained until you delete them or close your account.

• Device data (brand, model, app version, country): retained for the duration of your account.

• Subscription data (internal logs): retained for 7 years from the transaction date to comply with Dutch tax and accounting law. Payment records are managed by RevenueCat under their own privacy policy.

• Analytics and session data: retained for a maximum of 36 months, after which it is deleted or anonymized.

• Notification tokens: deleted when your account is closed or when the token expires or is refreshed, whichever comes first.

• Support communications: retained for as long as reasonably necessary to resolve your request.

6. Third-Party Services and International Data Transfers

To operate Whisprice, we rely on the following trusted third-party processors. Our primary servers and databases are hosted in the Netherlands. Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Amazon Web Services (AWS), EU region (Frankfurt): hosting and secure data storage. Data remains within the EEA.

• Firebase (Google), EU region: push notification delivery, profile picture storage, private notes storage, and error tracking. Data remains within the EEA.

• Google Analytics, EU region: aggregated usage analytics. Data remains within the EEA.

• Elastic, EU region: internal performance monitoring and search indexing. Data remains within the EEA.

• RevenueCat, US-based: subscription management and payment status confirmation. Data is transferred to the US under Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46 GDPR.

We do not sell your personal data. 

We may share anonymised or aggregated data (containing no identifiable personal information) for research or product benchmarking purposes.

7. Affiliate Links and Commercial Relationships

Whisprice may convert product URLs you submit into affiliate links where the retailer is one of our partners. When you visit a retailer through such a link, Whisprice may earn a commission. This does not affect the price you pay.

An information icon (i) is displayed on every product detail page, regardless of whether that product has an affiliate link. Tapping it explains how affiliate links work and what it means for you.

Whisprice may also display affiliate brand suggestions within the app. These will be clearly labelled as such when the feature is active.

Affiliate activity is processed on the basis of our legitimate interests in operating and financially sustaining the service. It does not involve sharing your personal data with retailers or advertisers.

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. To exercise any of these rights, please contact us at support@whisprice.com. We will respond within 30 days.

Right of access (Article 15): You may request a copy of the personal data we hold about you.

Right to rectification (Article 16): You may request correction of inaccurate data. You can update your name and profile picture directly in the app at any time.

Right to erasure (Article 17): You may request deletion of your personal data. You can delete your account or specific tracking history directly within the app. Full deletion is completed within 90 days. Subscription records may be retained for up to 7 years for legal compliance.

Right to restriction of processing (Article 18): You may request that we limit processing of your data in certain circumstances, for example if you contest its accuracy.

Right to data portability (Article 20): You may request a copy of your personal data in a structured, commonly used, machine-readable format such as JSON or CSV, or request that it be transferred to another controller where technically feasible.

Right to object (Article 21): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent: Where processing is based on consent such as marketing notifications or emails, you may withdraw consent at any time through your in-app notification preferences, without affecting the lawfulness of prior processing.

You have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), if you believe we have not handled your data in accordance with GDPR: www.autoriteitpersoonsgegevens.nl

9. Push and Email Notifications

Whisprice sends the following types of notifications. You can manage all preferences at any time via the Notifications screen in the app:

Push Notifications

• Price Drops and Price Increase alerts: enabled by default as these are core to the service. You may disable them at any time.

• Product Availability Updates: opt-in only.

• Feature Updates: enabled by default as informational service notices. You may disable them at any time.

Email Notifications

• Price Drop emails: enabled by default as a core service feature. You may disable them at any time.

• Smart Shopping Tips and Guides: opt-in only. Requires explicit consent.

• Deals and Promotions: opt-in only. Requires explicit consent.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens (AP) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected users directly without undue delay, as required by Article 34 GDPR.

11. Security of Your Information

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or disclosure. Data is encrypted in transit and at rest. Access to personal data is restricted to authorised personnel only.

12. Use of Cookies on the Website

We use cookies exclusively for anonymous analytics on our website https://www.whisprice.com. These cookies help us understand general usage patterns such as page views, in order to improve performance and usability.

We do not use cookies for advertising, personalisation, or to collect identifiable personal data. All analytics data is aggregated and anonymised.

You can accept or decline analytics cookies via the consent banner shown when you first visit our website. Your preferences can be updated at any time.

13. Children's Privacy

The Whisprice service is designed for a general audience and is not directed at children. We do not knowingly collect personal data from children under the age of 13 without verified parental consent. If we become aware that such data has been collected, we will delete it immediately.

14. California Consumer Privacy Act (CCPA)

If you are a California resident, you have the right to know what personal data we collect about you, the right to request deletion of your personal data, and the right to opt out of the sale of personal data. Whisprice does not sell personal data. To exercise your rights under CCPA, please contact us at support@whisprice.com.

15. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in our operations, legal requirements, or user feedback. The date of the most recent update is displayed at the top of this document. When significant changes are made, we will notify you through the app or by email. Continued use of Whisprice after an update constitutes acceptance of the revised terms.

16. Contact Us

For any questions, data access requests, or complaints regarding this Privacy Policy or our data practices, please contact:

Ece Vural (trading as Whisprice)

KVK number: 97772305

Address: Kingsfordweg 151, 1043GR Amsterdam, the Netherlands

Email: support@whisprice.com

You also have the right to contact the Autoriteit Persoonsgegevens (AP) directly: www.autoriteitpersoonsgegevens.nl

In the event of any conflict or inconsistency between the English version and any translated version of this document, the English version shall prevail.