Privacy Policy

1. Controller

The controller of personal data relating to the Whelmly app is Katarzyna Lebek, address: ul. Bałkańska 12c/5, 42-600 Tarnowskie Góry, Poland, email: whelmlyask@gmail.com.

For privacy enquiries, contact: whelmlyask@gmail.com.

2. Data processed by Whelmly

Depending on the features you use, the app may process:

• content you save in the app, including saved topics, lists and settings;
• text or audio recording that you voluntarily submit to an AI feature;
• app settings, such as language, appearance, preferences and AI consent;
• a random installation identifier, AI usage counter, selected limit and technical data needed to secure the service and enforce limits;
• basic purchase or subscription information, if payments are activated.

The app does not require an account. Saved topics and settings are stored locally on your device. They are not synchronised with an account or automatically backed up to the cloud. Uninstalling the app or clearing its data may remove these records. The app lock does not provide full encryption of the local database.

3. AI features

AI is optional. When you choose an AI feature and provide the required consent, the selected text or audio is sent through Whelmly’s Cloudflare server to OpenAI services to provide the requested response, transcription or other feature.

Whelmly does not use conversation content for advertising profiles. AI responses may be inaccurate and do not replace professional help. Content may be automatically checked for safety; such checks can make mistakes. Whelmly does not store the result of a safety check as a diagnosis.

OpenAI may process data under its own terms and service settings. Depending on the service and provider configuration, data may be retained for a limited period for security and abuse prevention, for example for up to 30 days. Do not submit information you do not want these providers to process.

4. Purposes and legal bases

Data is processed to:

• provide app features and store your local records;
• provide an AI feature you request, based on your consent and to perform that feature;
• secure the service, enforce usage limits, prevent abuse and account for costs, based on the controller’s legitimate interests;
• handle payments and subscriptions, if activated, to perform a contract and comply with legal obligations;
• respond to enquiries and handle claims, based on legitimate interests or legal obligations.

You may withdraw consent to AI by not using the feature or changing the consent setting. Withdrawal does not affect processing that took place before withdrawal.

5. Recipients and international transfers

We do not sell your data. Where necessary to provide the service, data may be processed by:

• Cloudflare — hosting and securing the Whelmly server;
• OpenAI — providing selected AI features;
• Google Play / Google — app distribution and, once purchases are activated, payment processing;
• [ad provider name] — only after advertising is implemented.

Providers may process data outside the European Economic Area. Where this happens, transfers rely on mechanisms available under the GDPR that apply to the relevant provider and service. You can contact the controller for details of the safeguards currently in use.

6. Data retention

Saved topics, lists and settings remain on your device until you delete them or clear the app’s data.

A server-side usage record linked to a random installation identifier is retained for usage limits and security. Inactive records are deleted after 30 days. Aggregate AI cost statistics that contain no content and no installation identifier may be retained for 90 days. Purchase accounting records, if purchases are activated, will be retained for the periods required by law.

[Before publication, verify these periods against the current server and provider configuration.]

7. Your rights and data deletion

You may request access to, correction or deletion of your data, restriction of processing and, where applicable, data portability. You may also object where the law provides that right. If processing is based on consent, you may withdraw it.

You can delete topics and lists in the app. The “Delete my data” feature, where available in your app version, is intended to delete local data and submit a request to delete the server-side installation record. An internet connection may be needed to delete server data. You can also contact the controller at whelmlyask@gmail.com.

You may lodge a complaint with the Polish Data Protection Authority (UODO) or another competent supervisory authority.

8. Children and age

Whelmly is intended for people aged 13 or older. AI features are available to people who confirm that they are at least 16. The app is not directed to children under 13. Do not use a feature if you do not meet its age requirement.

9. Security and changes

We use measures intended to protect data, including access controls and server safeguards. No method of transmission or storage can guarantee absolute security.

This policy may be updated if the app, the law or data processing changes. The current version will be available at /en/privacy/.

10. Advertising and payments — complete before activation

Advertising: do not describe the app as using ads until an ad provider has actually been integrated and configured. Before activation, add: [SDK/provider name], data types, ad personalisation, legal basis, user consent and privacy settings.

Payments: until purchases are activated, the app does not charge subscription fees. Before activating payments, add details about Google Play Billing, data processed for purchases, retention periods and a link to the subscription terms.