This policy explains what personal data WhenLoop collects, why, who it's shared with and your rights. It applies to whenloop.com, the WhenLoop app and the emails we send.
Who we are
WhenLoop is run by Leon Neal, an individual based in the United Kingdom (“we”, “us”). We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact us at privacy@whenloop.com.
What we collect
When you answer a poll: the name you enter, your answers, and, if you choose to give them or the host asks for them, your email address and a note to the host. Also any comments you post.
When you create a poll: the poll's title, place, details and suggested times, and the email addresses of anyone you invite through WhenLoop.
If you create an account: your email address and name; optionally a profile photo, a password (stored only in hashed form) and details about how you use WhenLoop (such as personal or work use, organisation, industry and role); and your preferences. If you log in with Google, we receive your name, email address and profile photo from Google.
Other: your email if you join the WhenLoop Pro waitlist; anything you send us; essential cookies (see the cookie policy); a hashed (scrambled) version of your IP address, kept briefly to prevent spam and abuse; and technical logs kept by our hosting provider for security and troubleshooting.
We don't use advertising or analytics trackers.
Where we get it from
Most information comes directly from you. Some comes from other people: a host may give us your email address to invite you to a poll, or add your name and answers to a poll on your behalf (for example, if you replied by text). If you log in with Google, some details come from Google.
Do you have to give it to us?
No. But some features need certain details: for example, we need your email address to log you in, and a name to record your answers. If you'd rather not give them, you can't use those features.
Why we use it, and our lawful basis
- To provide WhenLoop (showing polls, counting answers, sending login codes, invites, notifications and confirmations): necessary to provide the service you've asked for (contract).
- To pass on invites when a host enters someone's email address: our and the host's legitimate interests in letting people know about a plan they're invited to.
- To keep WhenLoop secure, prevent misuse and fix problems: our legitimate interests.
- To improve WhenLoop from feedback you send: our legitimate interests.
- The Pro waitlist: your consent, which you can withdraw at any time by emailing us.
- To meet legal obligations, where we're required to: legal obligation.
We don't sell your personal data or use it for advertising, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who can see it
Anyone with a poll's link can see that poll and, unless the host has hidden them, the names, answers and comments of the people who have answered. Email addresses and notes are shown only to the poll's host. You choose what you type into a poll, so please don't share anything you wouldn't want others with the link to see.
Hosts decide who they share their polls with and are responsible for how they use any details they collect through them.
Service providers
We use these providers to run WhenLoop. They process personal data only on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Vercel | Hosts the website and app | UK (London); may also involve the US |
| Supabase | Stores the database | UK (London); may also involve the US |
| Resend | Sends emails such as login codes and invites | EU; may also involve the US |
| ImprovMX | Forwards emails sent to our @whenloop.com addresses | EU/US |
| Google sign-in, only if you choose to use it | Worldwide |
Some providers may process data outside the UK. Where they do, we rely on safeguards recognised under UK law, such as the UK International Data Transfer Agreement or Addendum, or UK adequacy regulations. We may also disclose information where the law requires it, or where necessary to protect our rights or someone's safety.
How long we keep it
- Polls, answers and comments: until the poll or the host's account is deleted.
- Account details: until you delete your account. Deleting your account deletes your account details and your polls. Answers you gave on other people's polls stay with those polls unless you or the host remove them, or you ask us to.
- Login codes expire after 15 minutes. Anti-spam data is kept only briefly.
- Pro waitlist sign-ups: until WhenLoop Pro launches or you ask to be removed.
- Messages you send us: only as long as needed to deal with them.
We may delete polls that haven't been used for a long time, and we may keep some information for longer if the law requires it.
Security
We use appropriate technical measures to protect your data, including encrypted connections and hashed passwords. No website can be completely secure, so we can't guarantee the security of information sent to or stored on WhenLoop.
Your rights
Under UK data protection law you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive a copy to take elsewhere. Where we rely on consent, you can withdraw it at any time. Some of these rights have exceptions set by law.
You can delete your account in Settings. For anything else, email privacy@whenloop.com. We may need to confirm your identity before acting on a request.
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to help first.
Children
WhenLoop isn't intended for children. You must be at least 13 to create an account.
Organisations
If you use WhenLoop for an organisation and need information about how we process data on your behalf, contact privacy@whenloop.com.
Changes
We may update this policy from time to time. The date at the top shows when it last changed.
Contact
Questions about privacy? Email privacy@whenloop.com.