COOKIE POLICY
What we store on your device.
This policy explains the cookies and similar technologies that Whipcream Ltd uses on whipcream.io and within the Whipcream platform, what each of them does, how long it lasts, and how you can accept, refuse or withdraw your consent at any time. It sits alongside our Terms & Conditions, Privacy Policy and Data Processing Agreement.
Whipcream Ltd · Company no. 16958944
whipcream.io and the Whipcream platform
Privacy and Electronic Communications Regulations 2003 · UK GDPR
Information Commissioner's Office (UK)
1 About this policy
This Cookie Policy explains how Whipcream Ltd ("Whipcream", "we", "us"), a company incorporated in England and Wales with company number 16958944 and registered office at Covent Garden, London, WC2H 9JQ, United Kingdom, uses cookies and similar technologies.
It applies to our website at whipcream.io and to the Whipcream platform (the "Services"), and it is addressed to website visitors, prospective customers, and the Authorised Users of our business customers.
It should be read together with our Privacy Policy, which explains the personal data we collect and the lawful bases we rely on, our Terms & Conditions, and, where you are a business customer, our Data Processing Agreement ("DPA"). Capitalised terms not defined here have the meaning given in the Terms & Conditions.
This policy is referred to in clause 24.6 of the Terms & Conditions and in section 7.3 of the Privacy Policy, and forms part of the documents incorporated into the Agreement under clause 3.1 of the Terms & Conditions.
2 What cookies and similar technologies are
A cookie is a small text file placed on your device when you visit a website or use a web application. It allows the site to recognise your device on later visits, to keep you signed in, and to record how the service is used.
We also use technologies that work in a similar way and are treated the same way under this policy, including local storage and session storage in your browser, software development kits and pixels used for analytics, and security tokens issued when you authenticate.
A first-party technology is set by whipcream.io or by the platform itself. A third-party technology is set by a provider acting on our behalf, such as our analytics or observability providers. Both are covered by this policy.
A session cookie is deleted when you close your browser. A persistent cookie remains on your device until it expires or until you delete it.
3 Where this policy applies
This policy applies to the technologies that Whipcream sets, or instructs a provider to set, on whipcream.io and in the platform, and to the personal data collected through them, for which Whipcream is the controller as described in section 2.2 of the Privacy Policy.
It does not apply to cookies set by websites operated by our business customers, by a Third-Party Service such as Stripe, HubSpot, Google Analytics or Mixpanel on the customer’s own properties, or by any other site you reach from a link in our Services. Those technologies are governed by the operator’s own cookie and privacy notices.
DATA REACHING US THROUGH A CUSTOMER INTEGRATION
Where analytics identifiers or usage events reach Whipcream because a business connected its own analytics, CRM or billing account to the Services, that business decides why the data is used and is responsible for the cookie notice and consent on its own properties. Whipcream acts as processor for that data, as set out in section 14 of the Privacy Policy and in the DPA. Please contact that business in the first instance.
4 Consent, and how to change your choices
Cookies and similar technologies that are strictly necessary to provide a service you have requested do not require your consent under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003.
For analytics we ask for your consent through our cookie banner before anything is set. Non-essential technologies are not placed on your device unless and until you accept them.
The banner offers two choices of equal weight, Accept analytics and Decline analytics. Declining is as easy as accepting, and nothing is pre-selected on your behalf.
You may change or withdraw your consent at any time, without affecting the lawfulness of what was done before you withdrew it, by:
(a) opening the Cookie settings link in the footer of whipcream.io;
(b) clearing the site data for whipcream.io in your browser, which resets your recorded preference and causes the banner to appear again; or
(c) emailing info@whipcream.io.
We record your choice in your browser's local storage so that we do not ask you again on every visit. That record is itself strictly necessary, because it is what allows us to honour your decision.
We ask for your consent again when our purposes change materially, when we add a provider in a category you have accepted whose processing is materially different, and in any event no later than 12 months after your last recorded choice.
5 The categories we use
We group the technologies we use into three categories. Only analytics needs your consent: functional items hold choices you make yourself in the interface, and are set only when you make one. We do not use marketing or attribution technologies.
We do not use cookies or similar technologies to build advertising profiles, we do not sell the data collected through them, and we do not share it for third-party advertising, consistent with section 8.1 of the Privacy Policy.
6 Cookies and similar technologies on whipcream.io
The following are used on our public website. Names and durations are those in force at the version date of this policy and are reviewed whenever a provider changes.
Google Analytics runs only on whipcream.io, with Google signals and ad personalisation switched off. Declining or withdrawing consent deletes the _ga cookies already set.
7 Cookies and similar technologies in the platform
Inside the product we use a smaller set of technologies, most of which are strictly necessary to sign you in and to keep your workspace secure.
Local storage is used in the product to hold short-lived interface state, such as an unsaved filter or the position of a panel. It is cleared when you sign out or when you clear site data in your browser.
Langfuse, our LLM observability provider, does not set cookies on your device. It receives operational telemetry from our servers, as described in section 8.3 of the Privacy Policy and in Annex 3 of the DPA.
8 Analytics and product analytics
Our analytics and product-analytics providers currently include PostHog, which hosts in the European Union, and, on our website only, Google Analytics, as stated in section 7.3 of the Privacy Policy.
We use analytics to understand which pages and features are used, to detect errors and performance problems, and to prioritise product work. We rely on your consent to set these technologies, and on our legitimate interests in running and improving our product for the analysis that follows, as set out in section 5.2 of the Privacy Policy.
We configure our analytics providers to minimise identifiers where the product is not degraded by doing so, consistent with the pseudonymisation and minimisation measure in Annex 2 of the DPA. Where a provider offers IP truncation or anonymisation, we enable it.
Analytics data collected in this way is used to produce aggregated and anonymised statistics. Once information is genuinely anonymised it is no longer personal data, and section 10.3 of the Privacy Policy governs our use of it.
9 Third-party technologies and international transfers
Where a third-party provider sets a technology on our behalf, that provider processes the resulting data under a written contract requiring appropriate confidentiality and security, as described in section 8.2 of the Privacy Policy. A current list of our providers is kept in Annex 3 of the DPA at whipcream.io/data.
Some providers are located outside the United Kingdom and the European Economic Area, including in the United States. Where we transfer personal data collected through cookies out of the UK or the EEA, we rely on an adequacy decision or adequacy regulations, on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, or on the European Commission’s Standard Contractual Clauses, in each case with any additional measures identified as necessary by a transfer risk assessment. Section 9 of the Privacy Policy and section 12 of the DPA set this out in full.
You may ask us for a copy of the safeguard relied on for a particular provider using the contact details in section 16.
10 How long cookies last
The duration of each item is stated in the tables in sections 6 and 7. Session items are deleted when you close your browser. Persistent items expire on the date shown, or earlier if you delete them or withdraw your consent.
Withdrawing consent stops the further setting of non-essential technologies and, where the provider supports it, instructs deletion of those already set. Items already stored on your device can also be removed at any time using your browser, as described in section 11.
Personal data derived from cookies and held in our systems is retained in accordance with section 10 of the Privacy Policy, in particular the periods stated there for usage and telemetry data, security and audit logs, and marketing and prospect data.
11 Managing cookies in your browser and on your device
In addition to our cookie banner, every major browser allows you to see the cookies stored for a site, to delete them, to block third-party cookies, and to block cookies entirely. The controls are usually found in the privacy or site settings section of the browser.
Browser settings are specific to the browser and the device you are using, so a choice made in one browser does not carry over to another browser or to another device.
Blocking or deleting strictly necessary items will prevent you from signing in, will end your session, and will cause your recorded cookie preference to be forgotten, which means the banner will appear again.
12 Technologies set by our business customers
Our business customers connect their own analytics, CRM and billing sources to the Services. The cookies and identifiers that generated the data in those sources were set on the customer’s own websites and applications, not by Whipcream.
The customer is the controller of that data, is responsible for its own cookie notice and for obtaining any consent required on its own properties, and warrants under clause 16.2 of the Terms & Conditions and section 3.2 of the DPA that it has the rights and lawful bases necessary to provide it to us.
If you are an individual whose data reached us in that way and you wish to exercise your rights, please contact that business first. We will forward any request you send us to the relevant customer without undue delay and will support it in responding, as required by section 9 of the DPA.
13 Browser signals and Do Not Track
There is no single, universally adopted standard for Do Not Track signals, and we do not currently respond to them.
We honour a Global Privacy Control signal by treating it as a refusal of analytics, and we do not show the banner while it is present. If you send such a signal and later accept categories through our banner, the choice you make in the banner applies.
14 What happens if you refuse
Refusing non-essential technologies does not prevent you from browsing whipcream.io, from requesting a demo, or from contacting us.
You can also sign in to and use the platform, because authentication relies only on strictly necessary technologies. Your saved interface preferences are functional and are not affected.
Refusal has no effect on your subscription, on the Fees, or on any right you have under the Agreement.
15 Changes to this policy
We may update this policy, for example when we add or remove a provider, when a duration changes, or when the law or regulatory guidance changes.
The current version and its effective date are shown at the top of this document. Where a change is material we will tell you by a prominent notice on the website or in the product before it takes effect, and, where the change concerns a non-essential category, we will ask for your consent again.
Previous versions are archived and available on request. Clause 36 of the Terms & Conditions governs changes to the Agreement more generally.
16 How to contact us, and how to complain
For any question about this policy, or to ask about a specific cookie or provider, contact us at info@whipcream.io, or write to Whipcream Ltd, Covent Garden, London, WC2H 9JQ, United Kingdom.
We have not appointed a Data Protection Officer, as we are not required to do so.
If you are not satisfied with our response, you may complain to a supervisory authority. In the United Kingdom this is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk. If you are in the EEA, you may complain to the supervisory authority in your country of residence, work or where the issue arose.
We would appreciate the chance to address your concerns before you approach the regulator, so please contact us first if you can.
A person answers.
Legal, procurement or security review — write to info@whipcream.io , or use the contact page.
Contact us →
Related documents
See what moves your revenue.
Agentic Revenue Intelligence
WHIPCREAM LTD 71-75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom
Company No. 16958944
info@whipcream.io
