PRIVACY POLICY
What we do with personal data.
This policy explains what personal data Whipcream Ltd collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It sits alongside our Terms & Conditions, Cookie Policy and Data Processing Agreement.
Whipcream Ltd · Company no. 16958944
whipcream.io, the Whipcream platform, and our business contacts
Information Commissioner's Office (UK)
1 About this policy
This Privacy Policy explains how Whipcream Ltd ("Whipcream", "we", "us"), a company incorporated in England and Wales with company number 16958944 and registered office at Covent Garden, London, WC2H 9JQ, United Kingdom, collects and uses personal data.
It applies to our website at whipcream.io, to the Whipcream platform (the "Services"), to visitors, prospective customers, and to the individual users of our business customers.
It should be read together with our Terms & Conditions, our Cookie Policy, our Acceptable Use Policy and, where you are a business customer, our Data Processing Agreement ("DPA"). Capitalised terms not defined here have the meaning given in the Terms & Conditions.
Whipcream sells to businesses. Most of the personal data we handle is business contact data and business usage data rather than data about consumers.
This policy is governed by the UK General Data Protection Regulation and the Data Protection Act 2018 (together, the "UK GDPR"), and, where it applies to our processing, EU Regulation 2016/679 ("EU GDPR").
2 Our two roles: controller and processor
Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles personal data on a controller's instructions. Whipcream acts in both roles, and it matters which one applies to you.
We are a controller of the personal data described in section 3: account registration data, billing and payment data, support correspondence, platform usage and security telemetry, website and marketing data. This policy governs that processing.
We are a processor of the personal data contained inside Customer Data — for example CRM contact records retrieved from HubSpot, billing contacts retrieved from Stripe, or end-user identifiers retrieved from Mixpanel or Google Analytics. Our business customer is the controller of that data; it decides what to connect and why.
IF YOU ARE AN INDIVIDUAL IN A CUSTOMER'S DATA
If your personal data reached Whipcream because a business connected its CRM, billing or analytics account, that business — not Whipcream — decides why your data is used and is responsible for telling you about it. Please contact that business in the first instance. We will assist it in responding to you, as required by our DPA, and we will forward any request you send us to the relevant customer.
Section 14 explains this in more detail, and the DPA governs it contractually.
3 The personal data we collect as a controller
We collect the following categories of personal data.
The categories below are not exhaustive of every individual field, but they describe every purpose for which we hold personal data as a controller.
We do not deliberately collect special category personal data (such as health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data about sex life or sexual orientation) or criminal offence data as a controller, and our Terms & Conditions prohibit customers from connecting such data to the Services without additional agreed safeguards.
4 Where we get personal data from
Directly from you, when you sign up, start a trial, buy a subscription, contact support, complete a form or attend an event.
From your employer or the administrator of your organisation's Whipcream account, when they create an account for you or invite you as an Authorised User.
Automatically, from your use of the Services and our website, through logs, cookies and similar technologies.
From our service providers, for example payment and fraud-prevention information from our payment processor.
From publicly available sources, such as company websites and professional networks, for limited business-to-business prospecting.
5 Why we use personal data, and our lawful basis
We only use personal data where we have a lawful basis to do so. The table below sets out each purpose and the basis we rely on.
Where we rely on legitimate interests, we have carried out a balancing assessment; you may ask us for a summary of it using the contact details in section 17.
If we ever need to use your personal data for a new purpose that is not compatible with the one we collected it for, we will tell you and, where the law requires it, ask for your consent.
6 AI, profiling and automated decisions
The Services use artificial intelligence, including large language models supplied by third parties, together with our own scoring methodology, to analyse business data and generate insights, recommendations and a Revenue Health Score.
That analysis is directed at businesses and business performance, not at evaluating individuals. We do not use the Services to make decisions about you as an individual that produce legal effects concerning you or that similarly significantly affect you.
Our Terms & Conditions require our customers not to use the Services or its outputs as the sole or determinative basis for decisions about individuals — including decisions about employment, recruitment, pay, creditworthiness, insurance or access to essential services — and to ensure meaningful human review where outputs are used in connection with any such decision. If a customer uses the Services in that way, it does so as controller and is responsible for the safeguards required under Articles 22A to 22D of the UK GDPR or Article 22 of the EU GDPR.
We do not use Customer Data to train foundation or general-purpose AI models, and we do not permit our AI model providers to use it to train their models, unless the customer has expressly opted in. We do use data to operate, tune, evaluate and improve the Services, and we use anonymised and aggregated data as described in section 10.
We use profiling in a limited way for security and abuse prevention, for example to detect abnormal query volumes, duplicate trial accounts or suspected payment fraud. Where this leads to a suspension, a human reviews the decision on request. See clause 30 of the Terms & Conditions.
7 Cookies and similar technologies
We use cookies and similar technologies on our website and in the product for authentication and session management, security, remembering your preferences, and product and website analytics.
Cookies that are strictly necessary to provide a service you have requested do not require your consent. For all others we ask for your consent through our cookie banner, in line with the Privacy and Electronic Communications Regulations 2003, and you can change or withdraw that consent at any time.
Our analytics and product-analytics providers currently include PostHog and, on our website, Google Analytics. Full details of each cookie, its purpose and its lifetime are set out in our Cookie Policy.
8 Who we share personal data with
We do not sell personal data, and we do not share it for third-party advertising.
We share personal data with the following categories of recipient, in each case only as necessary and under a written contract that requires appropriate confidentiality and security.
Service providers and subprocessors, including cloud hosting and infrastructure providers, payment processing, product and CRM integrations, AI model providers, analytics providers such as PostHog, observability providers such as Langfuse, email delivery, and support tooling. A current list is published at whipcream.io/subprocessors.
Professional advisers, such as our lawyers, accountants, auditors and insurers, where they need the information to advise us.
Authorities, courts and regulators, where we are required to disclose by law or where disclosure is necessary to establish, exercise or defend legal claims. We will tell you about such a request where we are lawfully able to do so.
Acquirers and investors, in connection with a financing, merger, acquisition, reorganisation or sale of the business or its assets, subject to confidentiality obligations.
Within your own organisation, your account administrator can see the account, user and usage information associated with your workspace.
9 International transfers
We are based in the United Kingdom. Some of our service providers are located outside the UK and the European Economic Area, including in the United States.
Where we transfer personal data out of the UK or the EEA, we rely on one of the following safeguards: an adequacy decision or adequacy regulations covering the destination country; the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses; or the European Commission's Standard Contractual Clauses, in each case with any additional technical and organisational measures the transfer risk assessment identifies as necessary.
You can ask us for a copy of the relevant safeguard using the contact details in section 17. Details of the location of each subprocessor and the transfer mechanism applied are published with our subprocessor list.
10 How long we keep personal data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. Our current retention periods are as follows.
Where different periods apply to the same record, the longest applicable period governs.
We may keep aggregated and anonymised information indefinitely. We only treat information as anonymised where it cannot reasonably be used to identify you, whether on its own or in combination with other information reasonably available to us, and we apply minimum aggregation thresholds so that individual contributions cannot be inferred. Anonymised information is no longer personal data and this policy does not restrict our use of it.
11 How we protect personal data
We implement appropriate technical and organisational measures designed to protect personal data, taking account of the state of the art, the cost of implementation and the risks involved.
These currently include encryption of data in transit and at rest; role-based access control and least-privilege access for our personnel; multi-factor authentication for administrative access; storage of integration credentials and API keys in a form that is not plaintext; logging and monitoring of access to production systems; defined change management and incident response processes; and confidentiality obligations and training for our personnel.
No system can be completely secure. We do not guarantee that personal data can never be compromised; our obligation is to take appropriate measures and to act with reasonable skill and care.
If a personal data breach occurs, we will notify the Information Commissioner's Office within 72 hours where the breach is reportable, notify affected individuals where the law requires it, and notify our business customers without undue delay in accordance with the DPA and clause 23 of the Terms & Conditions.
You also have a part to play: keep your credentials confidential, enable multi-factor authentication where it is offered, and tell us promptly at support@whipcream.io if you think your account has been compromised.
12 Your rights
Subject to the conditions and exemptions in data protection law, you have the following rights in relation to personal data for which we are the controller.
Access — to be told whether we hold personal data about you and to receive a copy of it, together with information about how we use it.
Rectification — to have inaccurate personal data corrected and incomplete data completed.
Erasure — to have personal data deleted where there is no good reason for us to continue holding it.
Restriction — to ask us to pause our use of your personal data in certain circumstances, for example while we check its accuracy.
Objection — to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
Portability — to receive personal data you provided to us, in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
Withdrawal of consent — where we rely on consent, to withdraw it at any time, without affecting the lawfulness of what we did before you withdrew it.
Rights relating to automated decisions — to be informed about, to make representations about, to obtain human review of, and to contest, a significant decision made about you by solely automated means. As explained in section 6, we do not make such decisions about individuals.
To exercise any of these rights, contact us using the details in section 17. We will respond within one month, and will tell you if we need longer because your request is complex or because you have made several requests. We may need to verify your identity first. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
REQUESTS ABOUT A CUSTOMER'S DATA
If your request relates to personal data we process on behalf of a business customer — for example a CRM record — we are the processor and must refer your request to that customer, who is the controller. We will do so without undue delay and will support the customer in responding, as our DPA requires.
13 Marketing communications
We may send marketing emails about our products, features and events to business contacts, relying on consent where the law requires it, or on our legitimate interests in promoting our business to corporate subscribers where it does not.
Every marketing email contains an unsubscribe link, and you can opt out at any time by using it or by emailing info@whipcream.io. We will act on your request promptly and keep a minimal suppression record so that we do not contact you again.
Opting out of marketing does not stop service, security, billing or administrative messages about your account, which are part of providing the Services.
14 Personal data we process for business customers
Where a business customer connects a data source to the Services — such as Stripe, HubSpot, Google Analytics or Mixpanel — the personal data contained in that source is processed by us as processor, on the customer's documented instructions.
For that processing: the customer is the controller and is responsible for having a lawful basis, for giving the required privacy notices to individuals, and for the accuracy and lawfulness of the data it connects; we process the data only to provide, secure and support the Services, to generate outputs, and to comply with legal obligations; and the Data Processing Agreement governs our obligations, including subprocessors, security, assistance with individual rights, breach notification, audits, international transfers, and deletion or return of the data.
Where the DPA conflicts with this Privacy Policy in respect of that processing, the DPA prevails.
Acustomer may ask us to delete its data at any time, as set out in clause 33 of the Terms & Conditions.
The Services are intended for businesses and professional users. They are not directed at children, and Authorised Users must be at least 18 years old.
We do not knowingly collect personal data from children as a controller. If you believe a child has provided us with personal data, contact us and we will delete it.
16 Changes to this policy
We may update this policy from time to time, for example to reflect changes to the Services, to our service providers or to the law.
The current version and its effective date are shown at the top of this document. Where a change is material, we will tell you by email to the address on your account or by a prominent notice in the product before it takes effect.
Previous versions are archived and available on request.
17 How to contact us, and how to complain
For any question about this policy, or to exercise your rights, contact us at info@whipcream.io, or write to Whipcream Ltd, Covent Garden, London, WC2H 9JQ, United Kingdom.
We have not appointed a Data Protection Officer, as we are not required to do so.
If you are in the European Economic Area and we are required to appoint an EU representative under Article 27 of the EU GDPR, their details will be published here. No representative has been appointed at the version date of this policy.
If you are not satisfied with our response, you have the right to complain to a supervisory authority. In the United Kingdom this is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk. If you are in the EEA, you may complain to the supervisory authority in your country of residence, work or where the issue arose.
We would appreciate the chance to address your concerns before you approach the regulator, so please contact us first if you can.
A person answers.
Legal, procurement or security review — write to info@whipcream.io , or use the contact page.
Contact us →
Related documents
See what moves your revenue.
Agentic Revenue Intelligence
WHIPCREAM LTD 71-75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom
Company No. 16958944
info@whipcream.io
