Privacy Policy

1. Introduction

Whistle AI (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our keyword intelligence platform at usewhistle.co and app.usewhistle.co.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our service.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address (via Google OAuth through Clerk)
• Business context: company name, website URL, product description, competitor names, industry
• Google Search Console (GSC) access: OAuth tokens to read your GSC property data

2.2 Information Collected Automatically

• GSC data: search queries, clicks, impressions, CTR, average position, and page URLs from your connected Google Search Console property
• Usage data: how you interact with our dashboard (page views, features used)
• Technical data: IP address, browser type, device information, log data

3. How We Use Your Information

• To provide and improve the Whistle AI platform
• To run keyword analysis, clustering, and SEO intelligence on your GSC data
• To generate reports and insights for you
• To authenticate you and maintain your account
• To communicate with you about your account or our service
• To comply with legal obligations

4. Data Storage and Security

Your data is stored on secure infrastructure (Supabase PostgreSQL). We implement industry-standard security measures including:

• AES-256-GCM encryption for OAuth tokens at rest
• Row-level security (RLS) on all database tables
• HTTPS for all data in transit
• Authentication via Clerk with Google OAuth

Your GSC data is isolated per user — no other user can access your data.

5. Third-Party Services

We use the following third-party services:

• Clerk — Authentication and user management
• Google (GSC API) — To read your Search Console data with your authorization
• Anthropic (Claude AI) — AI-powered analysis of your business context (see Section 5.1)
• Supabase — Database hosting (PostgreSQL)
• Railway — Application hosting
• Resend — Transactional email

Each third-party service has its own privacy policy. We do not sell your data to any third parties.

5.1 AI Processing (Anthropic Claude)

Whistle AI uses Anthropic's Claude AI to generate keyword intelligence, including seed keyword discovery, keyword expansion, and funnel classification. The following data is sent to Anthropic for processing:

• Business context you provide: company name, product description, industry, competitor names
• Aggregated keyword data: search queries, clusters, and topic groupings

What is NOT sent to Anthropic: your Google OAuth tokens, your email address, your personal account information, or raw Google Search Console API responses. We send only the business context necessary for analysis.

Anthropic processes this data under their Privacy Policy. Per Anthropic's API terms, data sent via their API is not used to train their models.

6. Google API Services

Whistle AI uses Google Search Console API to access your GSC data. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We access your GSC data solely to provide the Whistle AI analysis service. We do not share raw GSC data with any third parties. Business context you provide (company name, keywords, competitors) may be sent to Anthropic Claude for AI-powered analysis as described in Section 5.1. Raw GSC API responses and OAuth tokens are never shared.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Revoke Google Search Console access at any time via your Google Account settings
• Data portability — receive your data in a structured format

To exercise these rights, contact us at [email protected].

8. Data Retention

We retain your data for as long as your account is active. When you delete your account, we will delete all associated data within 30 days, except where retention is required by law.

9. Children's Privacy

Whistle AI is not intended for individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or a prominent notice on our platform. Continued use of Whistle AI after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: