Privacy Policy

1. Introduction

Whitecap Data LLC ("Whitecap Data," "we," "us," or "our") operates the website at whitecapdata.com, the authentication gateway at login.whitecapdata.com, and the tenant analytics dashboard at cana.whitecapdata.com (collectively, the "Services"). This Privacy Policy describes what personal information we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have.

This policy applies to all visitors to whitecapdata.com and all authorized users of the Whitecap Data dashboard.

If you are a California resident, see Section 12 for additional disclosures required under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). If you are an EU, UK, or Swiss resident, see Section 13b for your rights under the GDPR / UK GDPR / Swiss FADP.

This policy does not apply to information we process solely on behalf of our business customers as a data processor. Those arrangements are governed by a separate Data Processing Agreement (DPA) executed with each customer.

Contact for any privacy question: privacy@whitecapdata.com, or write to Whitecap Data LLC, 19 Columbia Street, Geneva, NY 14456.

2. Information We Collect

We collect information in three ways: information you provide to us, information collected automatically, and information received from third parties.

2a. Information You Provide

2b. Information Collected Automatically

• Log data: IP address, user agent, referring URL, pages visited, timestamps. Retained per Section 6.
• Cookies and similar technologies: Strictly necessary cookies (Clerk session, cookie-consent preference) plus, only after you accept via the consent banner, Google Analytics 4 cookies used to understand how visitors use the marketing site. See Section 8 for the full cookie table.
• Error events: Errors encountered while using the Services are sent to our error-tracking service (Sentry). PII is redacted before transmission; stack traces and exception messages are retained for 90 days.

2c. Information from Third Parties

• Stripe: Payment-confirmation metadata via webhook (charge ID, customer email, business name from the checkout custom field). We do not receive or store raw payment card data. Stripe acts as an independent data controller for its own fraud-prevention and compliance purposes.
• Clerk: User identity data (user ID, email, organization membership) shared with us to authorize dashboard access.
• Shopify (B2B customers only): Customer's Shopify store data (products, sales, inventory) accessed under authorization granted by the merchant customer. Processed on behalf of the customer, not for Whitecap Data's independent purposes.

3. How We Use Your Information

We do not use personal information to make automated decisions that produce legal or similarly significant effects. We do not currently send marketing email; if that changes, we will obtain consent first where required and you will be able to unsubscribe from every message.

4. How We Share Your Information

We do not sell or rent personal information to third parties for their own marketing purposes. We share information in these limited circumstances:

• Service providers (sub-processors): Third-party vendors who help operate the Services. Each is bound by a written data processing agreement. The current sub-processor list is at whitecapdata.com/trust/sub-processors.
• Business transfers: If Whitecap Data is acquired, merged, or undergoes a change of control, personal information may be transferred as part of that transaction. We will notify affected users via email or a notice on our website before any transfer.
• Legal compliance: We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of Whitecap Data, our customers, or others.
• With your consent: When you have given us explicit consent to do so.

We do not share personal information with advertising networks or data brokers. We do not use cross-context behavioral advertising pixels.

5. Customer Data (Whitecap Data as Processor)

When a business customer grants us access to their systems or uploads data to the dashboard, we process that data strictly on the customer's behalf and under their instructions, as a data processor. Our processing of such customer data is governed by our Data Processing Agreement (DPA), not this Privacy Policy. If you are an individual whose data was shared with us by a Whitecap Data customer, please contact that customer directly regarding your rights.

6. Data Retention

7. Security

We implement administrative, technical, and physical safeguards appropriate to the size of our business and the sensitivity of the data we hold. These include:

• TLS 1.2+ on every external request; HSTS with preload on every public domain.
• Multi-factor authentication required on every administrative account.
• Encryption at rest for backups; documented secret rotation cadence; least-privilege access.
• An incident-response program with documented runbooks.
• Quarterly security audits across infrastructure, dependencies, and configuration.

Our full security program is documented in our Written Information Security Program (WISP), which is available to customers under NDA on request.

No method of transmission over the Internet is 100% secure. If you believe your account has been compromised, contact us immediately at security@whitecapdata.com.

8. Cookies and Tracking

The dashboard (cana.whitecapdata.com) and gateway (login.whitecapdata.com) set Clerk-managed session cookies that are strictly necessary for authentication. The marketing site (whitecapdata.com) shows a consent banner on your first visit; non-essential cookies are blocked until you accept, and declining sets nothing beyond the consent-preference cookie itself. The cookies in use:

You can change your choice at any time: open cookie preferences. Google's use of analytics data is described in its privacy policy.

Global Privacy Control (GPC): If your browser transmits a GPC signal, we honor it as a valid opt-out for California residents under CCPA §1798.135(b)(1) — analytics stays off and the consent banner is not shown unless you explicitly opt in.

9. Children's Privacy

The Services are intended for use by businesses and professionals. We do not knowingly collect personal information from children under 13, and the Services are not directed to children under 13. If you believe a child has provided us with personal information, contact us at privacy@whitecapdata.com and we will promptly delete it.

10. International Transfers

Whitecap Data operates from the United States and our sub-processors are listed at whitecapdata.com/trust/sub-processors. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

For European Economic Area (EEA), United Kingdom, and Swiss data subjects: transfers of your personal data from the EEA, UK, or Switzerland to the United States rely on either (a) the EU–US Data Privacy Framework (and its UK Extension and Swiss–US Data Privacy Framework) where the receiving sub-processor is certified under those frameworks (Cloudflare, Stripe, GitHub, Sentry, and others on our sub-processor page are DPF-certified), or (b) the European Commission's Standard Contractual Clauses (SCCs) where DPF certification is unavailable, supplemented by additional technical and contractual safeguards. A copy of the executed SCCs for any specific data flow is available on request to privacy@whitecapdata.com.

We do not currently appoint an EU representative under Article 27 GDPR because our processing of EEA-resident data is occasional, does not include large-scale processing of special-category data, and is unlikely to result in a risk to the rights and freedoms of data subjects. This determination will be revisited if our EEA-facing activities expand.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy at this URL with an updated effective date. For material changes, we will provide at least 30 days' advance notice by email to account holders before the change takes effect. Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised policy. Prior versions are archived in our public Git history.

12. California-Specific Rights (CCPA / CPRA)

This section supplements the disclosures above for California residents.

12a. Categories of Personal Information Collected

We do not collect: biometric data, geolocation data, audio/visual data, government-issued identifiers, mental-health data, or sensitive personal information beyond the account credentials we manage through Clerk.

12b. Sub-processors

The current sub-processor list is at whitecapdata.com/trust/sub-processors. As of 2026-05-28 it includes Cloudflare, DigitalOcean, Clerk, Stripe, Resend, GitHub, Sentry, and Shopify (B2B data source — customer's account, used under customer authorization only). The deployed Whitecap Data products do not call third-party AI APIs at runtime.

12c. California Consumer Rights

California residents have the right to:

• Know: request disclosure of what personal information we have collected, used, disclosed, or sold about you in the past 12 months.
• Delete: request deletion of personal information we have collected from you, subject to exceptions in CCPA §1798.105(d).
• Correct: request correction of inaccurate personal information.
• Opt-Out of Sale/Sharing: we do not sell or share personal information. We honor Global Privacy Control (GPC) signals.
• Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without the right to limit.
• Non-Discrimination: we will not discriminate against you for exercising these rights.

To exercise any of these rights, submit a request to privacy@whitecapdata.com with the subject "California Privacy Rights Request." We will respond within 45 days (extendable to 90 days with notice). We may verify your identity before processing the request. Authorized agents may submit requests on your behalf with your written authorization.

13. Your Rights (General)

Regardless of your location, you may contact us at privacy@whitecapdata.com to:

• Access or correct your personal information
• Request deletion of your account
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

13b. EU / UK / Swiss Resident Rights (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the EU General Data Protection Regulation, the UK GDPR, or the Swiss Federal Data Protection Act, as applicable:

• Right of access (Art. 15) — confirmation of whether we process your data and a copy of that data
• Right to rectification (Art. 16) — correction of inaccurate data
• Right to erasure (Art. 17) — deletion subject to the exceptions in Art. 17(3)
• Right to restriction of processing (Art. 18) — pause processing while a dispute is resolved
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest, including direct marketing
• Right not to be subject to automated decision-making (Art. 22) — we do not currently engage in automated decision-making with legal or similarly significant effects
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw at any time without affecting prior processing
• Right to lodge a complaint with a supervisory authority (Art. 77) — contact your local Data Protection Authority

To exercise any of these rights, email privacy@whitecapdata.com with the subject "EU / UK Privacy Rights Request." We will respond within one month per Art. 12(3), extendable by two additional months for complex requests with notice. We may verify your identity before processing the request.

Data Protection Officer: we are not required to appoint a DPO under Art. 37 GDPR (our processing does not meet the thresholds for mandatory appointment). For data-protection matters, contact privacy@whitecapdata.com directly.

Supervisory authority for EU residents in the absence of an appointed lead supervisory authority: your local national Data Protection Authority. For UK residents: the Information Commissioner's Office (ICO).

14. Contact Us

Whitecap Data LLC
19 Columbia Street
Geneva, NY 14456
Email: privacy@whitecapdata.com
For security disclosures: security@whitecapdata.com