LEGAL

Privacy Policy

How iWhale collects, uses, and protects your information. Effective August 1, 2026.

1. Information We Collect

A. Information You Provide Directly

When you contact us, request a quote, sign up for services, or fill out forms on our website, we may collect:

  • Identity & Contact Data: full name, email address, phone number, business name, job title, mailing address
  • Business Information: industry, website URL, current marketing budget, business goals, target audience details
  • Account & Billing Data: payment information (processed securely via third-party payment processors — we do not store full card numbers), billing address, transaction history
  • Project & Campaign Data: content briefs, brand assets, keyword targets, ad creative, landing page materials submitted for SEO, PPC, or web design projects
  • AI Website Builder Inputs: prompts, images, brand guidelines, and generated content created through our AI-powered website design platform
  • Communications: emails, messages, and feedback you send us

B. Information Collected Automatically

When you visit iwhale.com or use our services, we automatically collect:

  • Device & Technical Data: IP address, browser type and version, operating system, device identifiers
  • Usage & Analytics Data: pages visited, time on site, click paths, referral source, search terms used to find us
  • Marketing Attribution Data: UTM parameters, ad campaign identifiers, conversion events tracked via pixels and tags
  • Cookie & Tracking Data: first-party cookies, Google Analytics identifiers, Google Ads conversion tags, Meta Pixel events (see Section 5)
  • SEO & Performance Data: Search Console impressions, keyword rankings, Core Web Vitals metrics associated with client projects

C. Information from Third Parties

We may receive information about you from:

  • Google (Analytics, Search Console, Ads) and Meta (Facebook/Instagram Ads) platforms
  • CRM and marketing automation tools (e.g., HubSpot, Mailchimp) used to manage client communications
  • Referral partners and affiliate networks
  • Publicly available sources such as business directories and LinkedIn

2. How We Use Your Information

We use the information we collect to:

  • Deliver Services: Provide SEO, GEO/AEO, PPC, CRO, AI website design, domain registration, PQC hosting, and password management services you have engaged us for
  • Account & Project Management: Set up accounts, manage campaigns, track project milestones, and communicate progress reports
  • Billing & Payments: Process invoices, manage subscriptions, and handle refunds in compliance with our Terms of Service
  • Performance Analytics: Measure, analyze, and optimize the effectiveness of your digital marketing campaigns
  • AI Model Improvement: Improve our AI website builder and SEO tools using anonymized, aggregated data (never used to train models on identifiable client business data without explicit consent)
  • Marketing & Communications: Send service updates, educational content, case studies, and promotional offers (you may opt out at any time)
  • Security & Fraud Prevention: Monitor for unauthorized access, protect against malicious activity, and comply with our data security obligations
  • Legal Compliance: Meet our obligations under US federal and state law, GDPR, CCPA, and other applicable regulations
  • Business Operations: Conduct internal research, improve website functionality, and develop new services

3. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract Performance: Processing necessary to deliver the services you have contracted with us
  • Legitimate Interests: Analytics, service improvement, fraud prevention, and direct marketing to existing clients (always balanced against your privacy rights)
  • Legal Obligation: Compliance with applicable laws and regulations
  • Consent: Marketing emails and non-essential cookies where required by law — you may withdraw consent at any time

4. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate our website and deliver marketing services. These include:

  • Essential Cookies: Required for website functionality, security, and session management. Cannot be disabled.
  • Analytics Cookies: Google Analytics 4 to understand visitor behavior, traffic sources, and content performance. Data is anonymized where possible.
  • Advertising Cookies: Google Ads conversion tags and Meta Pixel to measure ad campaign performance, attribute leads, and enable remarketing. These may track your activity across other websites.
  • Functional Cookies: Remember your preferences, language selection, and form data to improve your experience.

You can manage cookie preferences through your browser settings or our cookie consent banner. Opting out of advertising cookies will not remove ads but will make them less relevant to you. Some services may not function properly without certain cookies.

For more information, see Google’s Privacy Policy at policies.google.com/privacy and Meta’s Data Policy at facebook.com/privacy/policy.

5. Information Sharing & Disclosure

We do not sell your personal information. We may share your information with:

  • Service Providers: Trusted third-party vendors who assist us in operating our business — including cloud hosting (LiteSpeed, Cloudflare), payment processors (Stripe), email providers, CRM software, and analytics platforms. These parties are contractually bound to protect your data and may not use it for independent purposes.
  • Advertising Platforms: Google and Meta receive conversion data and audience signals to measure the performance of your paid advertising campaigns. This is done only for services you have contracted with us and in accordance with platform data policies.
  • AI & Technology Partners: Our AI website builder uses third-party AI APIs (processed under strict data processing agreements). Inputs are not used to train external AI models without your explicit consent.
  • Professional Advisors: Attorneys, accountants, and insurers under confidentiality obligations as necessary to conduct our business.
  • Legal Authorities: When required by law, court order, or governmental authority, or to protect the rights, property, or safety of iWhale, our clients, or the public.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice on our website before your data becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information only as long as necessary for the purposes set out in this policy:

  • Active Client Data: Retained for the duration of your contract plus 7 years to comply with tax, accounting, and legal obligations
  • Marketing & Lead Data: Retained for up to 3 years from your last interaction, or until you unsubscribe or request deletion
  • Analytics & Usage Data: Aggregated data retained indefinitely; identifiable data deleted after 26 months (aligned with Google Analytics default retention)
  • AI Builder Content: Project files retained for 12 months after project completion unless you request earlier deletion
  • Legal Hold: Some data may be retained longer if required by law or in connection with pending legal proceedings

7. Your Privacy Rights

California Residents (CCPA/CPRA)

California residents have the right to:

  • Know what personal information we collect, use, disclose, and sell about you
  • Delete personal information we hold about you (subject to certain exceptions)
  • Correct inaccurate personal information
  • Opt out of the sale or sharing of personal information (we do not sell your data)
  • Limit the use and disclosure of sensitive personal information
  • Non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at support@iwhale.com. We will respond within 45 days.

EEA, UK & Swiss Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the right to:

  • Access: Obtain a copy of the personal data we hold about you
  • Rectification: Correct inaccurate or incomplete data
  • Erasure (“Right to be Forgotten”): Request deletion of your data where there is no compelling reason for its continued processing
  • Restriction: Request that we restrict processing of your data
  • Data Portability: Receive your data in a structured, commonly used, machine-readable format
  • Objection: Object to processing based on legitimate interests or direct marketing
  • Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing

To exercise these rights, contact us at support@iwhale.com. You also have the right to lodge a complaint with your local data protection supervisory authority.

All Users — Opt-Out of Marketing

You may unsubscribe from our marketing emails at any time by clicking “Unsubscribe” in any email or by contacting us directly. We will process your request within 10 business days.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include:

  • SSL/TLS encryption for all data in transit
  • Post-Quantum Cryptography (PQC) hosting infrastructure using NIST-approved standards (ML-KEM, ML-DSA, SLH-DSA) for applicable services
  • Access controls and role-based permissions limiting data access to authorized personnel
  • Regular security audits and vulnerability assessments
  • Secure password management via NordPass Enterprise for internal system access

While we take every reasonable precaution, no method of transmission over the internet or electronic storage is 100% secure. If you suspect a security breach affecting your data, please contact us immediately at support@iwhale.com.

9. Children's Privacy

Our services are designed for and directed to businesses and business professionals. We do not knowingly collect personal information from children under the age of 13. If we discover that we have inadvertently collected information from a child under 13, we will promptly delete it. If you believe we have collected such information, please contact us at support@iwhale.com.

10. Third-Party Links

Our website may contain links to third-party websites, tools, and platforms (e.g., Google, Meta, NordPass, GoDaddy). This Privacy Policy applies only to iwhale.com. We encourage you to review the privacy policies of any third-party sites you visit, as we have no control over their practices and are not responsible for their content or privacy handling.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

  • Posting the updated policy on this page with a revised “Last Updated” date
  • Sending an email notification to active clients (for significant changes affecting how we process your data)

Your continued use of our services after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

iWhale
Digital Marketing Agency
New York, NY, United States
Email: support@iwhale.com
Website: iwhale.com

For data protection inquiries from EEA/UK residents, you may also contact your local data protection authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

This Privacy Policy was last reviewed and updated on August 1, 2026.