Privacy Policy

Data controller

The data controller is: (legal entity name), (legal form), with share capital of (share capital), registered with the Trade and Companies Register of (RCS city) under number (SIRET / SIREN), whose registered office is at (registered office address).

Contact: support@whatcopilot.com. Data Protection Officer / privacy contact if any: (DPO or privacy contact if distinct).

Scope

WhatCopilot is a third-party analytics and AI copilot product for Whatnot sellers. We are not affiliated with Whatnot. This policy applies to whatcopilot.com and the product (signed-in workspace, CSV imports, Orion, etc.).

Categories of data we collect

We collect only data needed to operate the service. We do not scrape Whatnot accounts.

• Account data: email address, password (hashed), organization name, preferences.
• Shop metadata you provide (name, currency, etc.).
• CSV data imported from the official Whatnot Seller Weekly Orders Report (orders, products, buyers, livestreams, etc.).
• Messages and instructions sent to Orion (AI copilot).
• Technical data and logs (IP address, browser, timestamps, pages viewed).
• Product / site analytics events (PostHog) when those trackers are enabled.

Purposes of processing

• Provide the product: KPIs, estimated margin, livestream / product / buyer insights, inventory, Orion.
• Create and secure accounts, prevent fraud and abuse.
• Improve reliability and product experience.
• Respond to support requests.
• Comply with legal and accounting obligations.
• Measure site / product usage (analytics), where required with consent.

Legal bases

• Performance of a contract (providing the service after registration).
• Legitimate interests (security, product improvement, abuse prevention), subject to your rights.
• Consent (e.g. certain non-essential analytics cookies / trackers).
• Legal obligation where applicable (accounting retention, responses to authorities).

Recipients and processors

Data may be accessed by authorized WhatCopilot personnel and by processors acting on our instructions, including:

• Hosting / deployment: Vercel.
• Database and authentication: Supabase.
• Product / site analytics: PostHog.
• (other processors — payments, transactional email, LLM providers, etc.)

International transfers

Some data may be processed outside the EU / EEA where our providers operate. Where required, we rely on appropriate safeguards (EU Standard Contractual Clauses and additional measures if needed).

Retention periods

• Account and imported data: for the life of the account, then (retention after deletion) for backups, fraud prevention, and legal obligations.
• Technical logs: (log retention period).
• Billing / accounting data: (billing retention period — often 10 years in France).
• You may request deletion via support@whatcopilot.com, subject to mandatory retention.

Your rights (GDPR)

Under the GDPR and applicable French data-protection law, you may have the following rights:

• Access, rectification, erasure.
• Restriction of processing, objection.
• Data portability, where applicable.
• Withdrawal of consent for consent-based processing.
• Instructions regarding your data after death (where available under local law).

Exercising rights and complaints

To exercise your rights: support@whatcopilot.com (or (DPO or privacy contact if distinct)). We respond within statutory deadlines.

You may lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

Cookies and trackers

The site and product may use cookies or similar trackers: technical cookies required for operation (session, authentication, language, theme, preferences), and non-essential analytics cookies / trackers (PostHog).

Non-essential trackers (PostHog audience measurement) are set only after your explicit consent via the cookie banner (accept, refuse, or customize). You can change or withdraw consent anytime via “Manage cookies” in the footer. Proof of your choice (timestamp and preferences) is stored locally in your browser.

You may also configure your browser to refuse some or all cookies. Refusing analytics cookies does not block access to the service.

Security

We apply technical and organizational measures appropriate to the risk (HTTPS, access controls, least-privilege keys, organization isolation). No method of transmission or storage is 100% secure.

Minors

The service is intended for adults / professionals. We do not knowingly collect data from minors under (minimum age — e.g. 16 or 18).

Changes

We may update this policy. The “Last updated” date at the top of this page reflects the current version. For material changes, we may notify you by email or in-product.