Privacy Policy

Last updated: 2 July 2026

Whispella ("we", "us") is an AI companion app for women navigating peri-menopause and menopause. Because we handle information about your health and wellbeing, we treat privacy as a design principle, not an afterthought. This policy explains what we collect, why, and your rights.

Data controller: Dominik Hampel, trading as Whispella, United Kingdom. Contact: hello@whispella.com.

What we collect

• Account data — an anonymous account identifier; your email address only if you choose to add one.
• Profile data you provide — age range, menopause stage, symptoms, HRT status, tone preferences (from the onboarding quiz).
• Conversations — messages you exchange with the AI companion, stored to provide continuity and cross-device sync.
• Daily check-ins — sleep, mood, energy and symptom entries you log.
• Waitlist — email address and optional stage, if you join the waitlist on our website.
• Usage analytics — pseudonymous events (e.g. "message sent", response-time buckets). We never send the content of your messages, journal or check-in notes to analytics.

What never leaves your device

Your journal is encrypted on your device (AES-256-GCM) with a key held in your phone's secure hardware (iOS Keychain / Android Keystore). Journal content is never transmitted to our servers. We could not read it even if compelled to — we do not have the key.

How we use your data

• To provide the service — generating AI responses, insights and cross-device sync (performance of contract, UK GDPR Art. 6(1)(b); for health-related data, your explicit consent, Art. 9(2)(a)).
• To improve the product via pseudonymous analytics (legitimate interests, Art. 6(1)(f)).
• To contact you about early access if you joined the waitlist (consent, Art. 6(1)(a)).

We do not sell your data or share it with advertisers or data brokers. Ever.

Processors we use

• Supabase (database & authentication — hosted in the EU)
• Anthropic (AI responses — your messages are processed to generate replies; not used to train their models per their commercial terms)
• OpenAI (voice transcription, paid plans only — audio is transcribed and not retained for training per API terms)
• PostHog (pseudonymous analytics — EU instance)
• Vercel (website hosting)
• Stripe (payments, when subscriptions launch — we never see your card number)

Retention

Conversations, check-ins and profile data are retained while your account exists so the app can function. Deleting your account (Settings → "Delete account and all data") permanently removes your account and all associated server data. Waitlist emails are kept until launch outreach completes or you ask us to remove you.

Your rights

Under UK GDPR you can access, correct, export, restrict or delete your data, and withdraw consent at any time. Deletion is built into the app; for anything else email hello@whispella.com. You also have the right to complain to the ICO (ico.org.uk).

Important limits

Whispella provides information and emotional support. It is not a medical device and does not provide medical advice, diagnosis or treatment. In an emergency call 999 (UK) or 112 (EU); for emotional crisis support call Samaritans 116 123 (UK) or 116 123 (PL).

Changes

We will post any changes here and, for material changes, notify you in the app before they take effect.