Privacy Policy

Whittle is a meeting-scheduling service operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Ireland ("we"). We are the data controller for the personal data described in this policy. Contact: [CONTROLLER CONTACT EMAIL].

When you create a Whittle account we collect your name, organisation name, email address and a password (stored only as a secure hash by our authentication provider). We record the date and time you accepted our Terms of Service and this policy. Meetings you create — names, date ranges, deadlines, locations or video links — are stored against your organisation.

Meeting organisers provide each attendee's name and email address so we can send them a personal scheduling link. Attendees do not create accounts. Through their link, attendees tell us the times they cannot attend, and may optionally state a time-of-day or meeting-format preference. That is the entirety of what we collect from attendees.

Attendee data is used solely to schedule the specific meeting it was provided for. It is never used for marketing and never shared with anyone other than that meeting's organiser.

We process organiser data to provide the service you signed up for (performance of a contract). We process attendee data on the basis of legitimate interest in scheduling the meeting the attendee has been invited to, initiated by the organiser who holds the relationship with the attendee.

Attendee personal data — name, email, marked times, preferences and the personal link — is automatically removed 30 days after a meeting concludes: after the confirmed slot has taken place, after cancellation, or after the scheduling window ends for meetings never confirmed. An anonymised record that emails were sent is kept for service integrity.

Organiser account and meeting data is kept while your account is active and deleted on account closure request to [CONTROLLER CONTACT EMAIL].

We share data only with the processors that run the service:

• Supabase — database and authentication, hosted on AWS in the EU (eu-west-1, Ireland).
• Resend — delivery of transactional email (invitations, reminders, confirmations).
• Vercel — application hosting.

Each processes data under its own data-processing agreement with us.

We set only the session cookies required to keep organisers signed in. There are no advertising or cross-site tracking cookies, and attendee response pages set no cookies at all.

Under the GDPR you may request access to, rectification or erasure of your personal data, restriction of or objection to its processing, and a copy in portable form. Write to [CONTROLLER CONTACT EMAIL]. You may also lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

We will post any changes on this page and, for material changes, notify organisers by email.