Privacy policy
What personal data Whalemate processes, for what purpose, and what rights you have.
Last updated: 2026-08-28. Model text pending legal review.
Controller
Whalemate processes personal data to operate the Human Risk Management platform and this site. The controller is identified in the DPA and in the site footer. Privacy contact: privacidad@whalemate.com.
Data we process
On the public site: name, work email, company, role, size and industry when you submit a demo, contact, partner or download form. On the platform (customers): name, work email, area, role, simulation results and training progress of employees the customer uploads or syncs.
Purposes
Responding to commercial and support requests. Operating the awareness program contracted by the customer (processor). Improving the product in aggregate. Meeting legal obligations.
Processor for the customer
When we process a customer's employee data, we do so on that customer's behalf. The processing agreement is in the DPA. No individual metric is used for disciplinary purposes by Whalemate.
Retention and rights
Site leads are kept for the commercial conversation and accounting obligations. On the platform, retention is described in the Trust Center. You may exercise access, rectification, erasure and objection by writing to privacidad@whalemate.com.
International transfers
Infrastructure runs on AWS, in the region the customer chooses when the contract provides for it. Subprocessors and change notice: see Trust Center and DPA.
Public site versus platform
Site leads (demo, contact, partner, application) are processed by Whalemate as controller. Employee data a customer uploads or syncs is processed as processor, under the DPA. Mixing those two bases is the error this paragraph avoids: a marketing form does not grant access to a tenant roster.
Site processors
Forms: Fillout. Measurement: Google Tag Manager when the container is published. Voice: ElevenLabs on the Fede widget, with its own terms. Internal email and CRM for the commercial follow-up you accepted. Cookie and script detail is in the cookie policy. The DPA covers the contracted platform, not every marketing cookie.
Minors and data we do not ask for
The site and the platform are not directed at minors. Do not type passwords, card data or identity documents in a form or in the voice assistant. If a field is not on the form, do not invent it in an attachment.