Privacy Policy

The data controller for everything described on this page is Wilph. For privacy questions or requests, contact info@wilph.com.

This policy covers three things: visitors to the public website at wilph.com, people who open and use a Wilph account, and people who write to us. It deliberately does not cover the support conversations a Wilph customer runs through the product. There, the customer is the controller and Wilph is only their processor — those terms are in the Data Processing Agreement. If you contacted a shop and reached Wilph, the shop is who holds your data; ask them.

We hold, as controller:

• Your identity and login — name, email address, and a hashed password. If you sign in with Google we receive your name, email address and Google account identifier, never your Google password.
• Session and security records — session tokens, and the counters that rate limit sign-in and password reset. Those counters identify a caller by a salted hash rather than storing an address in the clear.
• Your workspace — its name, its support address, its settings, and the encrypted credentials for anything you connect.
• Billing — your subscription state and the Stripe identifiers linking it to your payment. Card details are entered on Stripe’s own pages and never reach Wilph.

The legal basis is performance of our contract with you under Article 6(1)(b), and our legitimate interest under Article 6(1)(f) in keeping the service secure and working. We keep this data while the account exists. When a workspace is closed we delete it, including everything that belongs to it; backups age out on their own schedule. Records we are legally required to retain — invoices, chiefly — are kept for as long as the law requires and for nothing else.

We do not sell personal data, we do not share it for advertising, and we do not make automated decisions about you that produce legal or similarly significant effects.

The contact form on this website sends us an email with what you typed, and sets the reply address to the one you gave, so we can answer. Nothing from the form is stored in a database. The message lives in our mailbox like any other email, and we keep it for as long as the conversation is useful. Keeping strangers’ names and addresses in a database would be an obligation bought for nothing.

Running Wilph means using other companies — hosting, a database, an email provider, a payment provider, a model provider. Every one of them, what it does and where it holds data is listed on the sub-processor page.

The part worth stating here as well: our database is hosted in the United States, so account data is transferred outside the EEA and relies on the European Commission’s standard contractual clauses.

With your consent, we use Google Analytics 4 to understand which public pages people visit and improve the website. The legal basis for this processing is your consent under Article 6(1)(a) of the GDPR. Analytics can include:

• Public page views, visit timing, and session information.
• Random browser and session identifiers stored in cookies.
• General device, browser, language, and country information.
• The website address that referred you, limited to its origin (such as https://example.com).

These identifiers are pseudonymous: they do not contain your name, but they can distinguish visits from the same browser. They are therefore not the same as anonymous data.

Our analytics excludes account and dashboard pages, tickets, form contents, and URL query parameters. We do not send your name, email address, account identifier, or customer support content to Google Analytics. Advertising features and Google Signals are disabled. We do not use this analytics for advertising profiles or decisions that produce legal or similarly significant effects about you.

Analytics cookies use a fixed expiry rather than renewing their lifetime with every visit; your browser may remove them sooner. Your choice applies to the browser and device you use. We ask again when that choice expires or the analytics purpose materially changes. Local storage may remain on your device until your next visit or until you clear it, but an expired choice does not enable analytics.

Essential storage used for security or a sign-in you request is separate from analytics and is not switched off by rejecting analytics. You can also delete or block stored website data in your browser; blocking essential cookies may prevent sign-in from working.

Google Analytics is provided by Google Ireland Limited, with processing also involving Google LLC and Google's service providers. Google receives your IP address when your browser contacts its servers. Google states that for visitors in the EU, Switzerland, and the UK, it uses the address to derive approximate location and discards it before logging the analytics data.

Analytics data can be processed outside the European Economic Area, including in the United States. Google describes its use of the EU–US Data Privacy Framework and contractual safeguards where applicable. These are transfer safeguards, not a promise that data stays in Europe. Read how Google uses information from partner sites, its privacy policy, and its data transfer frameworks.

Our Google Analytics property uses a two-month retention setting for detailed user and event data, without resetting user retention on new activity. Google applies deletion through its scheduled processing. Standard aggregated reports can remain available longer; the two-month setting does not delete all reports.

Withdrawing consent stops further analytics collection from this browser and removes the analytics cookies we can access. Withdrawal does not change the lawfulness of earlier processing or automatically erase information already collected. Contact us if you also want to make a deletion request.

Depending on the circumstances, you can request access to your personal data, correction, deletion, restriction of processing, or data portability, and object where that right applies. You can withdraw analytics consent at any time. Write to info@wilph.com to ask about these rights. Because analytics uses browser identifiers, we may need information to locate the relevant records and verify a request; please do not send passwords or sensitive support content.

You may also complain to Datatilsynet, the Danish Data Protection Agency, or your local data protection authority. We update this notice when our processing changes.

Questions about this document, or any request about your data, go to info@wilph.com. We answer in English or Danish.