Privacy policy
This policy explains how we handle personal data. It covers two different roles. For this website, customer accounts (including the free trial) and billing, we decide how data is used: we are the controller. For the analytics data our customers collect about visitors to their own websites, the customer is the controller and we are their processor; that is governed by our data processing agreement.
1. Who we are
- Wholetally is a service of MAAT Automation, a Dutch sole proprietorship (eenmanszaak) operated from the Netherlands.
- Chamber of Commerce (KvK) number: 98655590. VAT number: NL005346453B10.
- Contact for privacy and legal questions: hello@wholetally.com.
2. Visitors to this website
This website (wholetally.com) sets no cookies, uses no storage on your device and loads no scripts, fonts or images from other domains. We don’t currently measure this website with Wholetally.
Our hosting provider Cloudflare receives the technical data every browser sends (IP address, user agent, requested page, time) to deliver the pages and protect them against attacks. Legal basis: our legitimate interest in a working, secure website (Article 6(1)(f) GDPR). Cloudflare may keep such request logs for up to about 30 days under its own observability policies (sampled analytics are retained at least that long).
3. Customer accounts
When you create and use an account on app.wholetally.com, we process:
- Account data: your email address, your password (stored only as a salted hash), password reset links (stored only as a hash and valid for 30 minutes) and session records (stored as a hash, valid for 30 days).
- Sign-up record: when you accepted the terms, which version you accepted, and your confirmation that you act for a business.
- Trial data: when your 30-day trial started and ends, the website domains used for it (one trial per domain), and which trial reminder emails we sent.
- Members: the email addresses of people you add to your account so they can view your sites.
- Configuration: your sites, settings, goals, funnels, API tokens (stored as a hash) and connected integrations.
- Usage records: AI usage per account (number of requests, tokens and credits used) to apply limits and bill credits.
- Billing data: plan, subscription status, invoices and the Stripe customer reference. Payment details are entered on Stripe’s pages; we don’t receive full card numbers.
- Correspondence: emails you send us.
Legal bases:
- Providing the service you signed up for (performance of a contract, Article 6(1)(b) GDPR).
- Keeping invoices and accounting records as Dutch tax law requires (legal obligation, Article 6(1)(c) GDPR).
- Security, preventing abuse and improving the service with aggregated usage figures (legitimate interest, Article 6(1)(f) GDPR).
We send password reset emails when you ask for one, two reminder emails to the account owner before the trial ends, and, only if you switch it on per site, a weekly report email. Every report email has a one-click unsubscribe link. We don’t send marketing or product-newsletter email without consent. Service emails required for the contract (password resets, trial reminders, billing, security and material changes to these terms) are sent on the basis of Article 6(1)(b) or (f) GDPR.
4. Visitors to our customers’ websites
When a website uses Wholetally, we process the fields listed on What we collect on behalf of that website, through api.wholetally.com. In short:
- The script sets no cookies, uses no storage on the device and creates no visitor, user or device ID.
- IP addresses are used in memory to deliver the request, to derive the country and, only when the site owner enables the daily hash mode, to compute a one-way hash together with the user agent and a random salt. IP addresses are never stored.
- The daily salt is deleted after one day, so hashes can’t be recomputed later. Hashes are kept for at most about two days in separate tables and never in the page view records.
- Page view records are deleted automatically after the retention period the site owner sets (default 395 days).
The website you visited is responsible for this processing and for informing you. To exercise your rights about this data, contact that website. If you contact us, we will forward your request to them.
5. AI features
When a customer uses the AI features, the question and the aggregated statistics needed to answer it are sent to our AI provider. See the AI-use statement.
6. Who receives data
We use the service providers on the sub-processor list (hosting, email, payments, AI). They may only use the data to provide their service to us. We don’t sell personal data and don’t share it for advertising. We may disclose data when the law requires it.
7. Transfers outside the EEA
Our database is stored in the EU. Some providers are US companies or route requests through locations outside the EEA. Where that happens, the transfer is covered by the EU-US Data Privacy Framework where the provider participates, or by the European Commission’s Standard Contractual Clauses. The sub-processor list names the safeguard per provider.
8. How long we keep data
| Data | Retention |
|---|---|
| Password reset links | 30 minutes valid; expired and used records deleted within 24 hours |
| Sessions | 30 days, or until you sign out |
| Account, sites and settings | While the account exists; deleted within 30 days after you close it |
| Analytics data (as processor) | Retention set per site (default 395 days); deleted within 30 days after the account ends |
| Invoices and accounting records | 7 years (Dutch fiscal retention obligation) |
| Sign-up record (terms version, time, business confirmation) | While the account exists; after closure kept for up to 5 years to handle possible contractual claims, then deleted |
| Trial data and members | While the account exists; deleted within 30 days after you close it |
| Backups | Point-in-time recovery (Cloudflare D1 Time Travel) for up to 30 days on our paid Workers plan |
9. Security
We encrypt all traffic (HTTPS), store passwords, password reset links, sessions and API tokens only as hashes, encrypt integration secrets, limit access to production systems to the people who need it, and delete data on fixed schedules. See Annex II of the data processing agreement.
10. Your rights
You can ask us for access to, correction or deletion of your personal data, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. Send your request to hello@wholetally.com; we answer within one month. We don’t make decisions about you based solely on automated processing.
You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own EU country.
11. Changes
We will update this policy when the service changes. Material changes are announced to customers by email at least 30 days in advance.