WhaleFinders Privacy Policy

Last updated: June 17, 2026.
Effective date: June 17, 2026.

Who we are

WhaleFinders LLC is a Wyoming limited liability company organized under the Wyoming Limited Liability Company Act, W.S. 17-29-101 et seq. ("WhaleFinders," the "Company," "we," "us," or "our"). The Company operates the website at whalefinders.com (the "Site") and provides the subscription service marketed as "WhaleFinders" (the "Service"). These documents are entered into by WhaleFinders LLC in its own name. The parties are independent contractors, and nothing in these documents creates any partnership, joint venture, agency, franchise, or employment relationship. No member, manager, officer, or employee of WhaleFinders LLC is personally liable for the obligations of the Company.

1. Introduction and scope

1.1 This Privacy Policy explains how WhaleFinders collects, uses, discloses, retains, secures, and transfers Personal Data, and the privacy rights you have. It applies to the Site and the Service, and to the Personal Data we handle when you visit the Site, communicate with us, subscribe to the Service, or receive Deliverables.

1.2 This Privacy Policy is incorporated by reference into the WhaleFinders Terms and Conditions. It should be read together with our Cookie Policy, our Acceptable Use Policy, our DMCA and Copyright Policy, and, for Agency customers, our Data Processing Addendum (the "DPA").

1.3 Defined terms. Words with initial capitals have the meanings given to them where they are first defined in this Privacy Policy. Capitalized terms not defined in this Privacy Policy have the meanings given to them in the WhaleFinders Terms and Conditions.

2. A note about Wyoming law and the laws we apply

2.1 WhaleFinders is organized in Wyoming. As of the effective date of this Privacy Policy, Wyoming has not enacted a comprehensive consumer data-privacy law that applies to private businesses. A recent Wyoming privacy measure applies to government entities only and does not create consumer rights against private companies. Wyoming does have a data-breach notification statute, W.S. 40-12-501 and 40-12-502, which we follow.

2.2 Because Wyoming has no omnibus consumer privacy statute, we voluntarily extend privacy rights to you. This Privacy Policy is informed by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"), by the other United States state privacy laws now in effect, and, for users in the European Economic Area, the United Kingdom, Switzerland, Australia, and Canada, by the GDPR, the UK GDPR, the Australian Privacy Principles, and Canadian privacy law. We do not suggest that a comprehensive Wyoming privacy law exists. Where a law gives you a right described in this Privacy Policy, you may exercise it as described in Section 13.

3. Our narrow data footprint (the Four NOTs)

3.1 The Service provides written direction and copy only. As explained in our Terms and Conditions and Acceptable Use Policy, WhaleFinders does not film, photograph, record, or edit any content (not production); does not operate any inbox or message any fan or Subscriber (not chatting); does not log into, access, control, or automate any platform, social media, OnlyFans, payment, email, or other account, and never requests, holds, or uses your account logins or credentials (not bots or automation); and does not buy, sell, or supply clicks, traffic, followers, upvotes, or Subscribers (not bought traffic). We refer to these boundaries as the Four NOTs.

3.2 Because of the Four NOTs, our data footprint is deliberately narrow. We do not hold your platform credentials, we hold no Personal Data about your Subscribers or fans, and we do not collect or store sexually explicit media, government identification documents, full payment-card numbers, or card security codes (CVV). The categories of Personal Data we do handle are set out in Section 4.

4. Categories of Personal Data we collect, and their sources

4.1 We collect and process the categories of Personal Data described in the inventory below. For each category we describe the data elements, where the data comes from (its source), the purposes for which we use it, the lawful basis under the GDPR and the UK GDPR (see Section 6), whether the category is Sensitive Data, and how long we keep it (see Section 14). Recipients of each category are described in Section 9. To make our notice at collection clearer for California residents. We collect the categories below on an ongoing basis.

4.2 Category A: Identity and contact data.

Your name, any business or agency name, your email address, your messaging handles (such as Telegram or Discord), and your role at an agency. Source: you, when you enquire, subscribe, or communicate with us. Used to create and manage your account, deliver the Service, and support you. Lawful basis: performance of a contract and our legitimate interests. Not Sensitive Data.

4.3 Category B: Creator Program Data (processed for Agencies). Information about a client agency's creators that the agency chooses to provide or to enter into the client portal, such as a creator's working name or identifier, niche and persona notes, platform handles, and performance statistics. Source: the client agency. We use this data solely to prepare and deliver the written marketing direction the agency has subscribed to. For this category the agency is the Controller and WhaleFinders acts as its Processor (or service provider under United States state law), processing the data only on the agency's documented instructions. We do not collect this data from creators directly and we have no direct relationship with them. Agencies are responsible for ensuring they have a lawful basis to share this information with us.

4.4 Category C: Billing and transaction data. Payment tokens, the last four digits of a card, payment-processor customer identifiers, cryptocurrency (USDC) wallet addresses, and transaction hashes. We never collect or store full card numbers or card security codes. Source: you and our payment processors. Used to take payment and keep tax and accounting records. Lawful basis: performance of a contract and legal obligation. Not Sensitive Data.

4.5 Category D: Usage and technical data. Internet Protocol address, device and browser information, and cookie and analytics identifiers from your use of the Site. Source: collected automatically through cookies and similar technologies, as described in our Cookie Policy. Used to secure the Site and, where you allow it, to understand how the Site performs. Lawful basis: legitimate interests and, for non-essential cookies, consent. Not Sensitive Data.

4.6 Category E: Communications data. The messages, requests, and records of your communications with us through our messaging channels (such as Telegram), the contact form on the Site, Calendly when you book a call, and email. Source: you. Used to provide support, handle sales enquiries, and keep business records. Lawful basis: performance of a contract and legitimate interests. Not Sensitive Data.

4.7 Category F: Newsletter data. The email address you enter when you subscribe to our newsletter through the Site, your double opt-in confirmation, and your subscription status. We use a double opt-in: we send a confirmation email and add you to the list only after you confirm. Newsletter emails are sent through Resend and every email includes an unsubscribe link. Source: you. Lawful basis: consent, which you may withdraw at any time by unsubscribing. Not Sensitive Data.

4.8 Category G: Client portal account data. If your agency uses the WhaleFinders client portal: your account email and name, your role and team membership within your agency's workspace, your settings and notification preferences, feedback and support messages you submit in the portal, and records of your use of the portal. Source: you and your agency. Used to operate and secure the portal, authenticate you, and provide support. Lawful basis: performance of a contract and legitimate interests. Not Sensitive Data.

4.9 We do not collect any category of sensitive personal information for our own purposes. To the extent creator information an agency provides could concern a person's sex life, we handle it only as the agency's Processor, as described in Category B (Section 4.3) and Section 5.

5. Sensitive Data

5.1 WhaleFinders does not collect Sensitive Data from individuals for its own purposes. We do not ask for, and you should not send us, sexually explicit media, government identification documents, health information, or platform login credentials. We do not need them to provide the Service.

5.2 Creator information provided by agencies. Where a client agency provides creator niche or persona information that could concern a person's sex life, that information is special-category data under Article 9 of the GDPR and the UK GDPR. We process it solely as the agency's Processor, on the agency's documented instructions and under our data processing terms. The agency, as Controller, is responsible for establishing a lawful basis, including obtaining any explicit consent required, before providing it to us. If you are a creator whose information an agency has shared with us, please direct any privacy request to that agency, and we will assist the agency in responding.

5.3 We never sell Sensitive Data, we never use it to infer characteristics about anyone, and we never use it for any purpose other than delivering the Service to the agency.

6. Lawful bases for processing (GDPR and UK GDPR)

6.1 Where the GDPR or the UK GDPR applies, we rely on the following lawful bases, matched to purpose:

6.2 Performance of a contract (Article 6(1)(b)). To create and manage your account, deliver the Deliverables, operate the Portal, and take payment.

6.3 Legitimate interests (Article 6(1)(f)). To secure the Site, the Portal, and our systems, to prevent and investigate fraud and abuse, to provide support, to keep business records, to improve the Service, and to carry out limited business-to-business marketing to existing and prospective business contacts. The legitimate interest we pursue is the safe, reliable, and improving operation of our business, balanced against your interests and rights. You may object to processing based on legitimate interests as described in Section 12.

6.4 Consent (Article 6(1)(a) and, for Sensitive Data, Article 9(2)(a)). For non-essential cookies and analytics where required, for email marketing where required, and for any processing of Sensitive Data. You may withdraw consent at any time.

6.5 Legal obligation (Article 6(1)(c)). To meet our tax, accounting, and anti-money-laundering record-keeping duties, and to respond to lawful requests from authorities.

6.6 Any processing of Sensitive Data always relies on your explicit consent under Article 9(2)(a) in addition to the Article 6 basis above.

7. How we use Personal Data

7.1 We use Personal Data only for the purposes set out in this Privacy Policy, which are:

7.2 We use Personal Data to create and manage your account; to deliver the Service and the Deliverables; to take payment and keep tax and accounting records; to communicate with you and provide support; to secure the Site and our systems and to prevent and investigate fraud and abuse; to comply with law and respond to lawful requests; and to carry out limited business-to-business marketing to existing and prospective business contacts. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

8. Cookies and similar technologies

8.1 The Site uses cookies and similar technologies to keep the Site secure, remember your preferences, and, where you consent, understand how the Site performs. We summarize our cookie practices here, and our Cookie Policy contains the full detail, including the cookie table and how to manage your choices.

8.2 We group cookies and similar technologies into four categories. Strictly necessary cookies, including those used for the consent banner and site security, do not require consent and cannot be switched off. Functional cookies remember your preferences and, in the European Economic Area and the United Kingdom, load only after you opt in. Analytics cookies are provided through Google Analytics 4 and help us understand how the Site performs. They load only after you opt in through our cookie banner, wherever you are located, and we honor recognized opt-out preference signals such as the Global Privacy Control. Functional cookies are not currently in use; if we ever introduce one, it will also load only after you opt in. We do not use marketing or advertising cookies.

8.3 In the European Economic Area and the United Kingdom, non-essential cookies load only after you opt in through our cookie banner. Non-essential cookies load only after you opt in, wherever you are located.

8.4 As of the effective date, we do not use cookies for cross-context behavioral advertising. If that ever changes, we will update this Privacy Policy and the Cookie Policy, update our consent banner, and add a clear "Do Not Sell or Share My Personal Information" link. For full details, including the cookie table and how to manage your choices, please see our Cookie Policy.

9. How we disclose Personal Data, our service providers, and our Subprocessors

9.1 We do not sell your Personal Data. We disclose Personal Data only as described in this Section, and only to the categories of recipients below.

9.2 Service providers and Subprocessors. We use trusted third parties to host the Site and the Portal, process payments, communicate with you, and run our business. For data we collect for our own purposes (Site visitors, newsletter subscribers, agency contacts, and agency account holders in the client portal), WhaleFinders is the Controller and these third parties act as our service providers, processing Personal Data on our behalf and on our documented instructions. Where an Agency is the Controller and WhaleFinders is the Processor (the Agency scenario), these third parties act as Subprocessors and process Personal Data on behalf of that Agency Controller. In each case they act under contracts that require them to protect the data and to use it only to provide their services to us. We will update this list in this Privacy Policy when our providers change. Our recipients are listed below.

Our current service providers and Subprocessors are: Framer (website hosting and forms); Google Analytics (consent-gated site analytics, as described in Section 8 and the Cookie Policy); Vercel (client portal hosting); Supabase (client portal authentication and database); Stripe (payment processing for card payments); Cloudflare (Turnstile bot protection on portal sign-in and sign-up); Upstash (rate limiting for the client portal); Resend (newsletter and transactional email, including double opt-in confirmation); Calendly (call scheduling); and Telegram (client communications through private groups and our support channel). We also disclose Personal Data to our professional advisors, such as accountants and lawyers, where needed.

This enumeration matches, by category and grouping, the categories of Subprocessors set out in our data processing terms, available on request, so that the same maintained list is described consistently in both documents.

9.3 Each service provider and Subprocessor is an independent third party with its own privacy practices. We name categories and a current list rather than fixing any single provider as permanent.

9.3A Artificial intelligence and no model training on your data. Where we use any artificial-intelligence or large-language-model tool to help us prepare the Deliverables, we use it only as a service provider or Subprocessor to provide the Service to you, we disclose it on the same maintained list described in Section 9.2, and we contract for it to be configured so that it does not use, retain, or train any model on your Personal Data, your Intake Data, or your Sensitive Data. We do not permit any third party to use your Personal Data, your Intake Data, or your Sensitive Data to train, fine-tune, or improve that third party's own models. If we ever engage any AI or model provider that cannot meet this no-training commitment, we will not send it your Sensitive Data.

9.4 Legal and protective disclosures. We may disclose Personal Data where we believe in good faith that doing so is necessary to comply with law or legal process, to respond to a lawful request from a public authority, to enforce our agreements, to protect the rights, property, or safety of WhaleFinders, our Customers, or others, or to prevent fraud or abuse.

9.5 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, Personal Data may be transferred as part of that transaction, subject to the protections in this Privacy Policy.

9.6 Agencies and End Clients. Where we act as a Processor for an Agency, we disclose Personal Data back to that Agency Controller and to the Subprocessors needed to deliver the white-labeled Service, on the Agency's instructions and under the DPA.

10. No sale of Personal Data, no sharing for cross-context behavioral advertising, and Global Privacy Control

10.1 We do not sell your Personal Data, and we do not share your Personal Data for cross-context behavioral advertising, as those terms ("sell" and "share") are defined under the CCPA. We have not sold or shared Personal Data for these purposes in the twelve months before the effective date of this Privacy Policy.

10.2 We honor the Global Privacy Control and other recognized opt-out preference signals. When your browser or device sends such a signal, we treat it as a valid request to opt out of any sale or sharing for the browser or device from which it is sent, without requiring you to verify your identity. For California, we honor recognized opt-out preference signals such as the Global Privacy Control.

10.3 Our discounts and your subscription choices are tied only to your subscription and are not tied to the collection, sale, or sharing of your Personal Data. We therefore do not operate a financial incentive program that requires a Notice of Financial Incentive.

10.4 If we ever begin to use advertising cookies or otherwise sell or share Personal Data as those terms are defined under applicable law, we will update this Privacy Policy, post a clear "Do Not Sell or Share My Personal Information" link, and provide the opt-out mechanisms the law requires before doing so.

11. International data transfers

11.1 We are based in the United States, and our service providers and Subprocessors may process Personal Data in the United States and in other countries. When we transfer Personal Data out of the European Economic Area, the United Kingdom, or Switzerland, we put in place a lawful transfer mechanism and appropriate safeguards.

11.2 Transfer mechanisms. Where a service provider or Subprocessor is certified under the EU-U.S. Data Privacy Framework, the UK Extension to that Framework, or the Swiss-U.S. Data Privacy Framework, we may rely on that certification for transfers to that recipient. Otherwise, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for the United Kingdom, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the Standard Contractual Clauses, in each case as amended or replaced from time to time. Where required, we also rely on findings of adequacy by the relevant authority.

11.3 Supplementary measures. WhaleFinders is not itself certified under the Data Privacy Framework. Transfers of Personal Data directly to WhaleFinders therefore rely on the Standard Contractual Clauses and the UK IDTA or UK Addendum, supported by a transfer-impact assessment and by supplementary technical and organizational measures such as encryption and access controls.

11.4 You may request a copy of the safeguards we use for international transfers by contacting us at admin@whalefinders.com.

12. Your privacy rights

12.1 Depending on where you live and which law applies, you have some or all of the rights in this Section. We honor these rights for the categories of individuals the relevant law protects. Where we act as a Processor for an Agency, please direct your request to that Agency, and we will assist them.

12.2 Right to access or know. You may ask us to confirm whether we process your Personal Data and to provide a copy of it, together with information about the categories of data, sources, purposes, and recipients.

12.3 Right to correction. You may ask us to correct Personal Data about you that is inaccurate or incomplete.

12.4 Right to deletion. You may ask us to delete Personal Data about you, subject to the exceptions allowed by law, including where we must keep data for legal, tax, accounting, security, or dispute-resolution reasons, except that records broadcast to a public blockchain (such as USDC transaction hashes) cannot be erased by anyone, including us.

12.5 Right to data portability. You may ask us to provide certain Personal Data you gave us in a structured, commonly used, and machine-readable format, and, where technically feasible, to transmit it to another controller.

12.6 Right to opt out of sale and of sharing for cross-context behavioral advertising. You may opt out of any sale of your Personal Data and of any sharing for cross-context behavioral advertising. As stated in Section 10, we do not sell or share Personal Data for these purposes, and we honor opt-out preference signals.

12.7 Right to limit use of sensitive personal information. You may direct us to limit our use and disclosure of your sensitive personal information to what is necessary to provide the Service, as described in Section 5.3.

12.8 Right to non-discrimination and non-retaliation. We will not discriminate or retaliate against you for exercising any privacy right. We will not deny you the Service, charge you a different price, or provide a different level or quality of service because you exercised a right. We do not operate any financial incentive program, so we do not offer price or service differences in exchange for the collection, sale, sharing, or retention of your Personal Data.

12.9 Right to withdraw consent. Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

12.10 Right to restriction (GDPR and UK GDPR Article 18). You may ask us to restrict processing of your Personal Data in certain circumstances, for example while we verify the accuracy of data you have contested.

12.11 Right to object (GDPR and UK GDPR Article 21). You may object to processing based on our legitimate interests, and to processing for direct marketing, in which case we will stop processing for direct marketing.

12.12 Right to appeal. Where we deny your request and the law that applies to you provides an appeal right, you may appeal our decision by replying to our response or by contacting admin@whalefinders.com with the word "Appeal." We will inform you of the outcome and, where required, of how to contact your state Attorney General.

12.13 Rights regarding automated decision-making (GDPR and UK GDPR Article 22). As stated in Section 7.2, we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not engage in such automated decision-making or profiling. If this ever changes, we will update this Privacy Policy and provide the information and rights the law requires.

12.14 Right to lodge a complaint. You may lodge a complaint with a data-protection supervisory authority, with your state Attorney General, or with another competent regulator. In the European Economic Area you may complain to the authority in your country of residence or work; in the United Kingdom, to the Information Commissioner's Office (ICO); and in Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC). We ask that you contact us first so we can try to resolve your concern.

12.15 Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your own identity directly with us or to confirm that you gave the agent permission.

13. How to exercise your rights

13.1 How to submit a request. To exercise any right in Section 12, email admin@whalefinders.com. Please tell us which right you wish to exercise and include enough information for us to locate your records.

13.2 Verification. To protect your Personal Data, we verify your identity before acting on most requests. If you have an account with us, we verify you by matching the details in your request against the information on your account, and we may ask for additional information where we cannot verify you from your account alone. If you do not have an account, for example because you are a visitor to the Site, we verify your request by matching the information you give us against the limited technical and usage data we hold (for example by asking you to submit the request from the same browser or device, or to provide details that let us reasonably link the request to the data we hold), and we may ask for additional information that we will use only to verify your identity and that we will delete as soon as practicable afterward. Where we cannot reasonably verify a visitor's identity to the degree of certainty the law requires, we will tell you, and we may decline to act on the request to the extent the law permits, while still treating any opt-out preference signal as described below. We do not require verification before honoring an opt-out preference signal or an opt-out of sale or sharing.

13.3 Response times. For requests under United States state privacy laws, we will respond without undue delay and within any period the law that applies to you requires. For requests under the GDPR or the UK GDPR, we will respond within one month, and we may extend that period by up to two further months for complex or numerous requests, in which case we will tell you within the first month.

13.4 No fee. We will not charge a fee to handle your request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline to act, as the law allows, and we will explain our decision.

13.5 Appeals. If we deny your request, we will explain why, and, where the law gives you an appeal right, we will tell you how to appeal, as described in Section 12.12.

14. Data retention

14.1 We keep Personal Data only for as long as we need it for the purposes described in this Privacy Policy, and then we delete or anonymize it, unless a longer period is required to comply with law, resolve disputes, or enforce our agreements. Our retention schedule is: We keep newsletter email addresses until you unsubscribe or we retire the list. Creator Program Data an agency enters in the client portal is retained while the agency's subscription is active and is deleted, or returned to the agency, on the agency's instruction or within a reasonable period after the subscription ends. Client portal account data is retained while the account is active and for a limited wind-down period afterward.

We keep account and contact data for as long as your subscription is active and for a limited period afterward to handle wind-down, disputes, and our records. We keep Intake Data for as long as we provide the Service to you and delete or anonymize it within a reasonable period after the Service ends, unless you ask us to delete it sooner. We keep billing and tax records for as long as tax and accounting law requires, which is typically up to seven years. We keep usage and analytics data for a limited period. We keep communications and support records for as long as needed to handle your matter and for our records. When we no longer need Personal Data, we delete or anonymize it.

15. Security

15.1 We use reasonable technical and organizational measures designed to protect Personal Data, including encryption of data in transit and at rest, access controls and least-privilege access, and logging. The client portal additionally uses email confirmation at sign-up, screening of new passwords against known breached-password lists, optional multi-factor authentication, Cloudflare Turnstile bot protection on sign-in and sign-up, and rate limiting. Our narrow data footprint described in Section 3, including our practice of not storing credentials, full card numbers, government identification documents, or sexually explicit media, is itself a security measure.

15.2 No method of transmission over the internet and no method of storage is perfectly secure. While we work to protect your Personal Data, we cannot guarantee its absolute security, and any transmission is at your own risk.

16. Data-breach notification

16.1 We maintain procedures to detect, investigate, and respond to security incidents. If we become aware of a breach of security that compromises Personal Data, we will investigate promptly and, where required, notify affected individuals and the relevant regulators in the most expedient time possible and without unreasonable delay, as required by applicable law.

16.2 We give notice of a breach as and when required by applicable law. Applicable law includes the breach-notification laws of the United States states, one example of which is the Wyoming data-breach notification statute, W.S. 40-12-501 and 40-12-502, which governs notice to affected Wyoming residents whose personal identifying information is involved. Where the GDPR or the UK GDPR applies, we will, where required, notify the competent supervisory authority within 72 hours of becoming aware of a personal-data breach and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

16.3 Where we act as a Processor for an Agency Controller, we will notify the Agency without undue delay after becoming aware of a personal-data breach affecting their data, so the Agency can meet its own notification deadlines, as set out in the DPA.

17. EU and UK representatives

17.1 Article 27 applicability. We have assessed whether we are required under Article 27 of the GDPR or the UK GDPR to appoint a representative in the European Union or the United Kingdom. Article 27 applies only where our processing of the Personal Data of individuals in the European Union or the United Kingdom is related to offering goods or services to those individuals, or to monitoring their behavior, and is not occasional, or where it involves special-category data on more than an occasional basis. The Service is a business-to-business service directed to OnlyFans management agencies. It is not targeted at, or marketed to, individual consumers in the European Union or the United Kingdom. Where, on this assessment, Article 27 does not apply to us, we are not required to appoint a representative and have not appointed one.

As set out above, on our current assessment Article 27 does not apply to us, and we have not appointed a representative in the European Union or the United Kingdom. If we determine that Article 27 applies, we will appoint a representative and publish their details here.

You may contact us at admin@whalefinders.com to ask whether we have appointed a representative and, if so, to obtain their details.

17.2 We have assessed that we are not required to appoint a Data Protection Officer, because our core activities do not consist of processing operations that, by their nature, scope, or purposes, require regular and systematic monitoring of data subjects on a large scale, and they do not consist of processing Sensitive Data on a large scale, within the meaning of Article 37. We nonetheless provide a dedicated privacy contact at admin@whalefinders.com. You may contact our privacy contact on any matter relating to the processing of your Personal Data.

18. Information for individuals in Australia

18.1 We handle Personal Data in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) where it applies. We collect sensitive information, which includes Intake Data concerning a person's sexual orientation or practices, only with the individual's consent and where it is reasonably necessary for the Service (APP 3.3).

18.2 Overseas disclosure (APP 8 and APP 1.4). We disclose Personal Data to overseas recipients, including our service providers and Subprocessors located in the United States and potentially in other countries, as listed in Section 9. Before disclosing Personal Data overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, or we rely on your informed consent. We acknowledge our accountability for the handling of your Personal Data by overseas recipients to the extent required by the APPs. We are also aware of the statutory tort for serious invasions of privacy introduced in 2024 and conduct our handling of Personal Data with that in mind.

19. Information for individuals in Canada and Quebec

19.1 Canada (PIPEDA). We handle Personal Data in accordance with the Personal Information Protection and Electronic Documents Act where it applies. We obtain meaningful consent for our collection, use, and disclosure of Personal Data, and we obtain express consent for Sensitive Data. We limit our use of Personal Data to the purposes we have identified, are open about our practices, and provide access and correction rights. Our Privacy Officer can be reached at admin@whalefinders.com.

19.2 Quebec (Law 25). For individuals in Quebec, our Person in Charge of the Protection of Personal Information can be reached at admin@whalefinders.com. We obtain express consent for sensitive personal information, and, before transferring Personal Data outside Quebec, we conduct a privacy impact assessment of the transfer. Individuals in Quebec also have rights of access, rectification, withdrawal of consent, data portability, and, in certain circumstances, de-indexing, which they may exercise as described in Section 13.

20. Children and adults-only Service

20.1 The Service is strictly for adults, and no part of it is directed to anyone under 18. Every Customer, and every person a Customer represents, must be at least 18 years old (or the age of majority in their jurisdiction, whichever is higher).

20.2 We do not knowingly collect Personal Data from anyone under 18. The Children's Online Privacy Protection Act (COPPA), which concerns the online collection of personal information from children under 13, does not apply to the Service, because the Service is intended only for adults and is not directed to children. If you believe a person under 18 has provided us with Personal Data, please contact admin@whalefinders.com so we can delete it.

21. California residents

21.1 WhaleFinders is a small business-to-business company. We do not currently meet any of the thresholds that make a company a "business" subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We nonetheless voluntarily honor the access, correction, and deletion rights in Section 12 for California residents. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not disclose it to third parties for their own direct-marketing purposes (California Civil Code Section 1798.83).

22. Do Not Track and Global Privacy Control

22.1 Some browsers offer a "Do Not Track" setting. Because there is no common industry standard for how to respond to Do Not Track signals, we do not respond to them. We do, however, honor the Global Privacy Control and other recognized opt-out preference signals, as described in Section 10.2.

23. Changes to this Privacy Policy

23.1 We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Where the changes are material, we will provide additional notice through the Site, the Portal, or by email, and, where the law requires your consent before a material change takes effect, we will obtain that consent before relying on the change. Non-material changes take effect when posted.

23.2 Survival. This Privacy Policy continues to apply, as to Personal Data we have already collected, after you stop using the Service and after the Terms and Conditions or any subscription ends, for as long as we retain that Personal Data under Section 14. Our obligations of retention, security, breach notification, and your privacy rights survive termination as to that Personal Data.

For any privacy question or to exercise a privacy right, please contact us first at admin@whalefinders.com.