Privacy Policy

This Privacy Policy explains how we handle personal data when you use the Whisma desktop application (the "App") and the website at https://whisma.com (the "Website").

The data controller is Smart One Mariusz Tarnaski, with a registered address at ul. Kłobucka 8A m. 28, 02-699 Warsaw, Poland, NIP: 9512440445, REGON: 367647421 ("Whisma", "we", "us"). For any privacy question you can reach us at [email protected].

1. Data We Collect

We keep data collection to what we need to run the Service:

• Account data – your email address and a securely hashed password. If you sign in with Google, we store a Google account identifier instead of a password. We also record whether your email has been verified.
• Subscription and billing data – your plan, its status, and trial and renewal dates, together with the customer, order, and subscription identifiers issued by our payment provider. Your full payment card details are handled by the payment provider, not by us.
• Connected Gmail accounts – the email address of each Gmail or Google Workspace account you connect, and a device identifier, which we use to apply your license. We do not collect or store the content of your emails (see Section 3).
• Security and technical data – sign-in attempts, session records, and basic log data such as IP address, used to keep your account secure and to prevent abuse.
• Support correspondence – the contents of messages you send us by email.
• Waitlist data – if you ask to be notified about a platform that is not yet available, we store your email address, the platform you are interested in, and basic technical data such as your IP address, so we can send you a single notification and prevent abuse.

We do not ask for or collect your date of birth, gender, shipping address, or similar information.

2. How We Use Data and Legal Bases

We process your personal data to:

• Provide the Service, manage your account, and apply your license – performance of our contract with you (art. 6(1)(b) GDPR);
• Take payment, issue invoices, and meet tax and accounting duties – performance of the contract and our legal obligations (art. 6(1)(b) and (c) GDPR);
• Keep the Service secure, prevent fraud and abuse, and answer your support requests – our legitimate interests (art. 6(1)(f) GDPR);
• Send service messages such as email verification, password resets, and important account notices – performance of the contract and our legitimate interests.

We do not use your data for advertising or for selling it to third parties.

3. Google User Data, Gmail, Google Calendar and Google Tasks

Whisma connects to your Gmail and Google Workspace accounts through Google's official OAuth 2.0 flow. You sign in directly with Google, so we never see or store your Google password.

The App displays Gmail's own web interface inside an isolated session for each account. The content of your emails stays on Google's servers. Whisma does not store the content of your messages on our servers or on your device, and does not transmit that content to us. We have no access to the bodies, attachments, or contacts inside your mailbox.

The only Google-related data we record is the email address of each connected account and an associated identifier, used to bind accounts to your license, as described in Section 1.

If you choose to connect Google Calendar in the App, the App asks Google for two additional permissions: to view your list of calendars and their events (the calendar.readonly scope) and to create, change, and delete events (the calendar.events scope). These permissions are used solely to show your calendars inside the App and to let you manage events from it. Calendar data travels directly between the App on your device and Google's servers; we do not store your calendar data, and you can withdraw these permissions at any time in your Google account settings.

Connecting Google Calendar also asks for permission to manage your Google Tasks (the tasks scope). The App uses it to show tasks that have a due date next to your events on the day they are due, and to mark a task complete or incomplete when you tick it off. Read access alone would not let you tick anything off, which is why the permission covers changes as well. Whisma does not create or delete tasks, does not read tasks without a due date outside the dates you are looking at, and does not store your task data. As with calendar data, it travels directly between the App on your device and Google's servers, and you can withdraw the permission at any time in your Google account settings.

Connecting Google Calendar also asks for permission to read the people you know (the contacts.readonly, contacts.other.readonly and directory.readonly scopes). The App uses them to suggest guests as you type them into an event, and to show a name and a photo instead of a bare address for the people already invited. Three separate permissions cover the three separate sources Google keeps: the contacts you saved, the people you have only exchanged mail with, and the directory of your Google Workspace organisation. The App only reads this data. It never creates or changes a contact, it keeps what it reads in memory for as long as the window is open, and it writes nothing to disk. As with calendar data, it travels directly between the App on your device and Google's servers, and you can withdraw these permissions at any time in your Google account settings.

Whisma's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or transfer it to others except as needed to provide the Service or as required by law.

Whisma is an independent product and is not affiliated with, endorsed by, or sponsored by Google LLC. Gmail, Google Calendar, Google Workspace, and Google are trademarks of Google LLC.

4. Payments

Purchases are processed by Polar, which acts as the merchant of record and as a separate controller of the payment data you provide to it. Polar handles your payment method and billing information; we receive confirmation of your purchase and the identifiers needed to manage your subscription. Please review Polar's own privacy policy to understand how it processes your data.

5. Cookies and Spam Protection

The Website uses only essential cookies needed to sign you in and keep your session secure. We do not use advertising cookies, and we do not run third-party analytics or behavioural tracking tools. Because we rely on essential cookies only, no consent banner is required for them, though you can still block cookies in your browser settings, which may stop you from signing in.

On the download waitlist pages we use Google reCAPTCHA v3 to tell real visitors apart from automated abuse. To do this, reCAPTCHA loads a script from Google and may set its own cookies and collect technical information such as your IP address, browser and device details, and how you interact with the page. This data is sent to Google and used by us only to protect our forms from spam and abuse, which is our legitimate interest (art. 6(1)(f) GDPR). reCAPTCHA runs only on the waitlist pages, not across the rest of the Website. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

6. Who We Share Data With

We share personal data only with service providers who help us run the Service, and only as far as needed:

• Polar, for payment processing and invoicing;
• Our hosting and infrastructure provider, where account data is stored;
• Our email delivery provider, used to send verification and account emails;
• Google, when you connect your accounts through Google OAuth, and through Google reCAPTCHA, which protects our waitlist forms from spam and abuse.

We may also disclose data where required by law, or to establish, exercise, or defend legal claims. We do not sell your personal data.

7. International Transfers

Some of our providers may process data outside the European Economic Area. Where that happens, we rely on an adequacy decision of the European Commission or on appropriate safeguards such as the European Commission's standard contractual clauses. You can ask us for more detail using the contact options below.

8. How Long We Keep Data

We keep account and subscription data for as long as you have an account, and afterwards only as long as needed to meet legal, tax, and accounting obligations or to defend legal claims. Security logs are kept for a limited period for abuse prevention. When you delete your account, we remove or anonymize your personal data except where we must retain certain records by law.

9. Your Rights

Under the GDPR you have the right to access your data and to request its correction, deletion, or restriction, the right to object to processing based on our legitimate interests, the right to data portability, and the right to withdraw consent at any time without affecting processing carried out before withdrawal.

To exercise these rights, email us at [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland if you believe your data is processed unlawfully.

10. Children

The Service is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date at the top of this page and, where appropriate, notify you. Please review this page periodically.

12. Contact

For questions about this Privacy Policy or your data, please contact us at:

• Email: [email protected]
• Address: Smart One Mariusz Tarnaski, ul. Kłobucka 8A m. 28, 02-699 Warsaw, Poland