Privacy policy

Who is responsible

Whether (whether.games) is run by Ioannis Sotiropoulos, Berlin, Germany, as an individual (see our Imprint). For anything privacy-related, use our contact form.

What we collect

• Account info - a user id; your email and name if you sign in with email/password or a single sign-on account.
• Project content - project names, pitch text, uploaded files (PDF, images, text), AI reports, strategy chat messages, and publisher lens profiles you save. This content is stored in encrypted form, so it is not readable as plain text in our database or file storage.
• Invitation requests - if you request access through our site gate, we store the email address you enter and the status of the request.
• Purchase records- what you bought, when, and how much you paid. Card details never touch our servers; see “Who processes your data” below.
• Usage metadata - things like AI token totals so we can run the product reliably.
• Optional analytics - if you choose Accept all, page views, product events, error reports, and session recordings (with form inputs masked) go to our analytics providers in the EU. We identify you by user id, not email. Necessary only leaves this off.

How we use your data

We use your data only to run features you ask for: pitch evaluation, positioning analysis, the execution coach, and strategy chat. We use it to keep the service stable and improve quality.

We do not sell your project data. We do not use your uploads to train public foundation models - and neither does our AI provider (see below).

Who processes your data

We use a small set of third-party service providers (data processors) to run Whether. Here is what each category does with your data:

• Cloud hosting and infrastructure- we use a third-party cloud provider for hosting, sign-in, database, file storage, and server functions. Some services, like sign-in, run on the provider’s global infrastructure.
• AI processing- the AI models that analyze your decks run inside our own cloud project. We don't use your data to train or fine-tune AI models. The provider may keep a short-lived cache of inputs and outputs (up to 24 hours) to speed up responses, and limited logs for abuse monitoring.
• Payments- when you buy credits you check out on the payment provider’s page; we never see or store your card number. The provider keeps its own payment records as the law requires.
• Email delivery - we use a third-party email delivery service to deliver our transactional emails (invitations, verification, summaries and notifications).
• Product analytics - optional analytics, only if you accept analytics cookies.
• Bot protection - we use bot protection on our invitation forms.

Public market data (game stats and tags) comes from public game databases. No personal data is sent to them.

Where your data goes

Whether runs on major cloud infrastructure. These transfers are covered by the EU-US Data Privacy Framework and by the EU Standard Contractual Clauses in our providers’ data processing terms. Your files and chats are stored encrypted. Analytics stay in the EU.

How we protect your data

• Sensitive project content (pitches, reports, chats) is stored encrypted at rest (AES-256-GCM, keys managed in our cloud provider’s key management service). Even someone holding a copy of our database could not read your pitch as plain text.
• Only your signed-in account can request your project data through the app. File downloads use short-lived signed URLs.
• All traffic runs over HTTPS.
• Our AI provider does not train on your uploads (see “Who processes your data”).

This is not end-to-end encryption - the analysis runs on our servers, and our team may access data when needed to operate the service, fix incidents, or comply with law.

How long we keep it

• Account and project data - until you delete the project or your account.
• Purchase and credit records - kept after account deletion for accounting and legal reasons (German tax law generally requires up to 10 years).
• Usage cost records - kept for our own cost accounting.
• Market signals derived from decks (genre, tags, budget and team figures) - kept after deletion; they hold no files or chat text, and when your account is deleted the internal account id is replaced by a random id, so they are fully anonymous and cannot be traced back to you.
• Invitation requests - kept while pending and after a decision.
• Analytics - kept in the EU.
• Backups - routine backups can take a little longer to clear.

Your rights

You can ask us at any time to: access your data and get a copy, correct it, delete it, restrict how we use it, receive it in a common machine-readable format (data portability), or object to how we use it. You can withdraw analytics consent anytime via Cookie settings in the footer.

To exercise any of these, use our contact form and include the email address on your account. We respond within one month at the latest, free of charge. For an export, we send your account data, project content and uploaded files in a common machine-readable format.

You can also delete projects and your whole account yourself in the app (see below). And you have the right to complain to a supervisory authority - for us that is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte fur Datenschutz und Informationsfreiheit).

Cookies

Necessary cookies and storage keep you signed in (our sign-in service), remember the site gate if it is on, and store your cookie choice. These are required for the product to work.

Analytics cookies are optional. The banner offers Necessary only or Accept all. Accept all turns on our analytics providers. Necessary only leaves them off. We do not set analytics cookies until you accept all.

Deleting your data

Delete any project from your workspace to remove its database record, uploaded files, and its related chats, share links and feedback. That deletion is permanent.

You can also delete your whole account in Settings. That removes your projects and files, chats, share links, publisher profile and team links, your payment customer record, and your login.

Some data stays after deletion: purchase and credit records, usage cost records, and the derived market signals described above. Routine backups can take a little longer to clear. The payment provider keeps its own payment records as the law requires.

If we contacted you as a publisher

We keep a private list of publisher contacts for outreach about Whether, based on our legitimate interest in offering the service (Art. 6(1)(f) GDPR). These contacts are not visible to other users and create no account. You can object at any time - reply to the email or use our contact form and we will stop contacting you.

Changes to this policy

If we change how we handle data, we update this page and the date at the top. Material changes get called out, not buried.