Privacy Policy

Last Updated: August 23, 2026

Whalewick is operated by Cloverpin Inc., a California corporation.

This Privacy Policy explains how Whalewick collects, uses, stores, shares, and otherwise processes personal data in connection with www.whalewick.com and related marketplace services.

Sri Lanka's PDPA has extraterritorial reach to entities outside Sri Lanka that offer goods or services to individuals in Sri Lanka, so this policy is drafted on the basis that Cloverpin Inc.'s Sri Lankan marketplace activity may fall within that framework.

Personal Data We May Collect

We may collect:

name;
email address;
telephone number;
account credentials;
billing information;
shipping address;
pickup information;
order history;
wishlist information;
reviews;
support communications;
marketing preferences;
IP address;
browser and device information;
approximate location information;
cookies and identifiers;
fraud and security information; and
usage/activity information.

Vendor Information

For Vendors we may additionally collect:

legal business name;
business registration details;
NIC information of authorized persons;
business contact details;
Sri Lankan bank account details;
Stripe account information;
payout information;
transaction information;
Seller verification information;
tax/compliance information;
store details; and
documents used to establish authenticity or authorization.

How We Collect Information

We may receive personal data:

directly from you;
through account registration;
during purchases;
through Vendor onboarding;
from Vendors;
from Stripe;
through cookies and tracking technologies;
through support communications;
from fraud/security providers;
from analytics platforms; and
from other service providers.

Why We Use Personal Data

We may process personal data to:

create accounts;
process orders;
facilitate payments;
facilitate COD and store pickup;
coordinate Vendor payouts;
administer returns and disputes;
provide customer support;
maintain wishlists;
publish reviews;
prevent fraud;
secure the Platform;
onboard and verify Vendors;
communicate with users;
send requested or permitted marketing;
improve the Platform;
analyze usage;
provide AI-assisted features;
comply with legal obligations; and
establish, exercise, or defend legal claims.

Payment Processing — Stripe

Whalewick uses Stripe and Stripe Connect for payment and Vendor payout functionality.

Stripe may process information necessary to:

authenticate payments;
facilitate transactions;
verify connected accounts;
manage payouts;
detect fraud;
process refunds;
manage disputes; and
satisfy financial-regulatory requirements.

Stripe Connect supports platform-controlled payout schedules and marketplace payment routing.

Vendors using Stripe Connect may also be subject to Stripe's applicable agreements.

Email — SendGrid

Whalewick uses SendGrid/Twilio to deliver email communications.

Information such as:

email addresses;
message content;
delivery metadata;
engagement information; and
technical delivery data

may be processed for email delivery, security, analytics, and troubleshooting.

Artificial Intelligence — OpenAI

Whalewick may use OpenAI's API to power AI-assisted functionality.

Depending on the feature, data sent to OpenAI could include:

a user's question;
product information;
support-related content;
search context; or
other information required to generate the requested response.

Whalewick should configure AI functionality to minimize unnecessary personal data.

OpenAI states that business/API inputs and outputs are not used for model training by default unless the customer opts in. OpenAI also states that standard API abuse-monitoring logs may generally be retained for up to 30 days unless a longer period is legally required.

Users should not intentionally submit highly sensitive information to AI features unless explicitly requested and necessary.

Analytics and Advertising Technology

Whalewick may use:

Google Analytics;
Google Tag Manager;
Google Ads;
Meta Pixel;
TikTok Pixel;
Cloudflare;
live-chat technology; and
other analytics or performance technologies.

These providers may process identifiers, device information, usage information, referral information, and interactions subject to their applicable configurations and policies.

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Where legally required, optional advertising or analytics cookies should not be activated until the required choice or consent has been obtained.

Sharing With Vendors

When you place an order, the applicable Vendor may receive personal information reasonably necessary to fulfill it, such as:

name;
telephone number;
delivery address;
pickup information;
order items; and
order-related communication.

Vendors must not use Buyer data obtained through Whalewick for unauthorized independent marketing or unrelated purposes.

Sharing With Service Providers

We may share information with providers supporting:

hosting;
payments;
payouts;
email;
security;
analytics;
advertising;
AI;
customer support;
communications;
fraud prevention; and
professional/legal services.

Cross-Border Processing

Because Cloverpin Inc. is established in the United States and Whalewick uses international service providers, personal data may be processed outside Sri Lanka.

We will take measures required by applicable law for cross-border processing and service-provider arrangements.

The Sri Lankan DPA has published materials dealing specifically with processing of personal data outside Sri Lanka, making this an area that should receive final privacy-counsel review before launch.

Data Retention

We retain information only for as long as reasonably necessary for purposes including:

providing accounts;
completing transactions;
Vendor administration;
tax/accounting;
fraud prevention;
dispute handling;
legal compliance; and
enforcement.

Different categories may have different retention periods.

Security

We use reasonable administrative, organizational, and technical safeguards designed to protect personal data.

No online service can guarantee absolute security.

Your Privacy Rights

Subject to the Sri Lankan PDPA and other applicable law, individuals may have rights relating to their personal data, including rights to request access, correction, and other legally available actions.

The DPA states that key PDPA provisions concerning processing, data-subject rights, controllers/processors, and penalties became operational from March 18, 2025.

Requests may be sent to:

legal@whalewick.com

We may verify identity before completing a request.