Who we are and how to contact us
Whitelabel AI Corporation ("Whitelabel," "we," "us," or "our") provides a platform that our business customers use to build and operate their own products and services. This Privacy Policy describes how we handle personal information in connection with our website, the platform, and related services.
If you have any questions about this Privacy Policy or our handling of personal information, you can reach us at:
- Email: privacy@whitelabel.ai
- Mail: Whitelabel AI Corporation, 823 Congress Ave, Austin, TX 78701
Our roles: controller and processor
Our role under data protection law depends on whose data is involved and why we are handling it.
When our customers use the platform to collect and process information about their own end users, the customer is the controller of that end-user data and decides why and how it is processed. In that context, Whitelabel acts as a processor and handles end-user data on the customer's behalf and on the customer's documented instructions, as set out in our Data Processing Addendum (DPA).
For information we collect to run our own business, such as data about our customers' administrators and other account users, billing and payment information, and security and operational logs, Whitelabel acts as the controller and is responsible for how that information is used.
If you are an end user of a product built on our platform, the organization that operates that product is the controller of your information, and you should direct privacy questions and requests to that organization in the first instance. See the section on your rights below.
Categories of personal information we collect
Depending on your relationship with us, we may collect the following categories of personal information:
- Account and administrator data: names, business email addresses, and other contact and profile details for the customer administrators and users who set up and manage the platform.
- Billing and payment data: information needed to process payments and manage subscriptions. Payment card details are collected and handled by our payments processor and are not stored on the platform itself.
- Security and operational data: logs, device and connection information, and other records we generate to operate, secure, monitor, and troubleshoot the platform.
- End-user data processed on behalf of customers: information our customers route through the platform about their own end users. We process this data as a processor under the DPA, and the categories are determined by the customer.
How we use personal information
As a controller of account, billing, and security data, we use personal information to:
- Provide, operate, maintain, and improve the platform and our website.
- Set up and administer customer accounts and authenticate users.
- Process payments, manage subscriptions, and carry out billing.
- Secure the platform, prevent and detect fraud and abuse, and maintain operational logs.
- Communicate with customers about their accounts, service changes, and support requests.
- Comply with our legal obligations and enforce our agreements.
As a processor, we use end-user data only to provide the platform to the relevant customer and to follow that customer's documented instructions, as described in the DPA.
How we use data for AI and model training
We do not use private customer content or conversation logs to train foundation models or other generalized models. Customer content stays within the scope of providing the service to that customer.
We may use de-identified and aggregated data, which does not identify any individual, to support and improve our operations, including monitoring performance, maintaining reliability, and enhancing the platform.
Subprocessors and sharing
We engage a limited set of third-party subprocessors to help us provide the platform. Each subprocessor is bound by contractual obligations consistent with this Privacy Policy and our DPA. Our current subprocessors include:
- Amazon Web Services (AWS): cloud hosting and infrastructure.
- PostHog: product and website analytics.
- OpenAI API: AI model processing, where a customer has configured that capability.
- Finix: payment processing.
Payment card data is collected and processed by our payments processor outside the platform, and we do not store full payment card details on the platform.
We do not sell personal information. We may also share information where required to comply with the law, to enforce our agreements, or to protect the rights, safety, and security of Whitelabel, our customers, and others.
International data transfers
We may process and store personal information in the United States and in other countries where we or our subprocessors operate. These countries may have data protection laws that differ from those in your country.
Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), to protect that information.
Data retention
We retain personal information for as long as needed to provide the platform, maintain and secure our service, and meet our legal, accounting, and reporting obligations.
For end-user data we process on behalf of a customer, retention and deletion follow the customer's instructions and the terms of the DPA. When data is no longer required, we delete or de-identify it in line with our retention practices.
Security
We maintain administrative, technical, and organizational measures designed to protect personal information against unauthorized access, use, alteration, and disclosure. These measures include:
- Encryption of data in transit and at rest.
- Access controls that limit access to personal information to those who need it.
- Operational and security controls modeled on the SOC 2 framework.
- Monitoring and logging to detect and respond to security events.
In the event of a personal data breach, we will notify affected customers without undue delay and cooperate as needed, consistent with our obligations under the DPA and applicable law.
Your privacy rights and how to exercise them
Depending on your location, you may have rights regarding your personal information, such as the right to access, correct, delete, or restrict the processing of your information, and the right to object to certain processing.
If you are a customer administrator or other account user and we act as the controller of your information, you can exercise these rights by contacting us at privacy@whitelabel.ai.
If you are an end user of a product built on the platform, the customer that operates that product is the controller of your information. Please direct your requests to that organization. If you contact us, we will refer your request to the relevant customer and support them in responding, as required by the DPA.
Children
Our platform and website are intended for businesses and are not directed to children. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information to us as a controller, please contact us at privacy@whitelabel.ai and we will take appropriate steps to address it.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the policy and, where appropriate, provide additional notice.
Your continued use of the platform or website after an update takes effect means you accept the revised Privacy Policy.
Questions about this document? Email privacy@whitelabel.ai. This page reproduces the current policy for convenience; where it differs from your signed agreement, the agreement controls.