Privacy Policy — referral program excerpt

Note: beta excerpt. This page describes only the data processing within our refer-a-friend referral program. You can find the complete Privacy Policy pursuant to Art. 13 GDPR at Privacy. If you currently take part only in the referral program, this excerpt is legally complete for this area.

This section supplements our general Privacy Policy with the specific data processing within the refer-a-friend program (Phase N).

Referral program — data processed

If you use our referral program (“Refer-a-Friend”), we process the following personal data in our database (EU Frankfurt, Supabase):

• referral_codes (table): your personal referral code (e.g. DY2TZ87X), as well as creation, rotation and usage timestamps.
• referrals (table): one row per referral — it is only created when the invited person signs up via your referral link, and it contains their user_id. You send invitations exclusively yourself (e.g. via a prepared draft in your own email program); in doing so, WhispaWave collects and stores no recipient email addresses. Rows from the former in-app sending (until July 2026) may historically still contain a recipient email address (invitee_email) — it is replaced by the invited person's user_id when they sign up. Status values (pending — historical only / signed_up / activated / rewarded / revoked), activation and reward timestamps are also kept.
• pending_referral_credits (table): parked bonus months for you if you did not have an active Pro contract at the time the invited contact was activated (Stripe coupon ID, amount in cents, block reason).
• referral_reward_audit (table): audit trail of all status transitions (activated, rewarded, canceled, refund-window scan, counter reconcile). Retained for 36 months under Section 195 of the German Civil Code (BGB) (standard limitation period) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in defending against or asserting claims arising from the referral relationship). After an account deletion, this audit trail is pseudonymized: your user identifier is removed from it.
• referral_cookie_consents (table): If you reach our site via a referral link and answer the attribution question (see the section “Attribution cookie for referral links” below) with yes or no, we store server-side only your referral code, your decision and the time — without any information about the visiting person (no IP address, no browser identifier, no link to an account). The referral code itself can be attributed to the referring person. Retained for 24 months, then deleted automatically.

Legal basis

Art. 6(1)(b) GDPR (performance of a contract — you actively agreed to the referral program by taking part) and Art. 6(1)(f) GDPR (legitimate interest — abuse prevention via the activation threshold and the audit trail).

Withdrawing from participation

In the “Privacy” tab of your account, you can deactivate the referral program. When your account is deleted, all referral data identifying you is irreversibly deleted within 30 days. The column referrals.invitee_email is automatically replaced by NULL when the invited person deletes their account, so that only a pseudonymous reward history remains for the inviter.

Stripe coupons already paid out to the referral partner remain in place under Art. 17(3)(b) GDPR (compliance with a legal obligation — tax retention).

Stripe customer balance on withdrawal

If you, as a referred person, withdraw within 14 days of signing up (right of withdrawal under Section 355 of the German Civil Code (BGB)) AND your inviter has already had the bonus month applied to their invoice, the amount is settled with your inviter via the Stripe customer balance (operated by Stripe Payments Europe Ltd., Ireland). This processing is a necessary consequence of your decision to withdraw; it does not establish a new, independent data processing relationship between you and Stripe — Stripe is already our payment processor (see processors).

The withdrawal backup system scans the rewards paid out in the last 14 days every day (05:15 UTC) and checks via the Stripe API whether the underlying invoice was refunded. This serves exclusively the correct reversal under § 355 BGB in case the immediate webhook notification from Stripe has failed.

Apple Private Relay detection (historical data only)

Until July 2026, invitations could be sent via WhispaWave; in doing so, our system detected addresses at @privaterelay.appleid.com (Apple Hide My Email) and logged an audit entry — without the email address in plain text, exclusively as a cryptographic SHA-256 hash for internal forensics (analysis of whether a referral mismatch was caused by relay forwarding).

Since the switch to self-sharing, WhispaWave no longer sends invitations; no new entries of this kind are created. Existing audit entries are subject to the 36-month retention described above.

Counter reconcile job (technical self-healing)

Once a week (Sundays 06:30 UTC), our system reconciles the referral counter values cached in user_profiles (referrals_rewarded_count, pending_credits_count) with the actual records and corrects any drift. No new personal data is created in the process — only existing counter values are adjusted where necessary.

Attribution cookie for referral links

If you reach our site via a referral link (e.g. https://whispawave.de/r/DY2TZ87X), we set no cookie yet. On the following page, we ask you expressly: “May we attribute the referral to you?” — with two equally designed answer options. We only ask this question on devices on which the attribution cookie can be used (Mac); on other devices, we show you the referral code directly, without storing anything on your device.

• If you choose “Yes, attribute referral”: We set an attribution cookie (referral) with a lifetime of 30 days, valid exclusively for whispawave.de. The legal basis is your consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The consent is bound to the code: if you later follow a referral link with a different code, we ask again. You can withdraw your consent at any time — via “Remove attribution” directly on the referral page (deletes the attribution cookie) or by deleting the cookie in your browser.
• If you choose “No, continue without attribution”: Instead, we set a decline marker (referral_consent=denied:<CODE>, likewise 30 days) — it contains the declined referral code, so that the decline can apply to exactly that code, and it ensures that we generally do not ask you again on a later visit with the same code (only the most recent decline is stored at any time). Like the consent, the decline is bound to the code: if you later follow a referral link with a different code, we ask again. This storage of your consent status is permitted as strictly necessary storage under § 25(2) no. 2 TDDDG. An attribution cookie previously set for the same code is deleted in the process — for this code, your decline takes precedence over an earlier attribution. We continue to show you your referral code even after a decline; we do not store an attribution in the process.
• Server-side log: In addition, we log your decision server-side in the table referral_cookie_consents (see above) — exclusively the referral code, the decision and the time, without any information about the visiting person. The referral code itself can be attributed to the referring person. The legal basis is our obligation to demonstrate consents given or refused (Art. 7(1) GDPR) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in reliable documentation of consent). Retention: 24 months, then deleted automatically.

Tracking-free

For the referral program, WhispaWave uses no third-party pixels, no IP-based tracking cookies and no UTM parameters. Attribution takes place via your referral code — either directly from the URL or, after your express consent, via the 30-day cookie described in the section “Attribution cookie for referral links”.

Transcript report with optional audio attachment (Phase S.2.E)

If you report a transcription as faulty (“Report transcript” function in the app), you can, on your own explicit initiative, attach an audio file as diagnostic material:

• Legal basis: Art. 6(1)(a) GDPR (express consent by actively switching on the “Attach original audio” toggle). The toggle is off by default — no audio is transmitted without your conscious decision.
• Which data: The audio file you explicitly selected (WAV or M4A, max. 5 MB) from your local storage. This is a file that you actively choose in the file selection dialog — the app never records audio via the microphone without being asked.
• Purpose: Diagnosis of ASR quality problems by our team (founder triage). No training of external models without separate consent.
• Storage location: Supabase Storage (EU Frankfurt) in the private bucket support-attachments. No disclosure to third parties.
• Retention: A maximum of 90 days, then deleted automatically. The rest of the transcription report (text, correction note) follows the general support retention rules.
• Withdrawal of consent: You can withdraw your consent at any time by sending a support request to support@whispawave.de and requesting the deletion of the audio file.

Anti-pattern protection: Via the microphone, WhispaWave captures only the dictation sessions actively started by the user. The audio attachment function for transcription reports is an express opt-in that requires a separate file selection dialog — no automatic capture in the background.

Processors

You can find the list of our processors (in particular Stripe, Resend, Supabase) under Subprocessors. Phase N.4–N.6 (Refer-a-Friend) does not introduce a new subprocessor — all services used were already part of our pre-N architecture.

Withdrawal and deletion

You can delete your account at any time (Art. 17 GDPR — right to be forgotten). We then delete all data identifying you from the referral program within 30 days, with the exception of the audit trails that are retained for 36 months and pseudonymized in the process (your user identifier is removed from them; legal basis Section 195 of the German Civil Code (BGB) in conjunction with Art. 6(1)(f) GDPR) and of the Stripe coupons that continue to exist under Art. 17(3)(b) GDPR.