Privacy notice

1. Who is responsible

[legal entity name], [registered address], is responsible for your personal data in Whoois. Contact: [privacy contact email]. [For counsel: an EU or UK representative, and a data protection officer, if required.]

Our terms of use are at https://whoois.app/terms.

2. What we keep, and why

• Your Itsmi profile: your first and last names; your email address and mobile number, each once you've verified it with a code; the addresses you pick, each with the label you give it; and your language, for our emails. Each address is picked from Amazon Location Service's suggestions as you type. Where a country's addresses have their own script (Israel, Greece, Cyprus and Bulgaria), we keep an address in that script and in Latin letters, so that a store in the country or abroad can deliver. Why: to run your Itsmi profile, to let you recover it, and, once purchases come, to give the stores in a purchase you confirm what they need to deliver. [For counsel: the lawful bases.]
• Your passkeys: for each one, its public key, its ID, a counter that rises with each sign-in, how your device reaches it, whether it syncs, and when it was added and last used. Your fingerprint, face or PIN never reach Whoois: they stay on your device.
• Recovery codes: only as one-way hashes, from which the codes can't be read back.
• Sessions: a cookie keeps you signed in, for up to 30 days. We keep only a one-way hash of it.
• Codes we send by email or text: only as one-way hashes, for 10 minutes.
• Your consent to a text: each time you ask for a code by text, when you agreed, to which words, in which language, and a one-way hash of the number. AWS requires us to keep this record. [For counsel: for how long.]
• Security notices: when your email address, mobile number, passkeys or recovery codes change, or a recovery by email starts, we email your Itsmi profile's email address, with a link that locks your Itsmi profile. We keep only a one-way hash of the link, for 7 days.
• A recovery by email: while it waits, when it started, for up to 7 days.
• AI assistants you connect: which assistant, what it may do, when you connected it and last used it, and an identifier for you that is different for each assistant.
• Records of what happened: each request's step and its outcome, with a random number to trace it, for a year. They never hold your name, contact details, addresses, codes, passkeys or tokens.
• Your network address: to stop abuse, we count requests per IP address, and codes per email address and mobile number, keeping each only as a one-way hash, for up to 2 days. Our firewall's logs keep the IP address of each request for a year, with its cookies, its authorization and its web address's query removed.

3. What we don't do

We show no advertising, sell no personal data, use no tracking or advertising cookies, and put no tracking in our emails.

4. Who handles your data for us

Amazon Web Services runs Whoois for us, in its US East (Ohio) region. Through it, Amazon Simple Email Service sends our emails; AWS End User Messaging Notify sends our texts, from its US East (N. Virginia) region; and Amazon Location Service suggests addresses as you type, which it may process outside the US East (Ohio) region. [For counsel: the processor terms, the list of sub-processors, and transfers out of the EU, the UK and Israel.]

5. Who we share it with, and when

• AI assistants you connect: that you're signed in, and what kinds of passkey you have. Never your name, contact details or addresses.
• Miapps you connect (coming): only with your permission, and only each saved address's label, country, region and postal code. You can withdraw the permission in Whoois at any time.
• Stores (coming): your name, email address, mobile number and the address you choose, only after you confirm a purchase with your passkey, and only to the stores in that purchase.

Text messages:

• No mobile numbers will be shared with third parties or affiliates for marketing or promotional purposes.
• Text messaging originator opt-in data and consent will not be shared with any third parties.
• Messages are delivered through AWS Notify. AWS does not share end user phone numbers with third parties for marketing or promotional purposes.

[For counsel: legal requests; a sale or merger.]

6. How long we keep it

• Your Itsmi profile, with its passkeys, addresses and connected AI assistants: until you remove them. [Deleting your Itsmi profile comes before launch. For counsel: what deleting it keeps.]
• Sessions: up to 30 days. Codes: 10 minutes. A notice's link: 7 days. A recovery by email: up to 7 days. Counts against abuse: up to 2 days.
• Records of what happened, and the firewall's logs: a year.
• Your consents to texts: [for counsel].

7. Your rights

You can see and correct your details on your Itsmi profile's page at any time. [For counsel: access, deletion, portability, objection and complaint, under the EU and UK GDPR, Israel's Protection of Privacy Law, Canada's PIPEDA and the US states' laws; and how to make a request.]

8. Children

[For counsel: the minimum age.]

9. Cookies

Whoois uses only the cookies it needs to work: one that keeps you signed in; one that ties a sign-in from an AI assistant to your browser; two that tie a lock or a recovery you started to your browser, while it lasts; and one that remembers the language you chose. None tracks you, and none is shared. [For counsel: whether each needs consent.]

10. Changes to this notice

[For counsel.]

11. Languages

This notice is published in English. [For counsel: the Hebrew and Spanish versions, and which version governs.]