Privacy policy
Last updated 28 August 2026.
Whimsee Ltd is the data controller for the personal data described here. We are registered with the Information Commissioner's Office under reference ZC209762.
What we collect
- Your account. Email address, the name you give for yourself or your business, and sign-in records.
- What you tell Jack. Ideas, chat messages, photos you upload, your tone-of-voice profile, standing rules, brand colours and logo, and any newsletter address you ask us to watch.
- What Jack writes. Drafts, graphics, and which of them you approved, banked or binned.
- Your connected accounts. Which platforms you connected and the account names. We do not hold your social media passwords or access tokens; the publishing provider holds those.
- Performance. Engagement figures for your published posts, which is how Jackdaw learns what works for you.
- Billing. Your plan, subscription status, and how many ideas you have used this month. Card details go straight to Stripe and never reach us.
Why, and on what basis
| What for | Lawful basis |
|---|---|
| Running your account and drafting your posts | Performance of our contract with you |
| Taking payment and keeping accounting records | Contract, and our legal obligations |
| Keeping the service secure and preventing abuse | Our legitimate interests |
| Emailing you about the service (outages, changes to these terms) | Contract |
| A few emails while you get set up, and one asking how it's going | Our legitimate interests. Every one has a link that stops them |
| Seeing how the app is used, so we can fix what gets in the way | Our legitimate interests |
| The early-access waitlist | Your consent, withdrawable at any time |
We do not sell your data, we do not advertise to you, and we do not use your content to train AI models.
Who else touches it
We use a small number of processors. Each gets only what it needs to do its job.
| Who | What they get |
|---|---|
| Anthropic | The idea, your tone profile and rules, and any photo or newsletter text involved, so a draft can be written. Sent per request, not stored by us there. |
| Our publishing provider | The approved post, its media, and the connection to your social accounts. |
| Stripe | Your email address and card details, for payment. We never see the card. |
| Resend | Your email address, to send your sign-in link and the few emails that come while you get set up. |
| Fasthosts | The server in the United Kingdom where the database lives. |
| PostHog | Visitor counts on our public website; how the app is used, tied to an internal account number rather than your name or email address; and your email address if you join the early list, so we can tell a person signing up from a script doing it. Never anything you write. Servers in the European Union. |
| Cloudflare | Your IP address and signals from your browser, when you sign up or sign in, so Turnstile can tell a person from a bot. It does not set advertising cookies or sell the data. |
Some of these are outside the UK, mainly in the United States. Where that is the case, transfers are covered by the UK's International Data Transfer Addendum or an adequacy decision. Ask us at hello@whimsee.co.uk if you want the detail for a particular one.
How long we keep it
- Your account and content: while your account is open, and deleted within 30 days of you closing it.
- Your conversations with Jack: 30 days, then deleted automatically. We keep your most recent twenty messages past that so the app still has your place when you come back. Posts you queued or kept are not conversation and are not affected.
- Billing records: six years after the end of the accounting period, because company and tax law requires it.
- Sign-in links: 15 minutes. Sessions: 30 days.
- Waitlist emails: until you ask us to remove yours, or until we stop running a waitlist.
- Your answers to our "how's it going" question: while your account is open.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to processing we base on legitimate interests. You can withdraw consent where consent is the basis.
Email hello@whimsee.co.uk and we will respond within one month. There is no charge.
If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but it is your right either way.
Cookies
The app sets one cookie, which keeps you signed in. It is necessary for the service to work, so there is no banner asking about it. We set no advertising or tracking cookies in the app. The app uses PostHog the same way the website does, without cookies, and ties what it sees to an internal account number rather than to you by name.
Our public website uses PostHog, configured without cookies and without storing anything on your device. Visitor counts are anonymous. Joining the early list is the one exception: your email address is recorded there as well as here, so we can tell a person signing up from a script doing it. Ask us and we will delete it from both.
Security
Data is encrypted in transit. Sign-in links and session tokens are stored only as hashes, so a copy of the database does not let anyone sign in as you. The database sits on a server in the United Kingdom with no public access.
No system is perfectly secure. If we ever have a breach that puts you at risk, we will tell you and the ICO within the time the law allows.
Children
Jackdaw is for people aged 18 and over, and is not directed at children.
Getting in touch
Whimsee Ltd, company number 17353256, registered in England and Wales at 134 Lakeside Avenue, Lydney, England, GL15 5QB.
Email hello@whimsee.co.uk.