Privacy Policy

This Privacy Policy explains how Eager Lobster Ltd, trading as “whoot” (“we”, “us”, “our”), collects, uses, shares, and protects your personal data when you use the whoot. platform, website, and related services (collectively, the “Service”).

Eager Lobster Ltd is a company registered in England and Wales (Company Number 17038042), with its registered office at First Floor 1 Des Roches Sq, Witan Way, Witney, England, OX28 4BE.

By using the Service you agree to the collection and use of information in accordance with this policy. This policy should be read alongside our Terms & Conditions.

1. Information We Collect

1.1 Information you provide

• Account information — name, email address, and password when you create an account.
• Organisation information — workspace name, slug, and billing details (including payment card details processed by our payment provider, Stripe).
• Profile information — avatar, display name, and any other information you choose to add to your profile.
• Communications — when you contact us for support or other enquiries.

1.2 Information we collect automatically

• Usage data — features used, rooms joined, timestamps, and interaction patterns.
• Device and browser data — IP address, browser type, operating system, device identifiers, and screen resolution.
• Cookies and similar technologies — session cookies for authentication and optional analytics cookies. See Section 8 for details.
• Audio data — if recording is enabled on a room by a workspace administrator, voice audio is recorded and stored. Transcription data is generated if transcription is enabled on the room. Audio is never recorded unless the feature is explicitly activated by an administrator.
• Audit logs — actions performed within the Service (e.g. member invitations, role changes, settings updates) are logged for security and compliance purposes.

2. How We Use Your Information

We use your personal data to:

• Provide, operate, and maintain the Service.
• Process payments and manage your subscription (via Stripe).
• Send transactional communications (e.g. invitations, password resets, billing receipts).
• Provide customer support and respond to your enquiries.
• Monitor and improve the Service, including performance, security, and reliability.
• Detect, prevent, and address fraud, abuse, or technical issues.
• Comply with legal obligations under applicable law.

We do not sell your personal data to third parties. We do not use your audio recordings or transcription data for advertising or for training machine-learning models.

3. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:

• Contract — processing necessary to perform our contract with you (the Terms & Conditions).
• Legitimate interests — improving the Service, ensuring security, preventing fraud, and communicating service updates, where these interests are not overridden by your rights.
• Legal obligation — where we are required to process data to comply with a legal obligation.
• Consent — where we rely on your consent (e.g. optional analytics cookies), you may withdraw consent at any time.

4. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Service providers — hosting (cloud infrastructure), payment processing (Stripe), email delivery, and analytics providers who process data on our behalf under appropriate data-processing agreements.
• Workspace administrators — administrators of your workspace can see member details, audit logs, and (if enabled) recordings and transcriptions.
• Legal requirements — if required to do so by law, regulation, legal process, or governmental request.
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case your data would be transferred as part of the business assets.

5. International Transfers

Your data may be processed outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the Information Commissioner’s Office (ICO) or reliance on an adequacy decision.

6. Data Retention

• Account data — retained for as long as your account is active, plus a reasonable period thereafter to comply with legal obligations.
• Audio recordings — retained according to the retention policy configured by the workspace administrator (default: 30 days; extended retention available). Recordings are permanently deleted after the retention period expires.
• Transcription data — retained for the same period as the associated recording.
• Audit logs — retained for a minimum of 12 months for security and compliance purposes.
• Billing records — retained for 7 years as required by HMRC.

7. Your Rights

Under the UK GDPR, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data where there is no compelling reason for its continued processing.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Data portability — request your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Cookies

We use the following types of cookies:

• Strictly necessary cookies — required for the Service to function (e.g. authentication session cookies). These cannot be disabled.
• Analytics cookies — help us understand how visitors interact with the Service. These are only set with your consent.

You can manage your cookie preferences through your browser settings or through our cookie-consent banner.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-level security for data isolation between tenants.
• Multi-factor authentication (MFA) support with configurable enforcement.
• Regular security assessments and penetration testing.

10. Children

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

• Email: [email protected]
• Post: Eager Lobster Ltd, First Floor 1 Des Roches Sq, Witan Way, Witney, England, OX28 4BE