Privacy Policy

This Privacy Policy explains how Eager Lobster Ltd, trading as “whoot” (“we”, “us”, “our”), collects, uses, shares, and protects your personal data when you use the whoot. platform, website, and related services (collectively, the “Service”).

Eager Lobster Ltd is a company registered in England and Wales (Company Number 17038042), with its registered office at First Floor 1 Des Roches Sq, Witan Way, Witney, England, OX28 4BE.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, together with the Privacy and Electronic Communications Regulations 2003 (as amended) and all other applicable data protection laws in force in England and Wales (together, the “Data Protection Laws”).

Our role. For personal data relating to your account, billing, and your use of our website and marketing channels, Eager Lobster Ltd is the data controller. For Content created within a Workspace by its members — including voice audio, recordings, transcripts, and messages — we generally act as a data processor on behalf of the organisation that operates the Workspace, which is the data controller for that Content. Where we act as your processor, we do so under the data processing terms described in Section 4 and in our Terms & Conditions, and a separate Data Processing Agreement is available on request.

By using the Service you agree to the collection and use of information in accordance with this policy. This policy should be read alongside our Terms & Conditions.

1. Information We Collect

1.1 Information you provide

• Account information — name, email address, and password when you create an account.
• Organisation information — workspace name, slug, and billing details (including payment card details processed by our payment provider, Stripe).
• Profile information — avatar, display name, and any other information you choose to add to your profile.
• Communications — when you contact us for support or other enquiries.

1.2 Information we collect automatically

• Usage data — features used, rooms joined, timestamps, and interaction patterns.
• Device and browser data — IP address, browser type, operating system, device identifiers, and screen resolution.
• Cookies and similar technologies — session cookies for authentication and optional analytics cookies. See Section 9 for details.
• Audio and transcription data — voice audio spoken in a room is processed to deliver real-time communication. If recording is enabled on a room by a Workspace administrator, voice audio is recorded and stored. Where transcription is enabled, audio is converted to text transcripts by our speech-to-text sub-processor (Deepgram). Audio is never recorded unless the feature is explicitly activated by an administrator. See Section 4 for how our sub-processors handle this data and Section 5 for our use of artificial intelligence.
• Content processed by AI features — where you or your Workspace administrator use our optional AI features (for example transcription, conversation summaries, search, and compliance or intelligence tooling), the relevant audio, transcripts, or message text is processed by our AI sub-processors (Deepgram and OpenAI) to generate the requested output. See Section 5.
• Audit logs — actions performed within the Service (e.g. member invitations, role changes, settings updates) are logged for security and compliance purposes.

2. How We Use Your Information

We use your personal data to:

• Provide, operate, and maintain the Service.
• Process payments and manage your subscription (via Stripe).
• Send transactional communications (e.g. invitations, password resets, billing receipts).
• Provide customer support and respond to your enquiries.
• Monitor and improve the Service, including performance, security, and reliability.
• Detect, prevent, and address fraud, abuse, or technical issues.
• Provide optional AI features that you or your Workspace administrator choose to enable — such as transcription, conversation summaries, semantic search, and compliance or intelligence tooling (see Section 5).
• Comply with legal obligations under applicable law.

We do not sell your personal data to third parties. We do not use your audio, recordings, transcripts, or message Content for advertising, and neither we nor our sub-processors use it to train, fine-tune, or otherwise develop artificial-intelligence or machine-learning models. Our sub-processors are contractually prohibited from doing so (see Section 4).

3. Lawful Basis for Processing

Where Eager Lobster Ltd is the data controller, we rely on the following lawful bases under Article 6 of the UK GDPR (as amended by the Data (Use and Access) Act 2025):

• Contract — processing necessary to perform our contract with you (the Terms & Conditions).
• Legitimate interests— improving the Service, ensuring security, preventing fraud, and communicating service updates, where these interests are not overridden by your rights. This includes, where applicable, the “recognised legitimate interests” introduced by the Data (Use and Access) Act 2025.
• Legal obligation — where we are required to process data to comply with a legal obligation.
• Consent — where we rely on your consent (e.g. optional analytics cookies), you may withdraw consent at any time.

Where we process Workspace Content as a processor on behalf of an organisation, that organisation (the controller) is responsible for establishing the lawful basis for the processing, including any consents required for recording, transcription, or AI processing under applicable law.

4. Data Sharing and Sub-processors

We do not sell your personal data. We share it only as described below.

4.1 Categories of recipient

• Sub-processors — third parties who process personal data on our behalf, under written contracts that require them to act only on our instructions, to keep the data secure, and to comply with the Data Protection Laws. The current list is set out in Section 4.2.
• Workspace administrators — administrators of your Workspace can see member details, audit logs, and (if enabled) recordings, transcriptions, and AI-generated outputs.
• Legal requirements — if required to do so by law, regulation, legal process, or a governmental or regulatory request.
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case your data would be transferred as part of the business assets.

4.2 Our sub-processors

We use the following categories of sub-processor to provide the Service. Each processes personal data only to perform the service described and under a data processing agreement that complies with Article 28 of the UK GDPR.

• Supabase — database and authentication.
• Amazon Web Services (AWS) — cloud infrastructure, compute, object storage of recordings, secrets management, and (for emergency announcements) text-to-speech via AWS Polly.
• Stripe — payment and subscription processing. We do not store card details on our systems.
• Twilio — PSTN/SIP telephony for dial-in and dial-out.
• Deepgram — speech-to-text transcription of voice audio and text-to-speech for alert announcements.
• OpenAI — AI processing of transcripts and message text for features such as summaries, semantic search, and compliance and intelligence tooling.
• Email delivery provider — sending transactional emails such as invitations, password resets, and receipts.

An up-to-date list of sub-processors is available on request, and customers under a Data Processing Agreement are notified of material changes to the sub-processor list.

4.3 Our AI sub-processors — non-storage basis

Our AI features are powered by two specialist sub-processors: Deepgram (speech-to-text and text-to-speech) and OpenAI (language-model processing). We have data processing agreements with both, under which:

• they act only as our processors and may use the data we send solely to return the transcription or AI output we have requested — and for no other purpose;
• they are contractually prohibited from using your audio, transcripts, messages, or any other Content to train, fine-tune, or improve their own models; and
• the data is processed on a non-storage basis — it is not retained by them after the request has been completed and the result returned, beyond any transient, in-memory processing strictly necessary to deliver the result.

This non-storage commitment applies to these third-party sub-processors. whoot. itself stores transcripts and related data within your Workspace in accordance with the retention settings described in Section 7.

5. Artificial Intelligence and Automated Processing

The Service offers optional features that use artificial intelligence, including real-time transcription, conversation summaries, semantic search, and compliance and intelligence tooling. These features process voice audio, transcripts, and message text using our sub-processors Deepgram and OpenAI on the non-storage, no-training basis described in Section 4.3.

AI-generated outputs (such as transcripts and summaries) may contain inaccuracies and should not be relied upon as a complete or authoritative record. We do not use these features to make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. Where a Workspace administrator uses compliance or monitoring features, the organisation operating the Workspace is the controller for that processing and is responsible for ensuring it is lawful, fair, and transparent to the individuals concerned.

6. International Transfers

Some of our sub-processors — including Deepgram, OpenAI, and certain AWS and Stripe services — are based in, or process data in, the United States or other countries outside the United Kingdom. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place under the Data Protection Laws, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or reliance on UK adequacy regulations. A copy of the relevant safeguards is available on request.

7. Data Retention

• Account data — retained for as long as your account is active, plus a reasonable period thereafter to comply with legal obligations.
• Audio recordings — retained according to the retention policy configured by the workspace administrator (default: 30 days; extended retention available). Recordings are permanently deleted after the retention period expires.
• Transcription data — retained for the same period as the associated recording.
• AI-generated outputs — summaries, search indexes, and similar outputs generated by our AI features are stored within your Workspace and deleted in line with the retention of the underlying Content. (Our AI sub-processors do not retain the data after processing — see Section 4.3.)
• Audit logs — retained for a minimum of 12 months for security and compliance purposes.
• Billing records — retained for 7 years as required by HMRC.

8. Your Rights

Under the Data Protection Laws, you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data where there is no compelling reason for its continued processing.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Data portability — request your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within one month, although under the Data (Use and Access) Act 2025 we may, where permitted, pause that period while we seek the information reasonably required to confirm your identity or to clarify your request.

Complaints. If you are unhappy with how we have handled your personal data, you have the right to complain to us first. Please contact us at [email protected]. In accordance with the Data (Use and Access) Act 2025, we will acknowledge your complaint within 30 days of receipt, investigate it without undue delay, and keep you informed of the outcome.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO) — being reconstituted as the Information Commission under the Data (Use and Access) Act 2025 — at ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.

9. Cookies

We use the following types of cookies:

• Strictly necessary cookies — required for the Service to function (e.g. authentication session cookies). These cannot be disabled.
• Analytics cookies — help us understand how visitors interact with the Service. Except where the Data (Use and Access) Act 2025 permits certain low-risk analytics without consent, these are only set with your consent.

You can manage your cookie preferences through your browser settings or through our cookie-consent banner.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-level security for data isolation between tenants.
• Multi-factor authentication (MFA) support with configurable enforcement.
• Regular security assessments and penetration testing.

11. Children

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

• Email: [email protected]
• Post: Eager Lobster Ltd, First Floor 1 Des Roches Sq, Witan Way, Witney, England, OX28 4BE