Whimful Privacy Policy

Effective Date: October 28, 2025

Whimful FZ-LLC ("Whimful," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our websites and services (collectively, the "Services"), as defined in our Terms of Service.

This policy applies to the information we process when you, as a representative of a "Company," use our Services. Please read this policy carefully. By using our Services, you agree to the collection and use of information in accordance with this policy.

1. Our Role: Controller vs. Processor

Our role in processing data depends on the situation:

• We are a Data Controller when we process your "Account Information"—the personal data you provide when you create an account, browse our website, or communicate with us (e.g., your name, email address, billing information). We control the "why" and "how" this data is processed.
• We are a Data Processor when we process "Service Data" on your behalf. "Service Data" is the data your Company (the "Data Controller") provides or generates when using our Services, such as ad creatives, targeting parameters, or the URLs you shorten with Goto.gt. We only process this data according to your instructions (i.e., to provide the Services).

2. Information We Collect as a Controller

We collect the following information from our Company users to provide and manage our Services:

• Account Information: When you sign up for an account, we collect information like your name, your Company's name, email address, and password.
• Payment Information: When you add a payment method, we collect this information to process payments for the Services. This is typically done via a secure third-party payment processor, and we do not store your full credit card number.
• Communications: We collect information when you contact us for support, send us an email, or communicate with us in any way (e.g., support tickets, feedback).
• Usage & Cookie Data: We may automatically collect information when you interact with our websites, such as your IP address, device type, browser, and pages visited. We use cookies and similar tracking technologies to analyze trends and administer the website.

3. Information We Process on Your Behalf (as a Processor)

As your Data Processor, we process Service Data solely to provide the Services to you. You are the Data Controller for this data and are responsible for its legality and for providing any necessary notices to your end-users.

• Whimful & AdTags.io Data: We process the ad creatives, ad tag code, targeting parameters, campaign data, and performance metrics you provide or generate through the Services.
• Goto.gt Link Data: We process the original (long) URLs you submit. When an end-user clicks your Goto.gt link, we necessarily process their IP address, browser/device type, and the referral source to facilitate the redirection and provide you with click statistics.

4. How We Use Your Information

We use the information we collect as a Data Controller for the following purposes:

• To Provide and Improve Services: To operate our platform, create and manage your account, process payments, and improve service functionality.
• Communication: To send you service-related announcements, invoices, support messages, and promotional communications. You may opt out of promotional communications at any time.
• Security & Compliance: To protect the security of our Services, prevent fraud, and comply with our legal obligations (e.g., tax laws).
• Analytics: To analyze usage trends to enhance our offerings. We may aggregate and anonymize data for research and reporting, but this data will not personally identify you.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share information in the following limited circumstances:

• Service Providers: We engage trusted third-party providers to help us operate our Services, such as payment processors, cloud hosting providers, and email service platforms. These providers are bound by confidentiality obligations and are only permitted to use the information to provide services to us.
• Compliance with Laws: We may disclose your information if required by law, subpoena, or in response to a valid legal request from a public authority (e.g., to meet national security or law enforcement requirements).
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in control or use of your information.

6. Data Security

We implement and maintain reasonable technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. However, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

7. Data Retention

We retain your Account Information for as long as your account is active and for a reasonable period thereafter as necessary to comply with our legal obligations (e.g., for financial reporting) or resolve disputes.

We retain Service Data (which we process on your behalf) for as long as instructed by you in your account settings or as necessary to provide the Services. We will delete or return this data upon termination of your account, in accordance with our Terms of Service.

8. International Data Transfers

We are based in the United Arab Emirates. Your information may be transferred to, and maintained on, computers located outside of your state, province, or country, where the data protection laws may differ from those in your jurisdiction. By using our Services, you consent to this transfer, storage, and processing.

9. Your Data Rights

Depending on your location and jurisdiction (e.g., the GDPR in Europe), you may have certain rights regarding your personal information:

• Access, Update, or Delete: You have the right to access, update, or request deletion of your Account Information. You can often do this directly in your account settings.
• Opt-Out: You have the right to opt out of receiving promotional communications from us by following the "unsubscribe" link in those emails or by contacting us.

To exercise any of these rights, please contact us at legal@whimful.com. For requests regarding Service Data (for which you are the Controller), we will direct the inquiry to you or assist you in responding, as applicable.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and, where feasible, by email. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

legal@whimful.com