Skip to content

Privacy Policy

WhyLeft is incorporated in Estonia (EU) and processes all data under GDPR. We act as a Data Controller for information you (the founder) give us, and as a Data Processor for your cancelled customers' data, which we process on your behalf.

The short version of what we live by:

  • We never sell personal data.
  • Cancelled customers receive at most two emails per interview, and every email carries one-click unsubscribe (RFC 8058).
  • Your Stripe connection is read-only; we never see or store card details.
  • You can export or permanently delete all of your customers' interview data from Settings at any time.

AI processing & your customers' data

We use Anthropic (Claude) to tag cancellations, draft exit and win-back emails, run the optional adaptive interview, and power the founder-facing AI Analyst. Our automated AI pipelines receive only the feedback text and non-identifying metadata (plan, price, dates, churn tags) — never a customer's name or email address.

The AI Analyst, which only you can use, may surface a specific customer's identity solely when you explicitly ask a customer-level question, and only within your own authenticated workspace — the same access boundary as the rest of your dashboard. The model never bypasses that boundary and never sees data from another organisation.

Anthropic processes this data as our sub-processor under a Data Processing Agreement with Zero Data Retention (ZDR): prompts and outputs are not retained by Anthropic and are never used to train models.

Sub-processors, DPA & retention

  • Sub-processors: Vercel, Supabase, Stripe, Postmark, Resend, Anthropic (ZDR), Upstash, Clerk — each under GDPR-consistent DPAs.
  • A Data Processing Agreement covering your customers' data is available on request at privacy@whyleft.com.
  • We retain interview and customer data until you delete it or close your account (permanently purged after a 30-day grace period). Billing records are kept for 7 years as required by Estonian tax law.

Questions, access, or deletion requests: privacy@whyleft.com.