WhatsMyRepThis policy explains what WhatsMyRep (whatsmyrep.com) collects, why, and what you can ask us to do with it. We keep it short because we collect little.
Who we are
WhatsMyRep is the controller of the personal data described here. WhatsMyRep is run and sold by Zelma Quigley, an individual, not a company, 2381 Zanker Rd Ste 110, San Jose, CA 95131, United States.
What we collect
- The check you run: the business name or website you type and the country you pick, and the report we build from public search results.
- Your account, if you create one: your email address, the businesses you watch, their reports and the history of changes, the alerts we sent, and your settings (risk level, quiet hours, your time zone as your browser reports it, weekly summary on or off).
- Sign in with Google, if you use it: Google tells us your email address, whether Google has verified it, and a fixed identifier of your Google account. We keep the email and the identifier to recognise you next time. Google also sends your name and profile picture; we do not store them. We ask Google for nothing else and get no access to your Gmail, contacts or files.
- Alert channels you add: the Slack, Microsoft Teams or Discord webhook address, or the browser notification subscription your browser gives us.
- Technical data: your IP address and a random identifier in a cookie (wmr_sid), used to apply the limit of free checks and to stop abuse; for signed-in users, a session cookie (wmr_s) and the browser type and IP of each sign-in.
- Payments, if you pay: the invoice (plan, period, amount), the coin, the amount sent, the payment number and transaction hash the gateway gives us. If you ask for a refund, the wallet address you give for it. We never see or keep card details.
- A one-way hash of your email address, so the free trial is given once per address. It stays after you delete the account and cannot be turned back into the address.
- Messages you send through the contact form.
- Visits, counted by our own first-party code on our own server (not shared with anyone): the page, the time, the referring site, campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and ad click identifiers (gclid, msclkid, fbclid) if the link had them, the country worked out from your IP address with a local copy of the DB-IP Lite database, and the device type from your browser. We keep the first visit of each browser as its first touch, so we know which channel first brought you. If you sign up or sign in, we link the browsers you use to your account. No advertising pixels.
- Google Analytics, only if you click "Accept analytics" in the cookie banner: Google Analytics 4 then records your visits and a few events (a check started, a sign-up, the start of a payment, a payment with its invoice number and amount). Until you accept, its code is not loaded at all.
Why we use it
To run the checks you asked for, watch the businesses you added and send you the alerts you set up (performance of a service you requested); to limit free checks and protect the service, and to understand which channels and pages bring visitors and customers with our own first-party counter (our legitimate interest); Google Analytics only on your consent, which you can withdraw at any time; to answer your messages. We email you only sign-in codes, alerts, the first report on a business, the weekly summary if you keep it on, invoices, a note before your trial or paid time ends, and notices about changes to the service.
Who processes it for us
Search results are fetched through XMLRiver, a search data provider; it receives the search queries built from the business name, not your IP or email. AI answers and the scoring of findings go through an AI model API (relaymodels.com, which routes to the model providers); it receives the business name and the public texts found, not your IP or email. If you sign in with Google, Google LLC confirms your account to us under its own privacy policy. If you accept analytics, Google LLC processes your visits as the provider of Google Analytics, under the Google Analytics terms and its privacy policy. Emails are sent through Resend (United States), which receives your email address and the text of the email. Payments go through NOWPayments, a crypto payment gateway: it receives the amount, the coin, our invoice number and the wallet the payment comes from, not your email. Browser notifications go through the push service of your browser maker (for example Google, Mozilla or Apple). Alerts to Slack, Microsoft Teams or Discord go to the webhook address you gave us, under the terms of that service. The site runs on our servers; the front server is in the United States.
How long we keep it
Reports of one-off checks: 90 days, then deleted. Reports of businesses you watch: the latest 40, while you watch the business. Your account and everything in it: until you delete it, which you can do yourself in Account, in one step, at any time. IP addresses of checks: 30 days. Sign-in codes: deleted after a day. The log of emails sent: 90 days. Messages: as long as needed to answer, at most 12 months. Invoices and payment records: kept for the seller’s books; when you delete the account, your email is removed from them. Visits and the first touch of a browser that never signed in: 25 months. Visits of an account’s browsers: until the account is deleted, then deleted with it. Google Analytics keeps event data for at most 14 months, the longest its standard properties allow.
Cookies
Google Analytics cookies (_ga and _ga_TG7XNY724Y, up to 2 years) are set only after you click "Accept analytics". If you click "Reject", Google Analytics is not loaded. To change your choice, use "Cookie settings" at the bottom of any page; after a change from accept to reject we delete the Google Analytics cookies on our domain. To object to our own first-party visit counting, write to us and we will delete the visits of your browser and stop linking it to your account. You can also delete all cookies at any time in your browser.
Your rights
You can ask for a copy of your data, its correction or deletion, object to its use, or withdraw consent, by writing to hello@whatsmyrep.com. Signed-in users can delete their account and all its data themselves. If you are in the UK or the EU, you can also complain to your data protection authority. California residents: we do not sell or share personal information for advertising, and you can ask what we hold and ask us to delete it at the same address.
Checks of other businesses
The service is for businesses. It looks at public search results about a business name. Do not use it to look up or watch private individuals.
Changes
If we change this policy we will update the date at the top. Material changes will be announced on the site and by email to account holders.