Wholisphere
Privacy

Privacy policy

Last updated: 2026-07-11.

Plain English summary: we collect the minimum data needed to make the agent work, scrub PII before it reaches any LLM, and never sell your data. Customers control retention and can delete everything at any time. This page is the formal version.

1. What we collect

  • Account data — email, organization name, billing details (held by Stripe).
  • Usage data — capability invocations, latency, errors. Used to bill correctly and improve the product.
  • Audit log — for each agent action, an entry of what was done and on what URL. Not the page content itself.
  • Telemetry — opt-in only. PII-scrubbed counts of which features are used.

2. What we don't collect

  • We do not record video or full-session replays.
  • We do not store the literal contents of pages users visit.
  • We do not sell or share data with advertisers.
  • We do not fingerprint visitors.

3. PII handling

Before any text reaches an LLM, our PII scrubber redacts emails, phones, SSNs, credit-card-shaped numbers, and API-key-shaped tokens. Customers on Platform plans can add custom redaction rules.

4. Data residency

All plans are stored on US-region Cloudflare infrastructure (D1, KV) today. EU data residency is planned but not yet available — if your compliance posture requires EU-resident storage, tell us at privacy@wholisphere.ai and we'll notify you when it ships.

5. Sub-processors

  • Cloudflare — hosting, edge compute (Workers), D1, KV, R2, DNS, WAF.
  • Anthropic — LLM inference (Claude vision + reasoning).
  • Google (Gemini API) — LLM inference (Gemini Flash / Pro for routine tasks).
  • Stripe — billing.
  • Resend — transactional email (magic-link sign-in).
  • Sentry — error tracking (no PII).
  • Plausible — cookieless, aggregate analytics on the marketing site (wholisphere.ai) only.

This list matches the sub-processor table in our trust center, which links each provider's DPA.

6. Your rights

Under GDPR / CCPA you have the right to access, correct, port, and delete your data. Export, rectification, and deletion are available via the API, or by emailing privacy@wholisphere.ai:

  • Export all data we hold on you as JSON — GET /v1/users/me/export
  • Correct your account details — PATCH /v1/users/me
  • Delete your account — POST /v1/users/me/delete. Deletion is scheduled with a 30-day grace period during which you can cancel; after that it is irreversible (Stripe records retained for tax purposes).
  • Revoke any API key from your dashboard

7. Retention

Audit-log retention follows your plan: Free and Pro keep 90 days, Platform keeps 365 days, Enterprise is unlimited. Sessions: 30 days from last use. Magic links: 15 minutes. Sub-processor logs follow each provider's policy.

8. The browser extension

The Wholisphere browser extension is designed to run without an account: it is keyed by an anonymous install ID generated on first run — no email, no name. Most capabilities (read aloud, contrast, focus mode, form helper, and more) run entirely in your browser with zero network calls.

  • Most cloud capabilities are on-demand. Page text, image bytes, or audio are sent to our backend only when you invoke that AI capability (describe image, summarize, translate, live captions, voice command), and we do not retain that content beyond the request lifetime. The one exception is the screen reader: once you turn it on, it stays on across page loads and automatically sends each page's structure and up to about a dozen of its images so it can narrate them without a per-image click. It sends nothing until you enable it, and turning it off stops the automatic uploads.
  • PII scrubbing. Text is scrubbed of emails, phone numbers, SSNs, card-shaped numbers, and key-shaped tokens before it reaches any model.
  • Bring-your-own-key. If you configure your own Anthropic or Google API key, it is stored in chrome.storage.local on your device (never synced, never sent to us), and eligible requests go directly from your browser to Anthropic or Google — bypassing our backend entirely.
  • Local storage. Preferences and the activity journal live in chrome.storage.local and clear when you remove extension data from chrome://extensions. Form drafts are stored in the web page's own session storage (with passwords and card numbers stripped out) and clear when you close the tab.
  • Server-side data & deletion. Our backend keeps a small amount of data keyed to your anonymous install ID — usage counters, and capability-event records if you opt into telemetry. You can erase all of it in one click from the extension popup (Delete & reset, which also issues a fresh install ID), or by emailing us your install ID.

Full capability-by-capability detail is in the extension privacy documentation.

9. Contact

Privacy contact for DSARs and GDPR/CCPA questions: privacy@wholisphere.ai.