Privacy Policy
Last updated 17 July 2026.
Overview
Whittl (“we”, “us”) is an AI copilot for problem-solving and solution discovery. This page explains what data we collect when you use Whittl, why we collect it, and the choices and rights you have — including under the EU General Data Protection Regulation (GDPR), the Dutch UAVG, and the cookie-consent rules in the Dutch Telecommunications Act (Telecommunicatiewet, art. 11.7a).
Account & project data
To provide the product itself, we process your name, email address, and the content you create in a project workspace (problem statements, criteria, longlist entries, decisions, tags, and chat messages). This is necessary to deliver the service you've signed up for and is processed on the basis of contract necessity — it is not optional and is not affected by the analytics choice below.
Product analytics
With your consent, we use PostHog (EU Cloud region — data is hosted and processed in the EU) as a product-analytics processor. When enabled, this collects:
- Page views and navigation within the app.
- A curated set of feature-usage events (for example: a project is created, a phase is confirmed or edited, a longlist entry is decided, a team member is invited) — tagged with IDs, phase names, and counts only.
We deliberately do not send prompt text, chat messages, document content, or any other free-text research content to PostHog, and we do not use autocapture, session recording, or a browser toolbar — only the specific events described above are ever captured. Your Anthropic/Claude usage (model, token counts, and estimated cost per phase) is tracked separately, in our own database, for cost and quality monitoring — not shared with PostHog.
Analytics is processed on the basis of your consent (GDPR Art. 6(1)(a)). It is off by default. You choose whether to enable it the first time you visit, and you can change your mind at any time — see “Your choices” below.
Cookies & similar technologies
Under Dutch law (Telecommunicatiewet art. 11.7a), we only place non-essential cookies or browser storage after you've given consent. Here's exactly what we use:
| Name | Purpose | Type | Duration |
|---|---|---|---|
| NextAuth.js session cookie | Keeps you signed in | Strictly necessary — no consent required | 30 days |
| whittl:consent-analytics (localStorage) | Remembers your cookie choice, so we don't ask again every visit | Strictly necessary — no consent required | Until you change your choice or clear browser storage |
| PostHog analytics identifier (cookie + localStorage) | Groups your page views and feature events together so we can see usage patterns | Analytics — only set after you accept | Up to 1 year (PostHog's default), or immediately cleared if you reject/withdraw |
Your choices
You can accept, reject, or change your analytics consent at any time from Cookie preferences in the account menu (if logged in) or in the site footer. Rejecting or withdrawing consent stops analytics collection immediately and does not affect your ability to use Whittl — there is no cookie wall and no reduced functionality either way.
Data retention
Account and project data is retained for as long as your account is active. Analytics events are retained in PostHog for no longer than necessary for the purposes described above; the PostHog identifier itself expires after at most 1 year (see the table above). We keep a record of your consent decision (granted or rejected, when, and which policy version) for as long as your account exists, as proof of compliance under GDPR's accountability principle (Art. 5(2)) — this record is kept even if you later withdraw consent, since it evidences the withdrawal itself. If you have further questions about retention, contact us using the details below.
Your rights
Under the GDPR, you have the right to access, correct, or request deletion of your personal data, to object to or restrict certain processing, to withdraw consent at any time (without affecting processing that already happened), and to data portability. To exercise any of these rights, contact us — see below. You also have the right to lodge a complaint with your national data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
Contact
Whittl
privacy@whittl.nl
Changes to this policy
If we make a material change to what we collect or why, we'll update this page and ask for your consent again the next time you visit.