Whacka procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ If you use Whacka to publish apps that collect data from end users, Whacka acts as a data processor on your behalf. Our Data Processing Agreement, available at whacka.app/legal/dpa , governs this relationship and applies automatically when you use the Service. A list of our sub-processors is available at whacka.app/legal/subprocessors .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Welcome to Whacka (“we,” “us,” or “our”). By accessing or using Whacka at whacka.app (the “Service”), you agree to be bound by these Terms of Service (“Terms”). If you do not agree, please do not use the Service. By using the Service, you also acknowledge our Privacy Policy at whacka.app/privacy , which describes how we handle your data. If you publish apps that process end-user data, our Data Processing Agreement at whacka.app/legal/dpa applies automatically.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Your data is stored and processed in the United States (AWS us-west-2, Oregon). If you are located outside the United States, your personal data is transferred to the US. For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (Module 2: Controller to Processor) as the legal mechanism for cross-border data transfers. A copy of the applicable SCCs is included as an annex to our Data Processing Agreement. Our sub-processors (listed at whacka.app/legal/subprocessors ) maintain their own cross-border transfer safeguards, including SCCs.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ By publishing an app on Whacka, you acknowledge that you are the data controller for any personal data collected through your published app. Whacka acts as a data processor on your behalf, subject to our Data Processing Agreement at whacka.app/legal/dpa . You are responsible for ensuring your published app complies with applicable data protection laws, including providing appropriate privacy notices to your end users. Our current list of sub-processors is available at whacka.app/legal/subprocessors .” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “Account data is retained for the duration of your active account plus 30 days after deletion. AI generation logs (prompts and outputs) are retained for the duration of the account, supporting debugging and abuse prevention. Payment records are retained for 7 years as required by US tax law. Published apps and their associated App Data may be retained for up to 90 days after account deletion to prevent disruption to end users, then deleted. Push notification tokens are deleted immediately upon opt-out or account deletion.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Google OAuth: if you sign in with Google, we receive your email address and profile information as authorized by you.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell your personal information. We share data only with: Supabase: database hosting and authentication. Stripe: payment processing. AI providers (Anthropic, OpenAI, Google): to process app generation and runtime requests. Cloudflare: edge proxy, static asset delivery, and DDoS protection. Resend: transactional email delivery. Google OAuth: if you choose to sign in with Google. Law enforcement: when required by law or to protect rights and safety.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Your app descriptions and prompts are sent to third-party AI services (Anthropic, OpenAI, Google) to generate application code, images, and audio. We do not train our own AI models on your data. Our AI sub-processors process prompts under their respective API-tier data usage policies, which do not use API inputs for model training. See their DPAs linked at whacka.app/legal/subprocessors . Third-party AI providers may have their own data processing policies.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.