The short version
Your workspace content stays on your Whombat. We can't read it, and we have no remote access to your Whombat.
Our cloud keeps only what it needs to run your account: your email address, your organization and its members, your Whombats and their health, and your subscription.
We don't store IP addresses. Where we need to recognize a network (for example to stop abuse), we keep a keyed hash of it instead.
No analytics, no advertising, no tracking cookies, no session recordings. We never sell your data and we never use it to train AI models.
You can delete your account yourself, and you can ask us about everything we hold on you.
Who we are
Whombat is a product of Cybex B.V., a company in the Netherlands (“we”, “us”). We are the controller for the personal data our cloud services process, as described in this policy.
For the data on a Whombat, your organization is the controller: it decides what goes on it and who can see it. We can't access that data, so we don't process it. If you have questions about data on your organization's Whombat, ask its owners.
What stays on your Whombat
Your Whombat is your organization's own server. It holds your workspace: messages, channels, files and repositories, agent runs and their output, memory, the vault, the accounts of the people in your workspace, and the sign-ins for the services you connect (such as Claude, Codex, GitHub or Google).
- Your devices reach your Whombat through our relay over an end-to-end encrypted connection. Each browser and phone has its own key, which never leaves it. The relay forwards encrypted bytes and never sees what's in them.
- The Whombat has no vendor login and no remote access for us. We only see diagnostics if an owner creates a diagnostics bundle, checks its contents and sends it to us.
- Backups go to a backup server your organization runs, encrypted with a password only your organization holds.
- When your agents use an AI provider or a connected service, your Whombat talks to that provider directly. What the provider does with the data it receives is covered by your agreement with that provider, not by this policy.
We build and sign the software updates your Whombat installs. You rely on us to ship honest software, the same way you rely on the maker of any operating system you run.
What our cloud collects, and why
Your account. Your email address, your sign-in sessions (when they were created and last used; no IP address or browser details) and, if you use them, your passkeys. We use them to sign you in and to send you sign-in links.
Your organization. Its name, its members and their roles, the invitations you send (the email address, the role and who invited), your plan and the state of your subscription, and which version of our terms was accepted, by whom and when. We use this to run your organization's account and to know what your plan allows.
Your Whombats. For each Whombat: its serial number and model, its public keys, the name you gave it, when it was claimed, and when it was last online. Every few minutes a Whombat reports its health: software version, uptime, update state, disk use, the number of open sessions and when it last made a backup. It also renews its licence about once a day. We use this to deliver updates safely, to see when something goes wrong, and to check the subscription. None of it contains your content.
Connecting to your Whombat. When one of your devices connects, our cloud issues a short-lived ticket, and the relay sees both ends' IP addresses and the size and timing of the encrypted messages while the connection is open. We don't store tickets or these addresses.
Billing. Payments go through Stripe. Stripe collects your company name, billing address, VAT ID and card details; we never see your full card number. We keep the Stripe customer and subscription references, your plan, the number of Whombats you pay for and the state of your subscription. To keep the free trial to one per customer, we remember which accounts, Whombats and cards (as Stripe's card fingerprint, not the number) have already had a trial, and a keyed hash of the network an organization was created from.
Waitlist. If you join the waitlist: your email address, company name and the note you leave, so we can invite you.
Notifications. If you turn on notifications: the push address your browser or phone gives us, and for each notification when it was sent, what kind it was (such as a message or an approval) and whether it arrived. What we send through push services never contains your content: only “Whombat”, the kind of notification and a random reference.
Emails. We send sign-in links, invitations, waitlist and billing emails. An invitation shows the organization's name and the email address of the person who invited you.
Keeping Whombat secure. A log of important actions in your organization (such as a member added or a Whombat claimed), recorded under a pseudonymous account number, without email addresses. Request logs with the kind of request, its result and its duration, without IP addresses, browser details or request contents. Counters that limit how often something can be tried, keyed by a hash, never by an IP address. When you claim a new Whombat, we compare keyed hashes of your network and the Whombat's network to find it; those hashes are erased once it's claimed.
The Feedback widget. If your organization puts Whombat's Feedback widget on its website, the reports visitors send are encrypted in their browser for your Whombat. We hold them, unreadable, until your Whombat collects them, together with the website they came from, their size and when they arrived. Your organization is responsible for those reports; we only carry them.
Support. If you email us, we use what you send to help you.
Our legal grounds
- To provide the service you signed up for (performance of a contract): your account, organization, Whombats, connections, notifications, emails and billing.
- Our legitimate interest in keeping Whombat secure and fair: the audit log, request logs, rate limits, network hashes and the one-trial-per-customer checks. We've kept each of these to the minimum that does the job.
- Legal obligations: keeping invoices and payment records as tax law requires.
- Your consent: notifications, which you can turn off at any time.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The only automatic check is whether a new organization can have a free trial; if you think we got that wrong, tell us and a person will look at it.
What we don't do
- No analytics, crash reporting, session recordings or advertising in our websites or apps.
- No tracking cookies and no third-party scripts. The web app and phone app bring their own fonts, so loading them doesn't tell anyone else you visited.
- We don't sell or rent personal data, and we don't use it, or anything on your Whombat, to train AI models.
Cookies and storage on your device
The web app doesn't use cookies to track you. It keeps what it needs to work in your browser's own storage: your sign-in, the list of your Whombats and their identities, drafts you haven't sent, and your device's key (stored so that even the page itself can't read it out). This is strictly necessary for the app, so we don't ask for consent. “Forget this browser” removes the key, and clearing your browser's site data removes the rest.
The payment pages are Stripe's own. Stripe sets its own cookies there, mainly to prevent fraud.
Who helps us
We use a small number of service providers, under agreements that only let them process data for us:
- Hetzner Online GmbH (Germany) hosts our servers, in Germany.
- Cloudflare, Inc. sits in front of our services and protects them. It handles the encrypted web traffic to our servers, including IP addresses, but not the content between your devices and your Whombat, which stays end-to-end encrypted.
- Mailgun (Sinch) sends our emails.
- Stripe handles payments. For fraud prevention and its own legal obligations, Stripe is also a controller in its own right; see Stripe's privacy policy.
- Push services deliver notifications: Google Firebase Cloud Messaging for the Android app, and the push service your browser uses (from Google, Mozilla or Apple, for example) on the web.
We may disclose data if the law requires it, and only as much as it requires. We'd tell you unless we're legally not allowed to.
Transfers outside Europe
Our servers are in the European Union. Some of the providers above are based in the United States or use affiliates there. When personal data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
How long we keep it
Your account: until you delete it (section 11).
Sign-in links: one day after they expire. Invitations: 30 days after they expire.
Your organization, its members, Whombats and terms acceptances: as long as the organization exists. It is deleted when its last member deletes their account, or when you ask us to delete it. A Whombat that is retired keeps its hardware entry, without your organization.
Health reports: 30 days. Notification deliveries: 14 days. Request logs: 14 days. Rate-limit counters: 2 days. Payment events from Stripe: 90 days. Audit log: 400 days.
Feedback reports: until your Whombat collects them, and never longer than 7 days.
Trial records (which accounts, Whombats, cards and networks had a trial): as long as we offer free trials, so a trial can't be taken twice.
Waitlist entries: until you're invited or ask us to remove yours.
Invoices and payment records: 7 years, as Dutch tax law requires.
Backups of our database are kept for up to 35 days, so deleted data disappears from them within that time.
Deleting your account
You can delete your Whombat account yourself: choose Delete account on the Your Whombats screen of the web app or the Android app, and type your email address to confirm. Your account, sign-in sessions, passkeys, memberships, notification addresses and pending invitations to your email are deleted at once, and so is any organization you were the only member of.
Two things to know:
- If you're the only owner of an organization with other members, make someone else an owner first. If you're the only person in an organization that still has a Whombat, invite someone to take it over first, or contact us.
- Deleting your Whombat account doesn't delete your account on your Whombat or anything you created there. That belongs to your organization, and an owner removes it on the Whombat. Export anything you want to keep first.
After deletion, the audit log keeps its pseudonymous entries (without your email address) until they expire, as listed in section 10.
Your rights
Under the General Data Protection Regulation you have the right to access the personal data we hold on you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Email us at [email protected] to use any of these rights. We answer within one month. We may ask you to confirm that the request comes from you, usually by replying from the email address of your account.
If you're not happy with how we handle your data, please tell us first. You also have the right to complain to a data protection authority: in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority where you live or work.
Security
End-to-end encryption between your devices and your Whombat, keys that stay on each device, encrypted connections to our servers, and keeping as little as possible are how we protect your data. If you find a security problem, please report it to [email protected].
Children
Whombat is a service for businesses. It isn't meant for children, and we don't knowingly collect data from anyone under 16.
Changes to this policy
When we change this policy, we update the version at the top. If a change affects how we use your data in a way that matters, we'll email the owners of your organization before it takes effect.