Whisperstream Website Privacy Policy

Version 2.3

Effective 2026-08-08

This Website Privacy Policy explains how Lanreal Technologies Inc. ("Lanreal," "we," "us," or "our") collects, uses, shares, and retains personal information when you visit the Whisperstream marketing website at whisperstream.io (the "Website"). It also describes the rights you have with respect to that personal information and how to exercise them.

This Website Privacy Policy covers only the Whisperstream marketing website at whisperstream.io. It does not cover the Whisperstream desktop application for Microsoft Windows, which is governed by a separate Privacy Policy bundled with the application installer and published at https://whisperstream.io/privacy. If you are looking for information about how the desktop application handles your data, please refer to that document instead.

This Website Privacy Policy also does not cover your relationship with Polar Software Inc. ("Polar"), the Merchant of Record that processes your purchase when you buy a Whisperstream license. When you complete a purchase through the embedded checkout on the Website, Polar separately collects your name, email address, payment information, and billing address through its own checkout flow. That information is governed by your relationship with Polar and by Polar's privacy policy at https://polar.sh/legal/privacy. Lanreal does not directly collect your payment information.

The data controller responsible for the personal information described in this Website Privacy Policy is:

Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Lanreal is a corporation incorporated under the Business Corporations Act (Ontario). Our registered office is in the Province of Ontario, and our operations are governed by Canadian federal and provincial law applicable therein.

Privacy Officer designation. In accordance with Canadian federal privacy law (the Personal Information Protection and Electronic Documents Act), Lanreal Technologies Inc. has designated a Privacy Officer responsible for compliance with this Website Privacy Policy. The Privacy Officer can be contacted at support@whisperstream.io. Throughout the remainder of this document, "Canadian federal privacy law" refers to the statute named above.

Under the European Union General Data Protection Regulation (GDPR), Lanreal is the "controller" of the personal information described in this Website Privacy Policy. Under the California Consumer Privacy Act (CCPA), Lanreal is a "business" that collects personal information about California residents through the Website.

All privacy-related communication, including data subject rights requests, complaints, and general questions about this Website Privacy Policy, should be directed to support@whisperstream.io. This is Lanreal's single privacy contact channel for the Website.

The Website is a static marketing site that promotes the Whisperstream desktop application and facilitates checkout. This section describes every category of information associated with your visit to the Website.

3.1 PostHog Cloud analytics data

The Website uses PostHog Cloud (the posthog-js SDK, EU instance at eu.i.posthog.com) to understand how visitors use the site. The SDK is configured in cookieless mode (cookieless_mode: 'always') with memory-only persistence (persistence: 'memory') and operates as follows:

• The SDK does not set any cookies, and does not use localStorage, sessionStorage, or any other persistent browser storage. It reads the limited browser, page, and referrer information enumerated below while its JavaScript runs in memory.
• Each event you generate is associated with a server-side identifier derived by PostHog from a one-way hash of the project identifier, a daily-rotated random salt, your IP address, your user-agent string, and the website hostname. PostHog deletes the daily salt at the end of each calendar day, which makes the identifier non-reversible and rotates your effective identity every 24 hours.
• PostHog does not retain raw IP addresses against events captured in cookieless mode; the IP address is used only as input to the hash described above and to derive approximate geolocation (country, region, city) for aggregated analytics.
• The Website suppresses PostHog initialization and event capture when your browser sends a Do Not Track or Global Privacy Control signal.
• The Website disables autocapture, session replay, surveys, heatmaps, exception capture, console-log capture, Web Vitals reporting, and persistent person profiles.
• The Website sends the full current and initial page URLs and referrer URLs that the browser makes available, including paths, query strings, fragments, and arbitrary custom tracking parameters. It also sends referring-domain values and standard UTM campaign-attribution properties. This detail is used to distinguish inbound links and campaigns.

PostHog Cloud collects the following data points with each page view or custom event:

• event timestamp,
• current and initial page URL, including hostname, path, query string, fragment, and dynamic route pattern,
• current and initial referrer URL, including any path, query string, or fragment supplied by the browser, plus the referring domain,
• standard UTM campaign-attribution properties (utm_source, utm_medium, utm_campaign, utm_term, utm_content) when present in the page URL,
• geolocation (country, region, city, derived from your IP address),
• device operating system and version,
• browser name, browser version, and browser language preference,
• device type (desktop, mobile, or tablet),
• viewport dimensions and screen dimensions,
• timezone, and
• the version of the PostHog client library.

Before 2026-08-03, Polar redirected a completed purchase to /success?checkout_id=<uuid>. PostHog's page-view event could therefore include that full success-page URL and its Polar-generated checkout identifier in the $current_url event property. The checkout identifier was not a license key or payment-card number, but Lanreal could use it with Polar's server API to retrieve the associated purchase confirmation. The current success route uses a short-lived encrypted, HttpOnly cookie and a clean /success URL. The current analytics filter does not remove query strings, fragments, or referrer detail. The Website's checkout flow does not place checkout identifiers, customer email addresses, product or payment details, or license keys in the success URL or its event-specific analytics properties. Because inbound page URLs and referrers are transmitted in full, a value that a visitor or third party places in a tracking link can be sent to PostHog. Do not put personal or sensitive information in links to the Website.

This data is used by Lanreal in aggregated form to understand website traffic patterns. The cookieless server-side identifier described above does not track visitors across different applications or websites and rotates each day, so it cannot be used by Lanreal to build a long-term profile of an individual visitor.

In addition to automatic page view tracking, the Website sends the following custom events through the PostHog SDK to measure user engagement:

• download_clicked (with CTA label, page location, and an optional explicit attribution source),
• pdf_download_clicked (with page location),
• watch_demo_clicked,
• buy_clicked (with page location),
• price_badge_clicked (with page location),
• checkout_session_created (with page location),
• purchase_completed (with no event-specific properties),
• license_key_ready (with the number of polling attempts),
• license_key_copied, and
• acquisition_source_reported (with only the enumerated source selected in the optional survey described in Section 3.5).

The event-specific properties contain no freeform acquisition response or direct identifier. PostHog also attaches the full page and referrer context described above. The Website's outbound filter rejects unapproved event types and removes standalone checkout, license, email, payment, customer, order, and transcript property names. That property-name filter does not remove text embedded in a page URL, referrer URL, query string, or fragment.

3.2 Cloudflare DNS and CDN data

The Website uses Cloudflare for DNS resolution and is hosted on Cloudflare Pages. When you visit the Website, your request is resolved and served by Cloudflare's network. As part of standard CDN, DNS, and hosting operation, Cloudflare may:

• process your IP address to route your request,
• set a security cookie (__cf_bm or similar) to distinguish legitimate visitors from automated traffic and to mitigate abuse, and
• collect standard access logs for security and performance monitoring.

Cloudflare's processing of this data is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Lanreal does not have access to Cloudflare's raw CDN or DNS access logs (a separate Cloudflare Logpush product that Lanreal does not enable). The content-free application logs stored through Cloudflare Workers Observability are described separately in Section 3.4 below.

3.3 Polar embedded checkout data

When you click a purchase button on the Website, the Website creates a checkout session through Polar's API and opens an embedded Polar checkout modal (an iframe served by Polar). Inside that checkout modal, Polar collects:

• your name,
• your email address,
• your payment card information (processed by Stripe, Inc., Polar's payment processor), and
• your billing address, phone number, business name, and tax number (if you provide them).

This information is collected directly by Polar inside its own iframe. Lanreal does not see, handle, or store your payment card details. When the Website creates the checkout session, Polar immediately returns the checkout identifier (a Polar-generated UUID) to Lanreal's server. This occurs before you complete or abandon the checkout. If you complete the purchase and return to the confirmation page, Lanreal then retrieves the following data from Polar through its server-side API:

• the customer email address associated with the purchase,
• the product name and purchase total, and
• the license key generated for your purchase.

This data is used to render the post-purchase confirmation page on the Website (showing your email, product name, total, and license key). The checkout identifier is held in an encrypted, authenticated, HttpOnly, SameSite=Lax cookie for no longer than thirty minutes. It is not placed in the confirmation-page URL, browser-visible JavaScript, analytics, or Lanreal application logs. The Website uses the cookie to retrieve the confirmation data from Polar's API. Client polling deletes the cookie when the license endpoint returns the key; otherwise it expires within thirty minutes. If the checkout is abandoned, the cookie expires without being used for purchase confirmation. Neither the checkout data nor the license key is stored in a Lanreal-operated database. After the cookie expires or is deleted, the purchase data remains only in Polar's systems.

3.4 Server-side request logs and Cloudflare Workers Observability

The Website is served by Cloudflare's Workers platform (via Cloudflare Pages and the @opennextjs/cloudflare adapter). Two distinct categories of server-side log data exist for the Website:

• Cloudflare's own platform-level logs. Cloudflare's hosting infrastructure logs standard HTTP request metadata (including your IP address, request path, user agent, and timestamp) as part of its normal platform operation. These logs are controlled by Cloudflare and are governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Lanreal does not have access to or control over these platform-level logs.

• Content-free application logs. Lanreal's server-side routes emit allowlisted operational events such as a route name, status code, latency, outcome, and error class. They do not log request URLs, request bodies, checkout identifiers, license keys, email addresses, acquisition-survey text, or payment data. Cloudflare's automatic per-request invocation logging is explicitly disabled. Cloudflare retains the content-free application log events according to the Workers Logs setting on Lanreal's account. Lanreal uses them only for reliability, debugging, and security, not marketing or profiling.

Server-side request logs and the Cloudflare DNS and CDN data described in Section 3.2 are processed by the same provider under the same Cloudflare Customer Data Processing Addendum and the same privacy policy.

3.5 Optional acquisition survey responses

After a completed purchase, the Website may ask how you found Whisperstream. The survey is optional. If you choose to submit it, the Website collects:

• one source selected from a fixed list, and
• if you select "Somewhere else," a freeform description of up to 200 characters.

The freeform field asks you not to include names or other personal information. If you nevertheless include personal information, Lanreal will receive and store it as part of your response. Please do not include sensitive personal information.

The Website stores the selected source and, when applicable, the freeform description in Lanreal's acquisition_sources database hosted by Supabase, Inc. The database record does not include your name, email address, checkout identifier, license key, IP address, user agent, or PostHog identifier and is not linked to your purchase record.

Cloudflare Workers processes the survey request so that the Website's API route can validate and forward it to Supabase. Lanreal's code does not write the selected source or freeform description to application logs, and the content-free application events described in Section 3.4 do not include the request body.

3.6 Information the Website does not collect

The Website does not collect the following:

• No user accounts. The Website does not have a registration or login system or a user-account database. The only Lanreal-controlled Website database is the limited acquisition survey database described in Section 3.5.
• No tracking cookies. The Website does not set analytics or advertising cookies. During checkout confirmation, it sets the short-lived, strictly necessary state cookie described in Section 3.3. The PostHog Cloud analytics SDK does not set cookies.
• No contact form submissions. The Website does not have a contact form. Support requests are handled via email at support@whisperstream.io, and any personal information in those emails is governed by the email interaction itself, not by this Website Privacy Policy.
• No localStorage or sessionStorage. The Website does not use browser storage mechanisms to store personal information.
• No advertising identifiers or tracking pixels. The Website does not integrate Google Analytics, Meta Pixel, Google Tag Manager, or any comparable advertising or tracking service.

This section explains, for each category of information described in Section 3, the purpose for which Lanreal processes that information and the corresponding lawful basis under GDPR Article 6.

• PostHog Cloud analytics data (Section 3.1). The purpose is to understand how visitors use the Website so that Lanreal can improve its content, layout, and user experience. The lawful basis under GDPR Article 6 is Article 6(1)(f), Lanreal's legitimate interest in understanding aggregate website usage patterns, balanced against your interests and fundamental rights. The PostHog SDK is configured in cookieless mode (no cookies, no localStorage, no sessionStorage), does not track visitors across sites, derives a daily-rotating server-side identifier from a one-way hash with a daily-deleted salt, stores data on PostHog's EU instance in Frankfurt, Germany, and produces aggregated statistics. The Website suppresses this processing for Do Not Track and Global Privacy Control signals. Full URL and referrer collection increases the possibility that a tracking link contains information unrelated to audience measurement. Lanreal relies on Article 6(1)(f) for GDPR purposes while its data- minimization assessment, first-party privacy-choice control, and jurisdiction-specific review remain open. This does not establish a jurisdiction-wide exemption from consent requirements under national laws implementing the ePrivacy Directive.

• Cloudflare DNS and CDN data (Section 3.2). The purpose is to deliver the Website to your browser reliably and to protect the Website against malicious traffic. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating and securing the Website. Cloudflare's security cookies, if set, serve the strictly necessary function of distinguishing legitimate visitors from bots and are not used for advertising or analytics.

• Polar embedded checkout data (Section 3.3). The purpose of creating the checkout session and displaying order confirmation details is to complete the purchase you initiated. The lawful basis is Article 6(1)(b), performance of a contract, because the checkout flow is how you enter into the Whisperstream license agreement. Polar's own collection of your payment information inside its checkout iframe is governed by Polar's privacy policy, and Polar acts as Merchant of Record for the transaction.

• Cloudflare's own platform-level logs (Section 3.4). Standard HTTP request logs generated by Cloudflare's hosting platform serve Cloudflare's purpose of platform operation, security monitoring, and abuse prevention. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in maintaining the availability and security of the Website. These logs are controlled by Cloudflare; Lanreal does not access them.

• Content-free application logs (Section 3.4). The allowlisted operational events serve Lanreal's purposes of reliability, debugging, and security of Lanreal's server-side route handlers. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating a reliable and secure marketing website. This processing is distinct from the Cloudflare-controlled platform-level logs described in the preceding bullet because Lanreal is the controller for these events and uses the data for Lanreal's own purposes. Lanreal does not use application log data for marketing analytics, visitor profiling, retargeting, or any purpose beyond the three named here. Lanreal maintains a documented legitimate-interests assessment for this processing under Article 6(1)(f).

• Optional acquisition survey responses (Section 3.5). The purpose is to understand which sources introduce customers to Whisperstream so Lanreal can evaluate and improve its marketing. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in measuring customer acquisition. The survey is optional, limited to one source and at most 200 freeform characters, and the Supabase record is not linked to your purchase or a visitor identifier. These limits reduce the effect on your privacy. You are asked not to include names or other personal information and must not include sensitive personal information. You may use the Website and complete your purchase without submitting the survey.

Lanreal does not rely on your consent (GDPR Article 6(1)(a)) as the lawful basis for any of the processing described in this Website Privacy Policy. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22.

The Website does not set analytics or advertising cookies or use localStorage or sessionStorage for tracking purposes. It sets one strictly necessary first-party cookie after checkout: the encrypted, authenticated whisperstream_checkout_state cookie described in Section 3.3. The cookie expires after no more than thirty minutes and is deleted when client polling obtains the license key.

The PostHog Cloud analytics SDK described in Section 3.1 is active but does not use cookies, localStorage, sessionStorage, IndexedDB, or other persistent browser storage. Do Not Track and Global Privacy Control signals suppress it.

The following third parties may set cookies or use similar technologies when you visit the Website:

• Cloudflare may set a security cookie (such as __cf_bm) to identify and mitigate malicious bot traffic. This is a strictly necessary cookie that serves a security function. It is not used for advertising, analytics, or cross-site tracking.

• Polar may set cookies inside its embedded checkout iframe when you initiate a purchase. These cookies operate within Polar's own domain and are governed by Polar's privacy policy.

The Website does not display a cookie consent banner. The Cloudflare security cookie, if present, falls under the "strictly necessary" exemption recognized by the ePrivacy Directive (Directive 2002/58/EC, Article 5(3)) and by most national implementations of that directive, and does not require prior consent. Lanreal has directed that the cookieless PostHog configuration operate while the jurisdiction-specific treatment of cookieless analytics and the durable minimization of URL and referrer data remain under review. This policy does not claim a conclusively established consent exemption in every jurisdiction. A first-party privacy-choice control remains planned.

The Website relies on the current third-party services below. This list is exhaustive for the Website as it exists at the time of this policy's effective date.

1. PostHog Inc. (San Francisco, California, USA), website analytics provider. PostHog provides the PostHog Cloud analytics service described in Section 3.1. Analytics data remains in Lanreal's PostHog account under the retention terms described in Section 8. PostHog's processing is governed by PostHog's privacy policy at https://posthog.com/privacy and PostHog's Data Processing Addendum at https://posthog.com/dpa. PostHog's GDPR transfer mechanism includes both the European Commission's Standard Contractual Clauses and PostHog's certification under the EU-U.S. Data Privacy Framework.

2. Polar Software Inc. (Dover, Delaware, USA), Merchant of Record and checkout provider. Polar provides the embedded checkout modal described in Section 3.3 and processes your purchase. Polar receives the data enumerated in Section 3.3 directly from you within its checkout iframe. Polar's processing is governed by Polar's privacy policy at https://polar.sh/legal/privacy. Polar's GDPR transfer mechanism is the European Commission's Standard Contractual Clauses, as stated in Polar's privacy policy.

3. Stripe, Inc. (South San Francisco, California, USA), payment processor for Polar. Stripe processes your payment card information on behalf of Polar. Lanreal does not have a direct contractual relationship with Stripe for the Website's checkout flow. Stripe's involvement is governed by Polar's relationship with Stripe and by Stripe's privacy policy at https://stripe.com/privacy.

4. Cloudflare, Inc. (San Francisco, California, USA), DNS, CDN, website hosting (via Cloudflare Pages and Cloudflare Workers), and Workers Observability. Cloudflare provides DNS resolution, content delivery, the hosting platform that serves the Website, and the Workers Observability product that stores Lanreal's content-free application log events (Section 3.4). Cloudflare receives the data described in Section 3.2, the platform-level hosting logs described in Section 3.4, and the content-free application events stored through Workers Observability. Automatic per-request invocation logging is disabled. Cloudflare publishes a Customer Data Processing Addendum (version 6.4, effective 2026-04-03), whose Annex I.B expressly contemplates "Personal Data processed in Customer Logs, such as IP addresses." Lanreal is correcting the Cloudflare account's customer-of-record details so that the account-level contract names Lanreal; that operational item is not represented here as already complete. No additional sub-processor is engaged for the storage of Workers Observability data; it is stored on Cloudflare's own infrastructure. Cloudflare's processing is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Cloudflare's GDPR transfer mechanism includes both the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

5. Supabase, Inc. (Delaware, USA), acquisition survey database. If you choose to submit the optional survey described in Section 3.5, Supabase hosts the acquisition_sources table that stores the selected source and, when applicable, your freeform description. Supabase does not receive a purchase identifier, email address, license key, or PostHog identifier with the database record. Supabase's processing is governed by its privacy policy at https://supabase.com/privacy. Lanreal has executed Supabase's Data Processing Addendum at https://supabase.com/legal/dpa, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum.

Lanreal does not share personal information with any other recipients. Lanreal does not disclose personal information to advertisers, data brokers, or social media platforms.

Lanreal is incorporated in Ontario, Canada. All five third-party services listed in Section 6 are incorporated in the United States. Personal information collected through the Website may therefore be transferred from your location to the United States and Canada.

This section summarizes the transfer mechanism for each service under Chapter V of the GDPR:

• PostHog Inc. (United States; EU data instance in Frankfurt, Germany). PostHog retains Lanreal's analytics events on its EU instance, which is physically located in Frankfurt, Germany. The Frankfurt storage location reduces transfer risk for data at rest but does not eliminate the Chapter V transfer, because PostHog Inc. (United States) remains the contracting processor with potential support and operational access rights under United States law. PostHog's GDPR transfer mechanisms include both the European Commission's Standard Contractual Clauses and PostHog's certification under the EU-U.S. Data Privacy Framework, which are intended to address that residual access risk, as described in PostHog's privacy policy and Data Processing Addendum.

• Polar Software Inc. (United States). Polar cites the European Commission's Standard Contractual Clauses as the transfer mechanism for personal information from the European Economic Area, as stated in Polar's privacy policy.

• Stripe, Inc. (United States). Stripe is Polar's payment processor. Stripe's transfers are governed by Stripe's privacy policy and by Polar's contractual relationship with Stripe. Lanreal does not implement a separate transfer mechanism for Stripe because Lanreal's relationship with Stripe is indirect (through Polar as Merchant of Record).

• Cloudflare, Inc. (United States). Cloudflare's GDPR transfer mechanisms include both the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework, as described in Cloudflare's privacy policy and Trust Hub.

• Supabase, Inc. (United States). Supabase is incorporated in Delaware, USA, and stores the optional acquisition survey responses described in Section 3.5 in the United States. Lanreal has executed Supabase's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and wish to receive further information about these transfer mechanisms, please contact Lanreal at support@whisperstream.io.

Lanreal's retention posture for Website data is limited. The Website does not operate a user account system and stores only the optional survey response described in Section 3.5 in its own database.

• PostHog Cloud analytics data. Data sent by the Website remains on PostHog's EU instance for the configured retention period or until Lanreal deletes it, subject to PostHog's retention schedule. The daily-rotated server-side identifier described in Section 3.1 cannot be tied to a returning visitor because the salt used to derive it is deleted at the end of each calendar day. Aggregated analytics data (page view counts, referrer distributions, device breakdowns) is retained by PostHog for as long as Lanreal's PostHog account remains active. PostHog does not retain raw IP addresses against events captured in cookieless mode.

• Cloudflare DNS and CDN logs. Cloudflare retains access logs in accordance with its own retention schedule, as described in Cloudflare's privacy policy. Lanreal does not have access to these logs.

• Polar checkout data. Polar retains your purchase information (name, email, billing address, payment card details via Stripe) for the duration of your customer relationship with Polar and in accordance with Polar's own retention schedule and applicable financial record-keeping obligations. Lanreal does not store checkout data in any Lanreal-operated database. The checkout identifier is retained in the encrypted, authenticated, HttpOnly cookie described in Section 3.3 for no longer than thirty minutes, including when a checkout is abandoned. The displayed email, product, total, and license key are retrieved from Polar's API and exist only in transient server and browser memory for the confirmation session.

• Cloudflare's own platform-level logs. Cloudflare retains platform-level request logs in accordance with its own retention schedule, as described in Cloudflare's privacy policy. Lanreal does not control or have access to these platform-level logs.

• Content-free application logs. Cloudflare Workers Observability stores the allowlisted application events described in Section 3.4. Automatic invocation logging is disabled. The application events remain on Cloudflare's platform for the configured Workers Logs retention period and are not exported off that platform.

• Optional acquisition survey responses. Lanreal retains the source and any freeform description you voluntarily submit in Supabase for customer-acquisition analysis until Lanreal deletes the response or you request deletion under Section 9. Because the response is not linked to your account or purchase, you may need to provide the selected source, the exact freeform description, and an approximate submission date so Lanreal can locate it.

• Support emails. If you contact Lanreal at support@whisperstream.io, Lanreal retains the content of your email for the duration of the support interaction and deletes or anonymizes it once the matter is resolved.

Depending on where you live, you may have one or more of the rights listed in this section. Lanreal extends all of these rights to every Website visitor, regardless of jurisdiction, so that you do not have to prove residency to exercise a right.

Rights under the European Union General Data Protection Regulation (GDPR Articles 15 to 22):

• Right of access (Article 15): you may ask Lanreal to confirm whether we process personal information about you and, if so, to provide a copy of that information.
• Right to rectification (Article 16): you may ask Lanreal to correct any inaccurate personal information we hold about you.
• Right to erasure (Article 17): you may ask Lanreal to delete personal information we hold about you, subject to the statutory exceptions in Article 17(3).
• Right to restriction of processing (Article 18): you may ask Lanreal to restrict the processing of your personal information in the circumstances set out in Article 18(1).
• Right to data portability (Article 20): you may ask Lanreal to provide your personal information in a structured, commonly used, machine-readable format where the processing is based on consent or contract and is carried out by automated means.
• Right to object (Article 21): you may object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on Article 6(1)(f) (our legitimate interests). This right applies to PostHog Cloud analytics data retained under Section 8, the Cloudflare processing described in Section 3.2, the Cloudflare-controlled platform-level logs described in Section 3.4, and the content-free application logs described in Section 3.4, and the optional acquisition survey processing described in Section 3.5. If you exercise this right, Lanreal will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights in relation to automated decision-making (Article 22): not applicable. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of Article 22.

Rights under the California Consumer Privacy Act (CCPA):

• Right to know what categories of personal information we have collected about you, the sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties with whom we shared it.
• Right to delete personal information we collected from you, subject to the statutory exceptions in Cal. Civ. Code Section 1798.105(d).
• Right to correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information: Lanreal does not request sensitive personal information in the acquisition survey and does not use or disclose any sensitive personal information inadvertently entered there for a purpose that triggers the CCPA right to limit.
• Right to opt out of the sale or sharing of personal information: not applicable. Lanreal does not sell or share personal information for cross-context behavioural advertising, as described in Section 11 below.
• Right to non-discrimination for exercising any CCPA right. Lanreal will not deny you access to the Website, charge you a different price, or provide a different level of service because you exercised a right under the CCPA.

Rights under Canadian federal privacy law:

• Right of access to personal information Lanreal holds about you.
• Right to correction of inaccurate personal information.
• Right to challenge compliance with this Website Privacy Policy and with Canadian federal privacy law generally. Challenges are directed to the Privacy Officer in the first instance (see Section 14).

How to exercise your rights. To exercise any of the rights above, email Lanreal's Privacy Officer at support@whisperstream.io with a description of your request and enough information for us to locate your personal information. For an acquisition survey response, this may include the selected source, the exact freeform description, and an approximate submission date. Because the Website does not have user accounts, the survey is not linked to your purchase, and PostHog Cloud analytics data is aggregated under a daily-rotating, irreversible server-side identifier, Lanreal may not be able to link Website data to you. In that case, Lanreal will explain that it cannot identify the relevant record.

Verification. Because the Website does not maintain user accounts, identity verification for rights requests related to the Website will depend on the nature of the request. For purchase-related requests, Lanreal may verify your identity by confirming the email address associated with your Polar checkout.

Response timeline. Lanreal will acknowledge your request within a reasonable period and will respond substantively within 30 days of receipt. Under GDPR Article 12(3), Lanreal may extend this period by up to an additional 60 days where necessary, taking into account the complexity and the number of requests; if we need to do so, we will inform you of the extension and the reasons for it within the original 30-day window.

Authorized agents. California residents may use an authorized agent to submit a rights request on their behalf. If you do so, we may require the agent to provide written authorization from you and to verify their own identity.

The Website is not directed to children. Lanreal does not knowingly collect personal information from children under the age of 13 in the United States (consistent with the Children's Online Privacy Protection Act, or COPPA), or from children under the age of 16 in the European Economic Area (consistent with GDPR Article 8). If you are a parent or guardian and you believe your child has provided personal information to Lanreal through the Website, please contact us at support@whisperstream.io and we will take reasonable steps to delete that information.

This section supplements the rest of this Website Privacy Policy for California residents whose personal information is collected by Lanreal through the Website, and is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA").

Categories of personal information collected. In the preceding twelve months, Lanreal has collected the following categories of personal information from or about California residents through the Website, as those categories are defined by Cal. Civ. Code Section 1798.140(v):

• A. Identifiers (such as real name, unique personal identifier, online identifier, IP address, email address, or similar identifiers): IP address is processed transiently by Cloudflare for DNS, CDN, and hosting routing and by PostHog as a hash input from which the daily-rotating server-side identifier and approximate geolocation shown in analytics are derived. PostHog does not retain raw IP addresses against events captured in cookieless mode and does not make them accessible to Lanreal. Cloudflare's CDN and DNS access logs are not accessible to Lanreal either. Cloudflare Workers Observability stores only the content-free application events described in Section 3.4; those events exclude IP addresses, request URLs, user agents, and request bodies. The optional acquisition survey does not request identifiers, but its freeform field could contain an identifier if you enter one despite the instruction not to include names or other personal information. Purchase-related identifiers (name and email) are collected by Polar and governed by Polar's privacy policy. During confirmation, the Website temporarily receives the customer email and license key. It receives a Polar checkout identifier when it creates the checkout, before completion, as described in Section 3.3. The checkout identifier is confined to the short-lived encrypted cookie and server-side request; the license key is confined to the confirmation response and browser memory.
• B. Personal information categories listed in Cal. Civ. Code Section 1798.80(e): The acquisition survey does not request this information, but the freeform field could contain a name or another category you choose to enter. Name, address, and payment information required for purchase are collected by Polar as Merchant of Record.
• C. Characteristics of protected classifications: Not requested. The acquisition survey freeform field could contain this information if you choose to enter it despite the instruction not to include personal information.
• D. Commercial information: During confirmation, the Website temporarily retrieves the purchased product and total from Polar to display them to you. Lanreal does not store a purchase record in a Website database; Polar maintains the transaction record.
• E. Biometric information: None.
• F. Internet or other electronic network activity information: aggregated page view data, full current and initial page and referrer URLs (including paths, query strings, fragments, and arbitrary tracking parameters), referring domain, UTM campaign-attribution properties, browser type and language, operating-system type, device type, viewport and screen dimensions, and timezone, as collected by PostHog Cloud (Section 3.1). Before 2026-08-03, a page-view URL also could contain the Polar checkout identifier on the success route, as specifically described in Section 3.1. PostHog data is aggregated under a daily-rotating cookieless identifier and was not intended to identify individual visitors. In addition, Lanreal stores content-free route name, status code, latency, outcome, and error-class events for its server-side route handlers through Cloudflare Workers Observability (Section 3.4). These events exclude request URLs, bodies, IP addresses, and user-agent strings.
• G. Geolocation data: approximate geolocation (country, region, city) derived from IP address by PostHog Cloud and provided only in aggregated form.
• H. Audio, electronic, visual, thermal, olfactory, or similar information: The freeform acquisition survey description is electronic information if you choose to submit it. The Website does not collect audio, visual, thermal, or olfactory information.
• I. Professional or employment-related information: Not requested. The acquisition survey freeform field could contain this information if you choose to enter it.
• J. Education information: Not requested. The acquisition survey freeform field could contain this information if you choose to enter it.
• K. Inferences: None.
• L. Sensitive personal information: Not requested. The acquisition survey instructs you not to enter sensitive personal information, but the freeform field could contain it if you choose to enter it.

Sources of personal information. PostHog Cloud analytics data is derived from browser interactions with the Website and from page and referrer URLs supplied by visitors, link creators, browsers, and referring sites. Cloudflare data is derived from your DNS and HTTP requests as they pass through Cloudflare's network and the Cloudflare Pages hosting platform. Acquisition survey data is collected directly from the response you choose to submit. The current checkout identifier is received from Polar when Lanreal's server creates the checkout session. Customer email, product, total, and license key are received from Polar after a completed purchase. The historical checkout identifier in the success URL likewise originated from Polar.

Business or commercial purposes for collecting personal information. Analytics data is collected for the business purpose of understanding aggregate website traffic patterns and improving the Website. Cloudflare data is collected for the business purpose of delivering the Website securely and mitigating abuse. Acquisition survey responses are collected to understand which sources introduce customers to Whisperstream and to evaluate Lanreal's marketing. Polar checkout-session data is collected to open and maintain the short-lived confirmation flow. Purchase-confirmation data is collected to confirm the completed order, display the product, price, and customer email, and retrieve the license key. Before 2026-08-03, the checkout identifier in the success-page URL also could be processed by PostHog as part of historical page-view analytics.

Categories of third parties with whom we share personal information. PostHog Inc. (analytics), Cloudflare Inc. (DNS, CDN, Pages hosting, and content-free application logs), Polar Software Inc. and its payment processor Stripe, Inc. (checkout and payment processing), and Supabase, Inc. (acquisition survey database), as described in Section 6. The acquisition survey freeform description is shared with Supabase but not PostHog.

Categories of personal information disclosed for a business purpose. In the preceding twelve months, Lanreal has disclosed or made available the following categories for the stated business purposes: Identifiers and internet or electronic network activity information to Cloudflare for DNS, CDN, hosting, security, and content-free application logging; Identifiers, internet or electronic network activity information, and approximate geolocation to PostHog for Website analytics (before 2026-08-03 this could include a checkout identifier in the success-page URL); Identifiers, personal information under Section 1798.80(e), and commercial information to Polar and Stripe for checkout, payment, purchase confirmation, and licensing; and electronic information, plus any identifiers, protected-classification, professional, education, or sensitive information that a visitor voluntarily entered in the optional acquisition-survey freeform field, to Supabase for survey storage. Lanreal has not disclosed any other category collected through the Website for a business purpose in the preceding twelve months.

Sale or sharing of personal information ("Do Not Sell or Share My Personal Information"). Lanreal does not sell your personal information to third parties in exchange for money or other valuable consideration, and Lanreal does not share your personal information for cross-context behavioural advertising. Lanreal has not sold or shared personal information about California residents in the preceding twelve months, and does not intend to do so. Because there is no sale or sharing, there is no "Do Not Sell or Share My Personal Information" link; this Website Privacy Policy, which discloses that the right is not applicable to Lanreal's practices, serves as the required disclosure under Cal. Civ. Code Section 1798.135.

Use of sensitive personal information. Lanreal does not request sensitive personal information through the Website. If you enter it in the acquisition survey despite the instruction not to, Lanreal does not use or disclose it for a purpose that triggers the CCPA right to limit. You may request deletion as described in Section 9.

How to submit CCPA requests. California residents may submit a right-to-know, right-to-delete, right-to-correct, or non-discrimination request by emailing support@whisperstream.io.

Lanreal implements security safeguards proportional to the sensitivity of the personal information the Website processes. The Website does not operate a user account database or store payment information. The limited acquisition survey database is not linked to a purchase or visitor identifier. In particular:

• The Website is served over HTTPS. All connections between your browser and the Website are encrypted in transit.
• Cloudflare provides DDoS protection and bot mitigation at the DNS and CDN layer.
• The Polar checkout iframe is served from Polar's own domain over HTTPS. Payment card data is handled by Stripe within the checkout iframe and never passes through the Website's frontend or backend.
• The Website's server-side API routes (checkout session creation and license key retrieval) communicate with Polar's API over HTTPS using a server-side access token that is stored as an environment variable in Cloudflare Pages and is not exposed to the browser.
• PostHog Cloud analytics data is transmitted to PostHog's EU ingestion endpoint over HTTPS.
• Acquisition survey responses are sent over HTTPS to Supabase. Supabase row-level security permits anonymous inserts but prevents anonymous reads, updates, and deletions of the acquisition_sources table. Lanreal's API validates the source, trims the freeform description, and limits it to 200 characters before storage.

No security program can guarantee absolute protection against all threats. If you become aware of a security issue affecting the Website, please contact Lanreal at support@whisperstream.io.

Lanreal may revise this Website Privacy Policy from time to time. When we revise it, we will change the version number at the top of this document. Minor clarifications that do not materially change how we collect, use, or share personal information will increment the minor version (for example, from 1.0 to 1.1). Material changes will increment the major version (for example, from 1.0 to 2.0).

How you learn about changes. The current version of this Website Privacy Policy is always available at the URL where it is published on the Website. When a material change is made, Lanreal will update the effective date at the top of the document and publish the revised version at the same URL. Lanreal does not currently operate a separate notification mechanism for Website Privacy Policy changes (such as email notification or a changelog page), because the Website does not maintain user accounts or an email list. This may change in a future version.

Third-party service changes. If Lanreal adds, removes, or replaces a third-party service listed in Section 6, that change will be reflected in a new version of this Website Privacy Policy.

If you believe that Lanreal has processed your personal information in a way that is inconsistent with this Website Privacy Policy or with applicable privacy law, please contact Lanreal first at support@whisperstream.io so that we have the opportunity to address your concern. Lanreal's Privacy Officer will review your complaint and respond within the timeline described in Section 9.

If you are not satisfied with Lanreal's response, you may also have the right to lodge a complaint with a supervisory authority:

• European Economic Area, the United Kingdom, and Switzerland: you have the right under GDPR Article 77 to lodge a complaint with the data protection supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.
• California: you may contact the California Privacy Protection Agency or the California Attorney General's Office for information about your rights under the CCPA.
• Canada (federal): you may file a complaint with the Office of the Privacy Commissioner of Canada (the "OPC") at https://www.priv.gc.ca/en/report-a-concern/, toll-free 1-800-282-1376. The OPC has the authority to investigate your complaint under section 11 of the Personal Information Protection and Electronic Documents Act, issue a Report of Findings, and make formal recommendations. If the matter remains unresolved after the OPC's investigation, section 14 of the Act grants you the right to apply to the Federal Court of Canada for a hearing.
• Canada (provincial): if you are a resident of Quebec, British Columbia, or Alberta, your provincial regulator may have parallel jurisdiction. You may contact Quebec's Commission d'accès à l'information at https://www.cai.gouv.qc.ca, the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca, or the Office of the Information and Privacy Commissioner of Alberta at https://www.oipc.ab.ca.

Nothing in this section limits any other right or remedy available to you under applicable law.

Questions, requests, and complaints about this Website Privacy Policy and about Lanreal's handling of personal information collected through the Website should be directed to Lanreal's Privacy Officer:

Privacy Officer Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Email: support@whisperstream.io

Lanreal Technologies Inc. is the data controller for the personal information described in this Website Privacy Policy. The Privacy Officer is the designated contact for Canadian federal privacy law, for GDPR Articles 13 and 14, and for CCPA consumer requests.

Copyright (c) Lanreal Technologies Inc. All rights reserved.