Whisperstream Website Privacy Policy

Version 6.1

Effective 2026-08-17

This Website Privacy Policy explains how Lanreal Technologies Inc. ("Lanreal," "we," "us," or "our") collects, uses, shares, and retains personal information when you visit the Whisperstream marketing website at whisperstream.io (the "Website"). It also describes the rights you have with respect to that personal information and how to exercise them.

This Website Privacy Policy covers only the Whisperstream marketing website at whisperstream.io. It does not cover the Whisperstream desktop application for Microsoft Windows, which is governed by a separate Privacy Policy bundled with the application installer and published at https://whisperstream.io/privacy. If you are looking for information about how the desktop application handles your data, please refer to that document instead.

This Website Privacy Policy also does not cover your relationship with Polar Software Inc. ("Polar"), the Merchant of Record that processes your purchase when you buy a Whisperstream license. When you complete a purchase through the embedded checkout on the Website, Polar separately collects your name, email address, payment information, and billing address through its own checkout flow. That information is governed by your relationship with Polar and by Polar's privacy policy at https://polar.sh/legal/privacy. Lanreal does not directly collect your payment information.

The data controller responsible for the personal information described in this Website Privacy Policy is:

Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Lanreal is a corporation incorporated under the Business Corporations Act (Ontario). Our registered office is in the Province of Ontario, and our operations are governed by Canadian federal and provincial law applicable therein.

Privacy Officer designation. In accordance with Canadian federal privacy law (the Personal Information Protection and Electronic Documents Act), Lanreal Technologies Inc. has designated a Privacy Officer responsible for compliance with this Website Privacy Policy. The Privacy Officer can be contacted at support@whisperstream.io. Throughout the remainder of this document, "Canadian federal privacy law" refers to the statute named above.

Under the European Union General Data Protection Regulation (GDPR), Lanreal is the "controller" of the personal information described in this Website Privacy Policy. Under the California Consumer Privacy Act (CCPA), Lanreal is a "business" that collects personal information about California residents through the Website.

All privacy-related communication, including data subject rights requests, complaints, and general questions about this Website Privacy Policy, should be directed to support@whisperstream.io. This is Lanreal's single privacy contact channel for the Website.

The Website is a static marketing site that promotes the Whisperstream desktop application and facilitates checkout. This section describes every category of information associated with your visit to the Website.

3.1 PostHog Cloud analytics data

The Website uses PostHog Cloud (EU instance at eu.i.posthog.com) to understand how visitors use the site. Most Website analytics are sent by the posthog-js browser SDK. One narrow checkout event may instead be sent by the Website server as described below. The browser SDK is configured in cookieless mode (cookieless_mode: 'always') with memory-only persistence (persistence: 'memory') and operates as follows:

• The SDK does not set any cookies, and does not use localStorage, sessionStorage, or any other persistent browser storage. It reads the limited browser, page, and referrer information enumerated below while its JavaScript runs in memory.
• Each event you generate is associated with a server-side identifier derived by PostHog from a one-way hash of the project identifier, a daily-rotated random salt, your IP address, your user-agent string, and the website hostname. PostHog deletes the daily salt at the end of each calendar day, which makes the identifier non-reversible and rotates your effective identity every 24 hours.
• PostHog does not retain raw IP addresses against events captured in cookieless mode; the IP address is used only as input to the hash described above and to derive approximate geolocation (country, region, city) for aggregated analytics.
• The Website suppresses PostHog initialization and event capture when your browser sends a Do Not Track or Global Privacy Control signal.
• The Website disables autocapture, session replay, surveys, heatmaps, exception capture, console-log capture, Web Vitals reporting, and persistent person profiles.
• The Website sends the full current and initial page URLs and referrer URLs that the browser makes available, including paths, query strings, fragments, and arbitrary custom tracking parameters. It also sends referring-domain values and standard UTM campaign-attribution properties. This detail is used to distinguish inbound links and campaigns.

For page views and custom events sent by the browser SDK, PostHog Cloud collects the following data points:

• event timestamp,
• current and initial page URL, including hostname, path, query string, fragment, and dynamic route pattern,
• current and initial referrer URL, including any path, query string, or fragment supplied by the browser, plus the referring domain,
• standard UTM campaign-attribution properties (utm_source, utm_medium, utm_campaign, utm_term, utm_content) when present in the page URL,
• geolocation (country, region, city, derived from your IP address),
• device operating system and version,
• browser name, browser version, and browser language preference,
• device type (desktop, mobile, or tablet),
• viewport dimensions and screen dimensions,
• timezone, and
• the version of the PostHog client library.

Before 2026-08-03, Polar redirected a completed purchase to /success?checkout_id=<uuid>. PostHog's page-view event could therefore include that full success-page URL and its Polar-generated checkout identifier in the $current_url event property. The checkout identifier was not a license key or payment-card number, but Lanreal could use it with Polar's server API to retrieve the associated purchase confirmation. The current success route uses a short-lived encrypted, HttpOnly cookie and a clean /success URL. The current analytics filter suppresses every page view and custom event on /success; no paid-success or license event is sent to PostHog. Outside that surface, the filter does not remove query strings, fragments, or referrer detail. The Website's checkout flow does not place checkout identifiers, customer email addresses, product or payment details, or license keys in the success URL or its event-specific analytics properties. Because inbound page URLs and referrers are transmitted in full, a value that a visitor or third party places in a tracking link can be sent to PostHog. Do not put personal or sensitive information in links to the Website.

This data is used by Lanreal in aggregated form to understand website traffic patterns. The cookieless server-side identifier described above does not track visitors across different applications or websites and rotates each day, so it cannot be used by Lanreal to build a long-term profile of an individual visitor.

In addition to automatic page view tracking, the Website sends the following custom events through the PostHog SDK to measure user engagement:

• download_clicked (with CTA label and page location),
• pdf_download_clicked (with page location),
• watch_demo_clicked,
• price_badge_clicked (with page location), and
• checkout_session_created (with page location).

When either first-party checkout route receives a purchase request, the Website server may send buy_clicked instead of relying on the browser SDK. The event uses only the fixed page-location value pricing or checkout_redirect. If a current allow preference and valid attribution cookie are present, the event joins the consented purchase-measurement funnel described in Section 3.5 and uses its random wm1_ identifier and age-appropriate coarse acquisition fields. Otherwise, PostHog requires a distinct_id, so the event uses the shared technical value server_checkout_redirect, which does not distinguish requests or visitors. That fallback disables person-profile processing and is used only as a total count. Both paths disable GeoIP enrichment, set the IP property to null, and are suppressed for Do Not Track or Global Privacy Control. The Website does not forward the visitor's IP address, user agent, URL, referrer, query string, request headers, raw cookies, app or install identifier, customer identifier, or purchase identifier with this event. The personless fallback is not joined to browser analytics or the consented funnel.

The event-specific properties contain no direct identifier. The browser SDK does not send the download-attribution cookie, consent preference, random funnel identifier, or paid-source dimensions with these cookieless events. The server separately sends the consented events described in Section 3.5 under an unlinked identifier and restricted schema. PostHog also attaches the full page and referrer context described above. The Website's outbound filter rejects unapproved event types and removes standalone checkout, license, email, payment, customer, order, source, and transcript property names. That property-name filter does not remove text embedded in a page URL, referrer URL, query string, or fragment. The paid /success surface is excluded before those properties can leave the browser, and a later /success referrer is discarded. These controls prevent the cookieless website session from becoming a source-to-purchase join.

3.2 Cloudflare DNS and CDN data

The Website uses Cloudflare for DNS resolution and is hosted on Cloudflare Pages. When you visit the Website, your request is resolved and served by Cloudflare's network. As part of standard CDN, DNS, and hosting operation, Cloudflare may:

• process your IP address to route your request,
• set a security cookie (__cf_bm or similar) to distinguish legitimate visitors from automated traffic and to mitigate abuse, and
• collect standard access logs for security and performance monitoring.

Cloudflare's processing of this data is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Lanreal does not have access to Cloudflare's raw CDN or DNS access logs (a separate Cloudflare Logpush product that Lanreal does not enable). The content-free application logs stored through Cloudflare Workers Observability are described separately in Section 3.4 below.

3.3 Polar embedded checkout data

When you click a purchase button on the Website, the Website creates a checkout session through Polar's API and opens an embedded Polar checkout modal (an iframe served by Polar). Inside that checkout modal, Polar collects:

• your name,
• your email address,
• your payment card information (processed by Stripe, Inc., Polar's payment processor), and
• your billing address, phone number, business name, and tax number (if you provide them).

This information is collected directly by Polar inside its own iframe. Lanreal does not see, handle, or store your payment card details. When the Website creates the checkout session, Polar immediately returns the checkout identifier (a Polar-generated UUID) to Lanreal's server. This occurs before you complete or abandon the checkout. If you complete the purchase and return to the confirmation page, Lanreal then retrieves the following data from Polar through its server-side API:

• the customer email address associated with the purchase,
• the product name and purchase total, and
• the license key generated for your purchase.

This data is used to render the post-purchase confirmation page on the Website (showing your email, product name, total, and license key). The checkout identifier is held in an encrypted, authenticated, HttpOnly, Secure, SameSite=Lax cookie for twenty-nine minutes. It is not placed in the confirmation-page URL, browser-visible JavaScript, PostHog, or Lanreal application logs. The Website uses the cookie to retrieve confirmation and licensing data from Polar's API. License polling does not delete this cookie. If the checkout is abandoned, it expires without being used for purchase confirmation. Neither the checkout data nor the license key is stored in a Lanreal-operated database. After the cookie expires or is deleted, the purchase data remains only in Polar's systems.

If you previously allowed the separate purchase measurement described in Section 3.5, the same encrypted checkout-state cookie may also contain the random measurement identifier, a technical checkout-event UUID and timestamp, and an already-reduced acquisition cohort. Every Website checkout and every purchase link opened by the desktop app uses the same first-party checkout helper. The helper rechecks your current choice and browser privacy signals, reads the Website's attribution cookie, reduces its detail according to age, and places the surviving measurement state in checkout state. After Polar creates the checkout, the server may send the consented checkout event to PostHog. It does not send attribution fields to Polar. The desktop app only opens the Website checkout URL. It does not read, store, or transmit attribution data.

3.4 Server-side request logs and Cloudflare Workers Observability

The Website is served by Cloudflare's Workers platform (via Cloudflare Pages and the @opennextjs/cloudflare adapter). Two distinct categories of server-side log data exist for the Website:

• Cloudflare's own platform-level logs. Cloudflare's hosting infrastructure logs standard HTTP request metadata (including your IP address, request path, user agent, and timestamp) as part of its normal platform operation. These logs are controlled by Cloudflare and are governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Lanreal does not have access to or control over these platform-level logs.

• Content-free application logs. Lanreal's server-side routes emit allowlisted operational events such as a route name, status code, latency, outcome, and error class. They do not log request URLs, request bodies, checkout identifiers, license keys, email addresses, attribution channel, source, campaign, cookies, measurement or event identifiers, HMAC values, or payment data. Cloudflare's automatic per-request invocation logging is explicitly disabled. Cloudflare retains the content-free application log events according to the Workers Logs setting on Lanreal's account. Lanreal uses them only for reliability, debugging, and security, not marketing or profiling.

Server-side request logs and the Cloudflare DNS and CDN data described in Section 3.2 are processed by the same provider under the same Cloudflare Customer Data Processing Addendum and the same privacy policy.

3.5 Optional download-to-purchase measurement

When you request the Whisperstream installer, the Website may ask whether you will allow purchase measurement. Download without measurement and Allow measurement and download are equally available. Your download continues in either case, and a failure to save the choice does not block it.

Before you choose, the Website does not derive, store, or send acquisition context for this flow, create a measurement identifier, or send a funnel event. When you select allow, or request another download while a saved allow remains current, the Website derives coarse acquisition context from the current landing URL and referrer in browser memory. The allowed fields are:

• one broad channel, such as organic search, AI, organic social, referral, direct, or unknown;
• one optional fixed-enum source, such as a named search engine, AI service, or social service; and
• one optional shared campaign code, retained only if it is on Lanreal's server-configured allowlist.

The Website does not retain a raw URL, raw referrer, arbitrary query value, click ID, advertising ID, install ID, device ID, email, or free text in this attribution flow. PostHog separately receives the page and referrer information described in Section 3.1 under its own processing terms. That separate cookieless analytics identifier is not associated with this measurement.

If you allow measurement, the server sets two separate first-party cookies:

1. whisperstream_attribution_choice, a Secure, SameSite=Lax preference cookie that contains only allow or decline, the notice version, and the decision time. It has a fixed expiry no more than 180 days after that decision and is not renewed by later downloads. It is readable by the Website so the download controller and Privacy choices control can respect your current choice.
2. whisperstream_download_attribution, an encrypted, authenticated, HttpOnly, Secure, SameSite=Lax cookie that contains the notice/schema version, server acquisition time, fixed expiry, a cryptographically random measurement identifier beginning with wm1_, one technical download-event UUID, broad channel, optional fixed source, and optional allowlisted shared campaign. It has a fixed expiry of no more than 90 days and never exceeds the saved allow deadline.

A valid attribution cookie keeps its original deadline. Visits, app launches, checkout attempts, and later downloads before expiry do not renew it. A new explicit download can create a new measurement period only after the prior one has expired and while your saved allow choice remains current.

After creating the cookie, the server best-effort sends download_measurement_started to PostHog Cloud EU. It uses the random measurement identifier as the PostHog distinct_id and creates a minimal identified person with no person properties.

If you later start a purchase in the same browser profile, every purchase entrypoint uses the same first-party checkout helper. During the first 30 days, funnel events may use acquisition week, channel, optional fixed source, and optional allowlisted campaign. When the checkout endpoint receives the purchase request, the server schedules a best-effort buy_clicked event with a new technical event UUID, stable timestamp, and the fixed pricing or checkout_redirect location. The helper also places the measurement identifier, a new technical checkout-event UUID, a stable checkout-event timestamp, and the surviving cohort into the encrypted 29-minute checkout state. After Polar successfully creates the checkout, the server best-effort sends checkout_started to PostHog.

After 30 days and through day 90, it carries only acquisition month and broad channel. The 90-day cookie can still contain the original sealed coarse source and campaign until expiry, but the checkout helper does not copy or use those details after day 30.

On the clean /success page, the server checks that your current preference still allows measurement and that no DNT or GPC signal is active, then retrieves the checkout from Polar. An active signal also prevents attribution from being copied at checkout and causes the Website to best-effort remember decline and delete the attribution cookie. A purchase is eligible only if Polar confirms that it succeeded, is for the configured exact Whisperstream product, has a total greater than zero, and supplies a validated stable modification timestamp. The Website derives a technical purchase-event UUID from a dedicated, domain-separated HMAC of the checkout ID, then sends verified_purchase_completed to PostHog. It never sends the raw checkout ID.

The four possible funnel events contain only the random measurement identifier, exact event name, notice/schema version, technical event UUID, stable timestamp, the age-appropriate cohort fields above, and, for buy_clicked, the fixed checkout location. For this measurement, the server does not send PostHog your name, email, customer, checkout, order, product or license identifier, payment details, price, currency, raw cookie, IP address, request headers, user agent, precise location, device information, raw URL or referrer, browser fingerprint, desktop identifier, or cookieless browser PostHog identifier. It disables GeoIP enrichment on each event. Session replay, advertising destinations, and audience exports are not enabled for this processing.

The random measurement identifier, event UUIDs, minimal person, and linked events are pseudonymous personal information under GDPR Articles 4(1) and 4(5), not anonymous information. The public PostHog project token used for event capture is not an authentication boundary, and retry deduplication is best-effort. Lanreal treats the resulting funnel as directional analytics. It is not used for accounting, licensing, customer decisions, or advertising.

You can change your choice at any time through Privacy choices in the Website footer. Choosing decline deletes the 90-day attribution cookie and stops future funnel events because checkout and /success recheck the current preference. If the cookie still contains the random measurement identifier, the server also asks PostHog to delete the minimal person and linked events. PostHog performs this deletion asynchronously. If the deletion request cannot be submitted, measurement still stops and the Website provides a privacy contact so you can retry or ask us to investigate. Withdrawal does not affect the lawfulness of earlier processing under GDPR Article 7(3).

Withdrawal reaches the measurement period that is active when you decline. If an earlier 90-day period already expired, we no longer hold its random identifier and cannot locate those earlier PostHog records; they are removed by the scheduled deletion described below.

After the cookie expires, we generally cannot connect a PostHog funnel record back to you because we deliberately do not store your identity, purchase identifier, or contact details with it. GDPR Article 11 does not require us to collect additional identifying information solely to identify you when our purpose does not require identification. GDPR Article 11(2) disapplies Articles 15 to 20 for as long as we cannot identify you. If you provide information that lets us locate a record without exposing another person's data, we will assess and honor applicable rights under GDPR Articles 15 to 20.

PostHog keeps the funnel events and minimal person for no more than 12 months from the earliest funnel event. A daily scheduled process begins deletion around day 330 to leave operational margin before the public ceiling. It queries only the exact current event names, schema, and wm1_ namespace, submits person-and-events deletion, and checks asynchronous status. The 12-month maximum is a production condition. Lanreal operates the scheduled deletion process with advance margin and continues to verify the deadline, including the provider's treatment of backups and replicas.

The desktop Whisperstream app does not read, store, or transmit attribution data. If the app opens the Website checkout URL, the browser sends its own first-party cookies to the Website. The app does not carry those cookies or the attribution envelope.

This feature was enabled in production on 2026-08-17. Lanreal continues to maintain and verify the live PostHog EU project, provider and transfer facts, event exclusions, deletion, retention, required server secrets, published policy, release evidence, and controller records described in this policy.

Optional post-purchase acquisition survey

After a completed purchase, the Website separately offers an optional survey asking how you found Whisperstream. If you submit it, Lanreal collects one source from a fixed list and, if you select "Somewhere else," an optional free-text description of up to 200 characters. The free-text field asks you not to include names or other personal or sensitive information.

The Website sends the response through a Cloudflare Worker API route to the acquisition_sources table hosted by Supabase. The API validates the fixed source, trims the optional description, and limits it to 200 characters. The response is not linked to a name, email, checkout identifier, license key, IP address, user agent, purchase record, PostHog identifier, or the consented PostHog funnel described above. The source or free-text response is not written to application logs or sent to PostHog.

Lanreal retains submitted responses for longitudinal customer-acquisition analysis and reviews at least once each calendar year whether individual responses remain reasonably necessary for that purpose. A response remains necessary only while it supports a channel trend, source-taxonomy decision, or acquisition-period comparison that Lanreal still uses and cannot reproduce from less detailed aggregate data. Lanreal deletes or anonymizes responses that no longer meet that criterion. Optional free text could contain personal information voluntarily entered by a respondent, so Lanreal treats the table as potentially containing personal information. You may object to this processing or request deletion under Section 9.

3.6 Information the Website does not collect

The Website does not collect the following:

• No user accounts. The Website has no registration, login, or user-account database. Current PostHog attribution is stored in encrypted browser state and PostHog, not in a Lanreal-operated attribution database. Supabase stores the separate optional acquisition survey described above.
• No PostHog attribution free text. Current purchase measurement uses fixed coarse values and an optional allowlisted shared campaign only. The separate optional survey may accept the limited free text described above, but that response is not sent to PostHog or joined to the PostHog funnel.
• No browser-analytics or advertising cookies. Separate cookieless PostHog browser analytics uses no persistent storage. The Website does set the consented purchase-measurement cookies in Section 3.5 and the checkout-state cookie in Section 3.3.
• No attribution identity join. The Website does not join the random measurement identifier to cookieless browser analytics, Polar metadata, a customer, email, license, support record, or app installation.
• No contact form submissions. Support requests are handled through email at support@whisperstream.io.
• No localStorage or sessionStorage. The Website does not use those browser storage mechanisms for attribution or analytics.
• No advertising identifiers or tracking pixels. The Website does not integrate Google Analytics, Meta Pixel, Google Tag Manager, or a comparable advertising service.

This section explains, for each category of information described in Section 3, the purpose for which Lanreal processes that information and the corresponding lawful basis under GDPR Article 6. Sections 3 through 9 provide the clear, accessible processing information required by GDPR Articles 12 and 13.

• PostHog Cloud analytics data (Section 3.1). The purpose is to understand how visitors use the Website so that Lanreal can improve its content, layout, and user experience. The lawful basis under GDPR Article 6 is Article 6(1)(f), Lanreal's legitimate interest in understanding aggregate website usage patterns, balanced against your interests and fundamental rights. The PostHog SDK is configured in cookieless mode (no cookies, no localStorage, no sessionStorage), does not track visitors across sites, derives a daily-rotating server-side identifier from a one-way hash with a daily-deleted salt, stores data on PostHog's EU instance in Frankfurt, Germany, and produces aggregated statistics. The Website suppresses this processing for Do Not Track and Global Privacy Control signals. Full URL and referrer collection increases the possibility that a tracking link contains information unrelated to audience measurement. Lanreal relies on Article 6(1)(f) for GDPR purposes while its data- minimization assessment, first-party privacy-choice control, and jurisdiction-specific review remain open. This does not establish a jurisdiction-wide exemption from consent requirements under national laws implementing the ePrivacy Directive.

• Cloudflare DNS and CDN data (Section 3.2). The purpose is to deliver the Website to your browser reliably and to protect the Website against malicious traffic. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating and securing the Website. Cloudflare's security cookies, if set, serve the strictly necessary function of distinguishing legitimate visitors from bots and are not used for advertising or analytics.

• Polar embedded checkout data (Section 3.3). The purpose of creating the checkout session and displaying order confirmation details is to complete the purchase you initiated. The lawful basis is Article 6(1)(b), performance of a contract, because the checkout flow is how you enter into the Whisperstream license agreement. Polar's own collection of your payment information inside its checkout iframe is governed by Polar's privacy policy, and Polar acts as Merchant of Record for the transaction.

• Cloudflare's own platform-level logs (Section 3.4). Standard HTTP request logs generated by Cloudflare's hosting platform serve Cloudflare's purpose of platform operation, security monitoring, and abuse prevention. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in maintaining the availability and security of the Website. These logs are controlled by Cloudflare; Lanreal does not access them.

• Content-free application logs (Section 3.4). The allowlisted operational events serve Lanreal's purposes of reliability, debugging, and security of Lanreal's server-side route handlers. The lawful basis is Article 6(1)(f), Lanreal's legitimate interest in operating a reliable and secure marketing website. This processing is distinct from the Cloudflare-controlled platform-level logs described in the preceding bullet because Lanreal is the controller for these events and uses the data for Lanreal's own purposes. Lanreal does not use application log data for marketing analytics, visitor profiling, retargeting, or any purpose beyond the three named here. Lanreal maintains a documented legitimate-interests assessment for this processing under Article 6(1)(f).

• Download-to-purchase measurement (Section 3.5). Lanreal relies on your consent under GDPR Article 6(1)(a) and Article 7 for an allow preference, attribution cookie, later access to the attribution state, a minimal PostHog person, and the download, buy, checkout, and verified-purchase events. Prior consent under ePrivacy Directive Article 5(3) and UK PECR Regulation 6 also applies to storing and accessing the optional cookie. Lanreal does not use legitimate interests as a fallback basis for this flow. Continuing without measurement has no effect on download, price, purchase, license, or use. Purpose limitation, data minimisation, accuracy, and storage limitation are applied under GDPR Articles 5(1)(b) to 5(1)(e), with privacy-by-design and security measures under Articles 25 and 32. Because the capture token is not an authentication boundary, the funnel is directional analytics and is not used for accounting, licensing, customer decisions, or advertising.

• Remembering a decline (Section 3.5). A decline preference is strictly necessary to honor your request, avoid repeated prompts, and prevent optional attribution storage. Lanreal relies on Article 6(1)(f), its legitimate interest in respecting and demonstrating that privacy choice, and the strictly necessary preference-storage exception under ePrivacy rules. The cookie contains only the notice version and decline, lasts no more than 180 days, causes no measurement, and can be replaced through Privacy choices.

• Optional acquisition survey responses (Section 3.5, Optional post-purchase acquisition survey). The purpose is longitudinal analysis of the voluntarily submitted sources through which customers found Whisperstream. The lawful basis is GDPR Article 6(1)(f), Lanreal's legitimate interest in understanding and improving customer acquisition. Self-reported answers provide information that inferred landing data cannot, and the optional free-text field identifies sources outside the fixed list. A fixed list alone would lose that information. The survey remains optional, its records contain no account, purchase, contact, device, network, or PostHog identifier, and its answers are not joined to the separate PostHog funnel. Lanreal treats optional free-text descriptions as potentially personal information, uses responses only for the acquisition-analysis purpose, reviews their continuing necessity at least annually, and honors applicable objection and deletion rights. These controls implement purpose limitation, data minimisation, storage limitation, and accountability under GDPR Articles 5(1)(b), 5(1)(c), 5(1)(e), and 5(2).

Except for the purchase measurement identified above, Lanreal does not rely on your consent (GDPR Article 6(1)(a)) as the lawful basis for the other processing described in this Website Privacy Policy. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22.

The Website does not set cookies for separate browser analytics or advertising and does not use localStorage or sessionStorage for tracking purposes. It uses these first-party cookies:

• whisperstream_checkout_state, the encrypted, authenticated, HttpOnly, Secure, SameSite=Lax cookie described in Section 3.3. It lasts 29 minutes and is strictly necessary for checkout confirmation and licensing. With prior measurement consent, it may also contain the random measurement identifier, a stable checkout-event tuple, and an already-reduced attribution cohort.
• whisperstream_attribution_choice, a Secure, SameSite=Lax preference cookie that contains only allow or decline, the notice version, and the decision time. It has a fixed expiry no more than 180 days after that decision, is not renewed by later downloads, and is readable by the Website so it can respect your choice.
• whisperstream_download_attribution, the encrypted, authenticated, HttpOnly, Secure, SameSite=Lax purchase-measurement cookie described in Section 3.5. It has a fixed deadline of no more than 90 days, never exceeds the saved allow deadline, and is never renewed by a visit or checkout.

The Website asks for consent immediately before the first measured installer download. Continuing without measurement is equally available. Under GDPR Article 6(1)(a), Article 7, and ePrivacy Directive Article 5(3), an allow preference and the attribution cookie are used for purchase measurement only after that affirmative choice. A decline preference is stored only to honor the refusal and avoid repeated prompts, under the strictly necessary and Article 6(1)(f) basis described in Section 4. Privacy choices remains available in the footer. Choosing decline clears the attribution cookie and blocks future funnel events. When the cookie still contains a valid random measurement identifier, the server also best-effort asks PostHog to delete the minimal person and linked events. PostHog deletion is asynchronous. The choice interface reports if deletion was requested, no active identifier was available, or submission was unavailable.

The PostHog Cloud analytics SDK described in Section 3.1 is active but does not use cookies, localStorage, sessionStorage, IndexedDB, or other persistent browser storage. Do Not Track and Global Privacy Control signals suppress it.

The following third parties may set cookies or use similar technologies when you visit the Website:

• Cloudflare may set a security cookie (such as __cf_bm) to identify and mitigate malicious bot traffic. This is a strictly necessary cookie that serves a security function. It is not used for advertising, analytics, or cross-site tracking.

• Polar may set cookies inside its embedded checkout iframe when you initiate a purchase. These cookies operate within Polar's own domain and are governed by Polar's privacy policy.

The Website uses a contextual download-time consent prompt rather than a general analytics cookie banner. A Cloudflare security cookie, if present, is treated as strictly necessary under ePrivacy Directive Article 5(3). Lanreal continues to review the jurisdiction-specific treatment of cookieless PostHog analytics and the minimisation of URL and referrer data. This policy does not claim a consent exemption for cookieless analytics in every jurisdiction. The purchase-measurement choice controls only the linked funnel in Section 3.5. It does not control the separate cookieless browser analytics described in Section 3.1, which remains unlinked and follows supported browser privacy signals.

The Website relies on the current third-party services below. This list is exhaustive for the Website as it exists at the time of this policy's effective date.

1. PostHog Inc. (San Francisco, California, USA), website analytics provider. PostHog provides the PostHog Cloud analytics service described in Section 3.1 and is the intended processor for the consented funnel in Section 3.5. Separate cookieless browser analytics and the consented funnel use unlinked identifiers, different lawful bases, and different retention and rights paths. The funnel creates a minimal identified person with no person properties and sends only the four allowed events and properties. Analytics data remains in Lanreal's PostHog account under the retention terms described in Section 8. PostHog's processing is governed by PostHog's privacy policy at https://posthog.com/privacy and PostHog's Data Processing Addendum at https://posthog.com/dpa. PostHog's GDPR transfer mechanism includes both the European Commission's Standard Contractual Clauses and PostHog's certification under the EU-U.S. Data Privacy Framework. Before the consented funnel is activated, Lanreal must verify that the live project, DPA scope, subprocessors, support access, transfer mechanism, deletion, retention, backup, and replica facts match this policy.

2. Polar Software Inc. (Dover, Delaware, USA), Merchant of Record and checkout provider. Polar provides the embedded checkout modal described in Section 3.3 and processes your purchase. Polar receives the data enumerated in Section 3.3 directly from you within its checkout iframe. Polar's processing is governed by Polar's privacy policy at https://polar.sh/legal/privacy. Polar's GDPR transfer mechanism is the European Commission's Standard Contractual Clauses, as stated in Polar's privacy policy. Lanreal reads the checkout after your return to verify status, exact product, and positive total. It does not send attribution fields to Polar.

3. Stripe, Inc. (South San Francisco, California, USA), payment processor for Polar. Stripe processes your payment card information on behalf of Polar. Lanreal does not have a direct contractual relationship with Stripe for the Website's checkout flow. Stripe's involvement is governed by Polar's relationship with Stripe and by Stripe's privacy policy at https://stripe.com/privacy.

4. Cloudflare, Inc. (San Francisco, California, USA), DNS, CDN, website hosting (via Cloudflare Pages and Cloudflare Workers), and Workers Observability. Cloudflare provides DNS resolution, content delivery, the hosting platform that serves the Website, and the Workers Observability product that stores Lanreal's content-free application log events (Section 3.4). Cloudflare also runs the same-origin attribution and checkout routes, transports the encrypted first-party cookies, and holds the server-only attribution-encryption, checkout-state, PostHog event-UUID, PostHog admin, and Polar secrets plus the public PostHog project token configured for those routes. Cloudflare also runs the daily PostHog retention job. Cloudflare receives the data described in Section 3.2, the platform-level hosting logs described in Section 3.4, and the content-free application events stored through Workers Observability. Automatic per-request invocation logging is disabled. Cloudflare publishes a Customer Data Processing Addendum (version 6.4, effective 2026-04-03), whose Annex I.B expressly contemplates "Personal Data processed in Customer Logs, such as IP addresses." Lanreal is correcting the Cloudflare account's customer-of-record details so that the account-level contract names Lanreal; that operational item is not represented here as already complete. No additional sub-processor is engaged for the storage of Workers Observability data; it is stored on Cloudflare's own infrastructure. Cloudflare's processing is governed by Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/. Cloudflare's GDPR transfer mechanism includes both the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

5. Supabase, Inc. (Delaware, USA), optional acquisition-survey storage. Supabase is not used for the current PostHog download-to-purchase measurement. It hosts the separate acquisition_sources table for the optional post-purchase survey under the purpose and annual review criteria in Sections 4 and 8. Supabase's processing is governed by its privacy policy at https://supabase.com/privacy. Lanreal has executed Supabase's Data Processing Addendum at https://supabase.com/legal/dpa, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum.

Lanreal does not share personal information with any other recipients. Lanreal does not disclose personal information to advertisers, data brokers, or social media platforms.

Lanreal is incorporated in Ontario, Canada. All five third-party services listed in Section 6 are incorporated in the United States. Personal information collected through the Website may therefore be transferred from your location to the United States and Canada.

For transfers from the European Economic Area to Lanreal in Canada, Lanreal relies on European Commission Decision 2002/2/EC to the extent Lanreal is subject to Canada's Personal Information Protection and Electronic Documents Act. The live transfer assessment must verify that applicability before this feature is activated; if it does not apply, Lanreal will put an appropriate Article 46 safeguard in place before processing.

This section summarizes the transfer mechanism for each service under Chapter V of the GDPR:

• PostHog Inc. (United States; EU data instance in Frankfurt, Germany). PostHog retains Lanreal's analytics events on its EU instance, which is physically located in Frankfurt, Germany. The Frankfurt storage location reduces transfer risk for data at rest but does not eliminate the Chapter V transfer, because PostHog Inc. (United States) remains the contracting processor with potential support and operational access rights under United States law. PostHog's GDPR transfer mechanisms include both the European Commission's Standard Contractual Clauses and PostHog's certification under the EU-U.S. Data Privacy Framework, which are intended to address that residual access risk, as described in PostHog's privacy policy and Data Processing Addendum. The consented funnel uses the PostHog EU project described above, and Lanreal continues to review the applicable provider access and transfer facts for that processing.

• Polar Software Inc. (United States). Polar cites the European Commission's Standard Contractual Clauses as the transfer mechanism for personal information from the European Economic Area, as stated in Polar's privacy policy.

• Stripe, Inc. (United States). Stripe is Polar's payment processor. Stripe's transfers are governed by Stripe's privacy policy and by Polar's contractual relationship with Stripe. Lanreal does not implement a separate transfer mechanism for Stripe because Lanreal's relationship with Stripe is indirect (through Polar as Merchant of Record).

• Cloudflare, Inc. (United States). Cloudflare's GDPR transfer mechanisms include both the European Commission's Standard Contractual Clauses and the EU-U.S. Data Privacy Framework, as described in Cloudflare's privacy policy and Trust Hub.

• Supabase, Inc. (United States). Supabase is incorporated in Delaware, USA, and stores the optional acquisition-survey responses described in Sections 3.5, 4, and 8. It does not receive PostHog funnel events or identifiers. Lanreal has executed Supabase's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses (Controller-to-Processor, Module 2) and the UK International Data Transfer Addendum as the mechanisms for transfers of personal information from the European Economic Area, the United Kingdom, and Switzerland to Supabase in the United States.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and wish to receive further information about these transfer mechanisms, please contact Lanreal at support@whisperstream.io.

Lanreal's retention posture for Website data is limited. The Website does not operate a user account system or a PostHog attribution database. Supabase holds the separate optional acquisition-survey responses for this Website purpose.

• PostHog Cloud analytics data. Data sent by the Website remains on PostHog's EU instance for the configured retention period or until Lanreal deletes it, subject to PostHog's retention schedule. The daily-rotated server-side identifier described in Section 3.1 cannot be tied to a returning visitor because the salt used to derive it is deleted at the end of each calendar day. Aggregated analytics data (page view counts, referrer distributions, device breakdowns) is retained by PostHog for as long as Lanreal's PostHog account remains active. PostHog does not retain raw IP addresses against events captured in cookieless mode.

• PostHog consented funnel data. The random wm1_ measurement identifier, minimal person, and four possible linked funnel events are retained for no more than 12 months from the earliest funnel event. A daily scheduled process begins deletion around day 330, submits person-and-events deletion, and checks PostHog's asynchronous deletion status. The 12-month ceiling is a production condition. Before activation, Lanreal must prove the operated cleanup or an equivalent contractual retention commitment and document how backups, replicas, cold storage, and restores honor that ceiling.

• Cloudflare DNS and CDN logs. Cloudflare retains access logs in accordance with its own retention schedule, as described in Cloudflare's privacy policy. Lanreal does not have access to these logs.

• Polar checkout data. Polar retains your purchase information (name, email, billing address, payment card details via Stripe) for the duration of your customer relationship with Polar and in accordance with Polar's own retention schedule and applicable financial record-keeping obligations. Lanreal does not store checkout data in any Lanreal-operated database. The checkout identifier is retained in the encrypted, authenticated, HttpOnly cookie described in Section 3.3 for 29 minutes, including when a checkout is abandoned. License polling does not delete this cookie early. The displayed email, product, total, and license key are retrieved from Polar's API and exist only in transient server and browser memory for the confirmation session.

• Cloudflare's own platform-level logs. Cloudflare retains platform-level request logs in accordance with its own retention schedule, as described in Cloudflare's privacy policy. Lanreal does not control or have access to these platform-level logs.

• Content-free application logs. Cloudflare Workers Observability stores the allowlisted application events described in Section 3.4. Automatic invocation logging is disabled. The application events remain on Cloudflare's platform for the configured Workers Logs retention period and are not exported off that platform.

• Purchase-measurement cookies. The allow/decline preference cookie lasts for a fixed period of up to 180 days and is not renewed by later downloads. The separate encrypted, HttpOnly attribution cookie expires at a fixed deadline 90 days after it is set. Its deadline is not renewed by visits or checkout. Choosing decline deletes the attribution cookie sooner. The original encrypted coarse details may remain in that cookie until its deadline, but source and campaign are not used after day 30.

• Optional acquisition-survey responses. The selected source and any optional free-text description remain in the separate acquisition_sources table for longitudinal customer-acquisition analysis. At least once each calendar year, Lanreal reviews whether each response still supports a channel trend, source-taxonomy decision, or acquisition-period comparison that Lanreal uses and cannot reproduce from less detailed aggregate data. Lanreal deletes or anonymizes responses that no longer meet that criterion. Because a response is not linked to your account or purchase, if you object or request deletion you may need to provide the selected source, the free-text description as closely as you can recall, and an approximate submission date so Lanreal can attempt to locate it.

• Support emails. If you contact Lanreal at support@whisperstream.io, Lanreal retains the content of your email for the duration of the support interaction and deletes or anonymizes it once the matter is resolved.

Lanreal will not export the consented funnel or enable a destination without first updating this notice and its compliance review. A change to PostHog retention, deletion, backups, replicas, support access, or restore behavior reopens the activation assessment under GDPR Article 5(1)(e).

Depending on where you live, you may have one or more of the rights listed in this section. Lanreal extends all of these rights to every Website visitor, regardless of jurisdiction, so that you do not have to prove residency to exercise a right.

Rights under the European Union General Data Protection Regulation (GDPR Articles 15 to 22):

• Right of access (Article 15): you may ask Lanreal to confirm whether we process personal information about you and, if so, to provide a copy of that information.
• Right to rectification (Article 16): you may ask Lanreal to correct any inaccurate personal information we hold about you.
• Right to erasure (Article 17): you may ask Lanreal to delete personal information we hold about you, subject to the statutory exceptions in Article 17(3).
• Right to restriction of processing (Article 18): you may ask Lanreal to restrict the processing of your personal information in the circumstances set out in Article 18(1).
• Right to data portability (Article 20): you may ask Lanreal to provide your personal information in a structured, commonly used, machine-readable format where the processing is based on consent or contract and is carried out by automated means.
• Right to withdraw consent (Article 7(3)): you may refuse the optional purchase measurement by selecting Download without measurement. You can later use Privacy choices to decline. Decline clears the attribution cookie and stops future funnel events because checkout and purchase routes recheck your current choice. If the cookie still contains the random measurement identifier, Lanreal also asks PostHog to delete its minimal person and linked events. PostHog processes deletion asynchronously. If the request cannot be submitted, measurement still stops and the Website provides a privacy contact so you can retry. Withdrawal does not affect the lawfulness of earlier processing.
• Right to object (Article 21): you may object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on Article 6(1)(f) (our legitimate interests). This right applies to PostHog Cloud analytics data retained under Section 8, the Cloudflare processing described in Section 3.2, the Cloudflare-controlled platform-level logs described in Section 3.4, and the content-free application logs described in Section 3.4, the optional acquisition-survey responses described in Section 3.5, and the narrow legitimate-interest processing used to remember a decline in Section 3.5, but not the consent-based attribution itself. Use the withdrawal controls described above for attribution. You can erase the locally held decline preference through your browser's site-data controls or contact Lanreal for rights assistance. If you exercise this right, Lanreal will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights in relation to automated decision-making (Article 22): not applicable. Lanreal does not engage in automated decision-making that produces legal or similarly significant effects within the meaning of Article 22.

Rights under the California Consumer Privacy Act (CCPA):

• Right to know what categories of personal information we have collected about you, the sources from which we collected it, the business or commercial purposes for collecting it, and the categories of third parties with whom we shared it.
• Right to delete personal information we collected from you, subject to the statutory exceptions in Cal. Civ. Code Section 1798.105(d).
• Right to correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information: Lanreal does not request sensitive personal information in the current purchase-measurement flow. Lanreal does not use or disclose sensitive personal information inadvertently entered in the optional survey for a purpose that triggers the CCPA right to limit.
• Right to opt out of the sale or sharing of personal information: not applicable. Lanreal does not sell or share personal information for cross-context behavioural advertising, as described in Section 11 below.
• Right to non-discrimination for exercising any CCPA right. Lanreal will not deny you access to the Website, charge you a different price, or provide a different level of service because you exercised a right under the CCPA.

Rights under Canadian federal privacy law:

• Right of access to personal information Lanreal holds about you.
• Right to correction of inaccurate personal information.
• Right to challenge compliance with this Website Privacy Policy and with Canadian federal privacy law generally. Challenges are directed to the Privacy Officer in the first instance (see Section 14).

How to exercise your rights. To exercise any of the rights above, email Lanreal's Privacy Officer at support@whisperstream.io with a description of your request and enough information for us to locate your personal information. For current purchase measurement, use Privacy choices to decline, clear the attribution cookie, and submit deletion when the random identifier is still available. After the cookie expires, Lanreal generally cannot connect a PostHog funnel record to you because the flow does not store your identity, checkout, order, license, or contact details. GDPR Article 11 does not require Lanreal to collect more identifying information solely to identify you. If you provide information that lets Lanreal locate a record without exposing another person's information, Lanreal will assess and honor applicable rights rather than treating Article 11 as an automatic refusal. For an optional free-text acquisition response, locating the record may require the selected source, the free-text description as closely as you can recall, and an approximate submission date. Because the Website does not have user accounts, acquisition survey responses are not linked to a purchase. Separate cookieless PostHog Cloud analytics data is aggregated under a daily-rotating, irreversible server-side identifier. Lanreal may not be able to link Website data to you. In that case, Lanreal will explain that it cannot identify the relevant record.

Verification. Because the Website does not maintain user accounts, identity verification for rights requests related to the Website will depend on the nature of the request. For purchase-related requests, Lanreal may verify your identity by confirming the email address associated with your Polar checkout.

Response timeline. Lanreal will acknowledge your request within a reasonable period and will respond substantively within 30 days of receipt. Under GDPR Article 12(3), Lanreal may extend this period by up to an additional 60 days where necessary, taking into account the complexity and the number of requests; if we need to do so, we will inform you of the extension and the reasons for it within the original 30-day window.

Authorized agents. California residents may use an authorized agent to submit a rights request on their behalf. If you do so, we may require the agent to provide written authorization from you and to verify their own identity.

The Website is not directed to children. Lanreal does not knowingly collect personal information from children under the age of 13 in the United States (consistent with the Children's Online Privacy Protection Act, or COPPA), or from children under the age of 16 in the European Economic Area (consistent with GDPR Article 8). If you are a parent or guardian and you believe your child has provided personal information to Lanreal through the Website, please contact us at support@whisperstream.io and we will take reasonable steps to delete that information.

This section supplements the rest of this Website Privacy Policy for California residents whose personal information is collected by Lanreal through the Website, and is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA").

Categories of personal information collected. In the preceding twelve months, Lanreal has collected the following categories of personal information from or about California residents through the Website, as those categories are defined by Cal. Civ. Code Section 1798.140(v):

• A. Identifiers (such as real name, unique personal identifier, online identifier, IP address, email address, or similar identifiers): IP address is processed transiently by Cloudflare for DNS, CDN, and hosting routing and by PostHog as a hash input from which the daily-rotating server-side identifier and approximate geolocation shown in analytics are derived. PostHog does not retain raw IP addresses against events captured in cookieless mode and does not make them accessible to Lanreal. Cloudflare's CDN and DNS access logs are not accessible to Lanreal either. Cloudflare Workers Observability stores only the content-free application events described in Section 3.4; those events exclude IP addresses, request URLs, user agents, and request bodies. The current purchase-measurement flow does not request direct identifiers or free text. The separate optional survey could contain an identifier if you enter one despite the instruction not to. Purchase-related identifiers (name and email) are collected by Polar and governed by Polar's privacy policy. During confirmation, the Website temporarily receives the customer email and license key. It receives a Polar checkout identifier when it creates the checkout, before completion, as described in Section 3.3. The checkout identifier is confined to the short-lived encrypted cookie and server-side request; the license key is confined to the confirmation response and browser memory. If the purchaser previously allowed purchase measurement, the encrypted 90-day attribution cookie contains a random wm1_ identifier and technical event UUID. A domain-separated HMAC of the checkout ID supplies only the technical purchase-event UUID; the checkout ID is not sent to PostHog. The random identifier and linked events remain pseudonymous identifiers for the limited measurement purpose while they exist.
• B. Personal information categories listed in Cal. Civ. Code Section 1798.80(e): The optional free-text acquisition field could contain a name or another category you choose to enter despite the instruction not to include personal information. Name, address, and payment information required for purchase are collected by Polar as Merchant of Record.
• C. Characteristics of protected classifications: Not requested. The optional free-text acquisition field could contain this information if you choose to enter it despite the instruction not to include personal information.
• D. Commercial information: During confirmation, the Website temporarily retrieves the purchased product and total from Polar to display them to you. Lanreal does not store a purchase record in a Website database; Polar maintains the transaction record.
• E. Biometric information: None.
• F. Internet or other electronic network activity information: aggregated page view data, full current and initial page and referrer URLs (including paths, query strings, fragments, and arbitrary tracking parameters), referring domain, UTM campaign-attribution properties, browser type and language, operating-system type, device type, viewport and screen dimensions, and timezone, as collected by PostHog Cloud (Section 3.1). Before 2026-08-03, a page-view URL also could contain the Polar checkout identifier on the success route, as specifically described in Section 3.1. PostHog data is aggregated under a daily-rotating cookieless identifier and was not intended to identify individual visitors. In addition, Lanreal stores content-free route name, status code, latency, outcome, and error-class events for its server-side route handlers through Cloudflare Workers Observability (Section 3.4). These events exclude request URLs, bodies, IP addresses, and user-agent strings. Whether you allow or decline, this category includes the minimal 180-day choice cookie and decision time. If you allow purchase measurement, it also includes the 90-day encrypted attribution cookie, random measurement identifier, four possible PostHog funnel events, technical event UUIDs, coarse landing channel, optional fixed source, optional allowlisted campaign, and decayed week or month cohort described in Section 3.5.
• G. Geolocation data: approximate geolocation (country, region, city) derived from IP address by PostHog Cloud and provided only in aggregated form.
• H. Audio, electronic, visual, thermal, olfactory, or similar information: The Website does not collect audio, visual, thermal, olfactory, or similar information. An optional survey description is stored under the purpose and annual review criteria in Section 8.
• I. Professional or employment-related information: Not requested. The optional free-text acquisition field could contain this information if you choose to enter it despite the instruction not to include personal information.
• J. Education information: Not requested. The optional free-text acquisition field could contain this information if you choose to enter it.
• K. Inferences: The Website classifies landing information into a coarse acquisition channel and optional fixed source for purchase measurement. It does not use that classification to build a person-level profile, predict characteristics, or make a decision about you.
• L. Sensitive personal information: Not requested. The optional free-text acquisition field could contain sensitive personal information if you choose to enter it despite the instruction not to include personal or sensitive information.

Sources of personal information. PostHog Cloud analytics data is derived from browser interactions with the Website and from page and referrer URLs supplied by visitors, link creators, browsers, and referring sites. Cloudflare data is derived from your DNS and HTTP requests as they pass through Cloudflare's network and the Cloudflare Pages hosting platform. Current purchase-measurement data is derived from the landing URL and referrer your browser supplies, the consent choice you make when requesting the installer, and the later paid-checkout result received from Polar. Optional acquisition-survey data comes directly from a respondent after purchase. The current checkout identifier is received from Polar when Lanreal's server creates the checkout session. Customer email, product, total, and license key are received from Polar after a completed purchase. The historical checkout identifier in the success URL likewise originated from Polar.

Business or commercial purposes for collecting personal information. Analytics data is collected for the business purpose of understanding aggregate website traffic patterns and improving the Website. Cloudflare data is collected for the business purpose of delivering the Website securely and mitigating abuse. Acquisition data is collected to understand which sources introduce customers to Whisperstream and to evaluate Lanreal's marketing. Polar checkout-session data is collected to open and maintain the short-lived confirmation flow. Purchase-confirmation data is collected to confirm the completed order, display the product, price, and customer email, and retrieve the license key. Before 2026-08-03, the checkout identifier in the success-page URL also could be processed by PostHog as part of historical page-view analytics.

Categories of third parties with whom we share personal information. PostHog Inc. (cookieless analytics and the consented funnel), Cloudflare Inc. (DNS, CDN, Pages hosting, and content-free application logs), Polar Software Inc. and its payment processor Stripe, Inc. (checkout and payment processing), and Supabase, Inc. (optional acquisition-survey storage), as described in Section 6. Cloudflare processes the first-party attribution and checkout cookies through the Website routes. PostHog receives the random measurement identifier and four possible minimal funnel events but not the cookieless browser identifier or a purchase/customer identifier. Polar receives no attribution field. Any optional survey free-text description remains only in the separate Supabase table and is not shared with PostHog.

Categories of personal information disclosed for a business purpose. In the preceding twelve months, Lanreal has disclosed or made available the following categories for the stated business purposes: Identifiers and internet or electronic network activity information to Cloudflare for DNS, CDN, hosting, security, and content-free application logging; Identifiers, internet or electronic network activity information, and approximate geolocation to PostHog for Website analytics (before 2026-08-03 this could include a checkout identifier in the success-page URL); Identifiers, personal information under Section 1798.80(e), and commercial information to Polar and Stripe for checkout, payment, purchase confirmation, and licensing; and, for current purchase measurement, pseudonymous cookie and checkout-state data to Cloudflare and the random measurement identifier, technical event UUIDs, allowed cohort fields, and four possible funnel events to PostHog, together with any free-text description a visitor voluntarily submits through the optional survey, which remains in the separate Supabase table under the purpose and annual review criteria in Section 8. Lanreal has not disclosed any other category collected through the Website for a business purpose in the preceding twelve months.

Sale or sharing of personal information ("Do Not Sell or Share My Personal Information"). Lanreal does not sell your personal information to third parties in exchange for money or other valuable consideration, and Lanreal does not share your personal information for cross-context behavioural advertising. Lanreal has not sold or shared personal information about California residents in the preceding twelve months, and does not intend to do so. Because there is no sale or sharing, there is no "Do Not Sell or Share My Personal Information" link; this Website Privacy Policy, which discloses that the right is not applicable to Lanreal's practices, serves as the required disclosure under Cal. Civ. Code Section 1798.135.

Use of sensitive personal information. Lanreal does not request sensitive personal information through the current Website flow. Current purchase measurement has no free-text field. If you enter sensitive information in the optional free-text survey, Lanreal does not use or disclose it for a purpose that triggers the CCPA right to limit, and you may request deletion of that free text as described in Section 9.

How to submit CCPA requests. California residents may submit a right-to-know, right-to-delete, right-to-correct, or non-discrimination request by emailing support@whisperstream.io.

Lanreal implements security safeguards proportional to the sensitivity of the personal information the Website processes. The Website does not operate a user account database or store payment information. Current attribution uses a random pseudonymous identifier in encrypted browser state and PostHog, not a Lanreal-operated attribution database. The separate optional survey table is not linked to a purchase or visitor identifier. The source design applies GDPR Articles 25 and 32 as follows:

• The Website is served over HTTPS. All connections between your browser and the Website are encrypted in transit.
• Cloudflare provides DDoS protection and bot mitigation at the DNS and CDN layer.
• The Polar checkout iframe is served from Polar's own domain over HTTPS. Payment card data is handled by Stripe within the checkout iframe and never passes through the Website's frontend or backend.
• The Website's server-side API routes (checkout session creation and license key retrieval) communicate with Polar's API over HTTPS using a server-side access token that is stored as an environment variable in Cloudflare Pages and is not exposed to the browser.
• PostHog Cloud analytics data is transmitted to PostHog's EU ingestion endpoint over HTTPS.
• The purchase-measurement and checkout-state cookies use authenticated encryption, HttpOnly, Secure, and SameSite=Lax. The separate choice cookie contains no acquisition source.
• Dedicated server-only secrets protect attribution encryption, checkout-state encryption, PostHog event UUID derivation, and project-restricted query/deletion access. The capture project token is public and is not an authentication boundary. The administrative key is not exposed to browser code and the independent secrets must not be reused.
• The API validates exact enums, channel/source compatibility, and the optional campaign allowlist. Invalid, expired, or tampered state is treated as absent.
• The separate acquisition-survey API validates the fixed source, trims the optional description, and limits it to 200 characters. Supabase row-level security permits anonymous inserts but prevents anonymous reads, updates, and deletions. Survey answers are excluded from application logs and PostHog.
• /success rechecks the current consent preference and DNT/GPC signal and captures a purchase event only after Polar confirms status=succeeded, the configured exact product, and positive total.
• The checkout ID is replaced with a domain-separated technical purchase-event UUID before PostHog capture. The raw checkout ID is not sent to PostHog.
• Each event sets GeoIP suppression, omits request headers and IP address, and uses an exact event/property allowlist. The minimal person has no person properties and is not linked to the cookieless browser identifier.
• A daily scheduled process uses the earliest funnel event, begins deletion around day 330, submits person-and-events deletion, and checks asynchronous deletion status. Failed or incomplete cleanup fails the scheduled invocation.
• Attribution, PostHog, deletion, or configuration failure does not block the installer download, checkout, confirmation, licensing, or license delivery.

These controls are present in the production source. Lanreal continues to verify the live PostHog exclusions, deletion, retention, access and transfer facts and to maintain the release and controller records for this processing.

No security program can guarantee absolute protection against all threats. If you become aware of a security issue affecting the Website, please contact Lanreal at support@whisperstream.io.

Lanreal may revise this Website Privacy Policy from time to time. When we revise it, we will change the version number at the top of this document. Minor clarifications that do not materially change how we collect, use, or share personal information will increment the minor version (for example, from 1.0 to 1.1). Material changes will increment the major version (for example, from 1.0 to 2.0). Version 6.1 supersedes Version 6.0. It records that the optional consented PostHog download-to-purchase measurement feature is enabled, rather than still pending activation. It also explains the server-side buy_clicked event used by both checkout routes. With a current allow and valid attribution cookie, the event uses the same random identifier and coarse fields as the consented funnel. Without them, it uses a shared non-visitor technical value only for a personless total count. Both paths disable GeoIP, forward no visitor request data, and run in the background without delaying checkout. The providers, purchase-measurement cookies, and separate optional acquisition survey are otherwise unchanged.

How you learn about changes. The current version of this Website Privacy Policy is always available at the URL where it is published on the Website. When a material change is made, Lanreal will update the effective date at the top of the document and publish the revised version at the same URL. Lanreal does not currently operate a separate notification mechanism for Website Privacy Policy changes (such as email notification or a changelog page), because the Website does not maintain user accounts or an email list. This may change in a future version.

Third-party service changes. If Lanreal adds, removes, or replaces a third-party service listed in Section 6, that change will be reflected in a new version of this Website Privacy Policy.

If you believe that Lanreal has processed your personal information in a way that is inconsistent with this Website Privacy Policy or with applicable privacy law, please contact Lanreal first at support@whisperstream.io so that we have the opportunity to address your concern. Lanreal's Privacy Officer will review your complaint and respond within the timeline described in Section 9.

If you are not satisfied with Lanreal's response, you may also have the right to lodge a complaint with a supervisory authority:

• European Economic Area, the United Kingdom, and Switzerland: you have the right under GDPR Article 77 to lodge a complaint with the data protection supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.
• California: you may contact the California Privacy Protection Agency or the California Attorney General's Office for information about your rights under the CCPA.
• Canada (federal): you may file a complaint with the Office of the Privacy Commissioner of Canada (the "OPC") at https://www.priv.gc.ca/en/report-a-concern/, toll-free 1-800-282-1376. The OPC has the authority to investigate your complaint under section 11 of the Personal Information Protection and Electronic Documents Act, issue a Report of Findings, and make formal recommendations. If the matter remains unresolved after the OPC's investigation, section 14 of the Act grants you the right to apply to the Federal Court of Canada for a hearing.
• Canada (provincial): if you are a resident of Quebec, British Columbia, or Alberta, your provincial regulator may have parallel jurisdiction. You may contact Quebec's Commission d'accès à l'information at https://www.cai.gouv.qc.ca, the Office of the Information and Privacy Commissioner for British Columbia at https://www.oipc.bc.ca, or the Office of the Information and Privacy Commissioner of Alberta at https://www.oipc.ab.ca.

Nothing in this section limits any other right or remedy available to you under applicable law.

Questions, requests, and complaints about this Website Privacy Policy and about Lanreal's handling of personal information collected through the Website should be directed to Lanreal's Privacy Officer:

Privacy Officer Lanreal Technologies Inc. 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada

Email: support@whisperstream.io

Lanreal Technologies Inc. is the data controller for the personal information described in this Website Privacy Policy. The Privacy Officer is the designated contact for Canadian federal privacy law, for GDPR Articles 13 and 14, and for CCPA consumer requests.

Copyright (c) Lanreal Technologies Inc. All rights reserved.