WhaleLO Privacy Policy

Version 1.3 — last updated 27 October 2026

This Privacy Policy explains how WhaleLO ("WhaleLO", "we", "us", "our") collects, uses, and protects personal data when you use the WhaleLO website at whalelo.net, our related applications, and our services (collectively, the "Platform"). It should be read together with the WhaleLO Platform Terms of Use and the WhaleLO Customer Terms & Conditions. Capitalised terms not defined here have the meaning given in those documents.

1. Who we are

1.1 WhaleLO operates a technology marketplace that connects travellers ("Customers") with independent luggage storage providers ("Stations"). WhaleLO acts solely as an intermediary technology platform and does not itself provide luggage storage services.

1.2 The Platform is operated by WhaleLO LLC (WhaleLO Limited Liability Company), 30 N Gould St Ste R, Sheridan, WY 82801, United States. WhaleLO LLC is the controller responsible for your data under this Policy.

1.3 For any privacy question or request, contact us through whalelo.net/support.

2. Data we collect

2.1 Information you provide when booking. Your email address, name, phone number, and booking details (drop-off and pick-up date and time, number of items, and the selected Station). Under our Terms, a Customer account may be created automatically using the email address used for a booking so that you can track your bookings.

2.2 Payment information. Payments are processed through our payment providers. We receive confirmation of payment and limited transaction details; full card details are handled by the payment provider, not stored by WhaleLO.

2.3 Verification data. A booking verification code or PIN used to confirm drop-off, and records relating to a booking.

2.4 Support and claims data. Information you provide when you contact support or make a WhaleLO Protection claim, including proof of ownership or value where relevant.

2.5 Technical and usage data. Device, browser, and usage information collected through analytics tools, and approximate location (country) used to determine which regional notices apply. See our Cookie Policy for detail and for how consent is handled.

The analytics tools we currently use are Google Analytics and WhaleLO's own first-party measurement. Our own measurement records how visitors interact with our pages — for example pages viewed, time on page, scrolling and where clicks land — so that we can see where the booking process is difficult to use. It never records what you type into forms, it is stored on our own systems, we do not use it to identify individual visitors, and we do not sell this data. You can find how each tool is used, and how to opt out, in our Cookie Policy.

2.6 Station premises. Storage areas at Stations may be monitored by staff and covered by CCTV in accordance with WhaleLO operational standards; such footage is controlled by the relevant Station.

3. How we use your data

We use personal data to: (a) create and manage your account and process and confirm your bookings; (b) facilitate the storage service with the selected Station, acting as the Station's commercial agent for bookings and payments; (c) process payments; (d) provide customer support and administer WhaleLO Protection claims; (e) prevent and investigate fraudulent, abusive, or suspicious bookings; (f) operate, secure, and improve the Platform; and (g) comply with legal obligations.

4. When we share data

4.1 With the selected Station, to the extent necessary to fulfil your booking (for example your name, booking reference, and pick-up details).

4.2 With payment providers to process payments, and with other service providers who help us operate the Platform (such as hosting and analytics providers), under appropriate confidentiality obligations.

4.3 Where required by law, or to protect the rights, safety, and property of Customers, Stations, or WhaleLO.

4.4 We do not sell your personal data.

5. Cookies and analytics

We use cookies and similar technologies, including Google Analytics and WhaleLO's own first-party measurement. For visitors in the EU, UK, and EEA, analytics are disabled by default and run only after you accept via our cookie banner. Full detail is in our Cookie Policy.

6. International transfers

WhaleLO operates in the United States and Vietnam, and uses service providers that may process data in other countries. Where personal data is transferred internationally, we take steps to ensure an appropriate level of protection consistent with applicable law.

7. How long we keep data

We keep personal data for as long as needed to provide the Platform, maintain booking and account records, resolve disputes and claims, and meet legal obligations. Where luggage remains uncollected, related records may be kept in line with the disposal timeframe set out in the Customer Terms & Conditions.

8. Your rights

8.1 Depending on your location, you may have rights to access, correct, delete, or restrict the use of your personal data, to object to certain processing, and to data portability. Visitors in the EU, UK, and EEA have these rights under the GDPR and UK GDPR.

8.2 To exercise any right, contact us through whalelo.net/support. You may also withdraw cookie consent at any time as described in the Cookie Policy.

9. Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Platform is intended for users who are at least 18 years old, or the age of legal majority in their jurisdiction. We do not knowingly collect data from children.

11. Business documents from Stations

This Section applies to Stations (as described in Section 1.1) and to the people who act for them. It does not apply to Customers.

11.1 What we collect. Where a Station is asked to provide a business registration document or a similar official document, we collect the document itself and the details printed on it — which may include the registered name and address of the business, its registration number, the name of a representative, and any expiry date shown. Where a Station accepts one of our documents on the Platform, we record the full name and stated capacity of the person accepting, the wording they accepted, the date and time, and technical details of the acceptance.

11.2 Why we collect it. To confirm that the business we contract with and pay is the business it says it is, to meet our record-keeping obligations, and to keep an accurate record of who agreed to what and when.

11.3 Automated help in reading a document. When one of these documents is uploaded or reviewed, we use an artificial-intelligence service to check that the file is a legible document of the kind expected, and to read the key details printed on it so that our team does not have to retype them. The document is sent to that service for that purpose and for no other. Two things are deliberately fixed about how this works. First, the service does not keep the document and does not use it to train its models: every such request is sent with the provider's no-retention and no-training settings applied. Second, the result is a suggestion, not a decision: approving or rejecting a document is always done by a person at WhaleLO, and no account is approved, refused, suspended, or paid differently as the automated outcome of this check. The service is currently provided by Anthropic and reached through OpenRouter. If we change provider, we will update this page.

11.4 Where the documents are kept. Uploaded documents are stored by WhaleLO. They are not published on the Platform and are not listed or indexed anywhere. Within WhaleLO they can be opened only by staff whose role requires it, and only through links that expire shortly after they are issued. Acceptance records are generated as a PDF certificate kept in storage that is closed to the public, and a copy is emailed to the Station owner, to the person who accepted, and to our own records address.

11.5 How long we keep them. We keep these documents and records for as long as the Station works with WhaleLO, and afterwards for as long as we are required to keep business and tax records, or for as long as a document may be needed to establish or defend a legal claim.

11.6 Rights. The rights set out in Section 8 apply to personal details in these documents, including the right to ask for a copy, to ask us to correct something, and to object to a particular use. To exercise any of them, or to tell us that a document was sent to us in error so that we can delete it, contact us through whalelo.net/support. Section 6 explains that handling a request of this kind may involve transferring data between countries.

12. Changes to this Policy

We may update this Policy from time to time. The "last updated" date shows when it was last revised. Material changes will be reflected on this page.

13. Contact

For any question about this Policy or your personal data, contact WhaleLO through whalelo.net/support.