Privacy Policy
Last updated 24 August 2026
1. Who we are
WhoWhy OU ("WhoWhy", "we", "us", "our") is a company registered in Estonia. WhoWhy provides an AI recruiting assistant that operates inside Slack and helps hiring teams source, research and evaluate candidates. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have.
Where WhoWhy determines the purposes and means of processing your account and website data, we act as a data controller. Where we process candidate and hiring data on behalf of a customer, we act as a data processor and the customer is the controller. For any privacy question, or to exercise your rights, contact us at denis@whowhy.io.
2. Data we collect
Account and workspace data. When you install WhoWhy or sign in with Slack, we receive your name, email address, avatar, Slack user and workspace identifiers, and basic workspace information. We use OpenID Connect ("Sign in with Slack") to authenticate you.
Content you provide. Job descriptions, hiring criteria, search instructions, messages and decisions you enter while using the product.
Candidate data we process for you. To perform sourcing and evaluation, WhoWhy processes information about candidates, including names, professional profiles, current and past employers, job titles, work history, skills, public professional information, and professional contact details such as email addresses obtained from third-party data providers. WhoWhy generates this data at your direction, as part of the service we provide to you.
Usage and technical data. Log data, timestamps, feature usage and diagnostic information used to operate and secure the service.
We do not intentionally collect special categories of data such as health, race or religion, and we ask that you do not submit them.
3. How we use data
We use personal data to provide and operate the service; authenticate you and manage your account; run sourcing searches, enrichment and candidate evaluation on your behalf; process your instructions through large language models to generate results; communicate with you about your account, support and billing; secure the service and prevent abuse; and comply with legal obligations.
WhoWhy is an AI product. Your instructions and the content you provide are processed by large language models to generate results. We do not use your data, or candidate data, to train third-party foundation models.
4. Legal bases (GDPR)
Where the GDPR applies, we rely on performance of a contract to provide the service you request; our legitimate interests to operate, secure and improve the service and to source candidates on behalf of our customers, balanced against your rights; consent, where required; and compliance with legal obligations.
5. Large language models and automated processing
WhoWhy uses large language models to research and rank candidates and to draft outreach. These outputs are suggestions intended to support human hiring decisions, not to replace them. WhoWhy does not make final hiring decisions, and customers are responsible for reviewing outputs before acting on them. We do not carry out solely automated decision-making that produces legal or similarly significant effects on candidates within the meaning of Article 22 GDPR.
6. Sharing and sub-processors
We share personal data with service providers who process it on our behalf, under contract and only as needed to run the service:
Anthropic — large language model processing of your instructions and content.
Supabase — application database and hosting.
Amazon Web Services (AWS) — underlying cloud infrastructure.
Slack — the platform WhoWhy runs on and integrates with.
Data-enrichment providers, including Apollo, FullEnrich and Exa — to find and enrich candidate profiles and professional contact details.
We may also disclose data where required by law, to protect our rights, or in connection with a merger or acquisition. We do not sell personal data.
7. International transfers
WhoWhy and its providers may process data in the European Union and the United States. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
8. Data storage and security
Customer Data is stored in a managed PostgreSQL database (Supabase, running on AWS) and encrypted in transit (TLS) and at rest. We restrict access to authorized personnel, enforce database-level access controls, and follow the security practices required by the Slack Marketplace.
9. Data retention
We retain personal data for as long as your account is active. On account termination, uninstall, or a verified deletion request, we delete Customer Data within 30 days, except where longer retention is required by law. Routine encrypted backups are purged on a rolling basis.
10. Your rights
Depending on your location, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. You may also withdraw consent where processing is based on consent. To exercise any of these rights, contact denis@whowhy.io. You have the right to lodge a complaint with a supervisory authority; in Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon).
11. Candidates
If you are a candidate and WhoWhy processes your data on behalf of a hiring customer, that customer is the controller of your data. You can contact us at denis@whowhy.io and we will route your request to the relevant customer, or handle it where we are able. You may ask to access or delete the professional data we hold about you.
12. Cookies
Our website uses only essential cookies needed to serve and secure the site. The WhoWhy product runs inside Slack and does not rely on advertising cookies.
13. Children
WhoWhy is a business product and is not directed to children. We do not knowingly collect data from anyone under 16.
14. Changes
We may update this Privacy Policy from time to time. We will post the updated version here and change the "last updated" date above. Material changes will be communicated where appropriate.
15. Contact
WhoWhy OU, Estonia. Email: denis@whowhy.io.