Work Whale (“we”, “us”, “our”) is committed to protecting your personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its implementing rules and regulations. This Privacy Policy explains how we collect, use, store, and protect your data when you use the Work Whale platform at workwhale.ph (“the Platform”).
1. Information We Collect
We collect the following types of information:
- Account information: name, email address, password (hashed and never stored in plain text), and account role (employer, worker, or admin)
- Profile information: bio, profile photo, skills with years of experience, work history, education, certifications, languages, portfolio links, projects, location, availability, and hourly rate
- Uploaded files: resumes, portfolio documents, and video introductions (stored securely on Supabase Storage)
- Employment information: job applications, AI-generated and manually written cover letters, screening question answers, and application status history
- Invoices: invoice details created by workers and sent to employers, including amounts and payment status
- Reviews: employer-submitted reviews of workers following a completed engagement
- Communications: messages sent between employers and workers on the Platform
- Google account data: when you connect Google Calendar, we store an OAuth refresh token solely to create calendar events and Google Meet links on your behalf. We do not access any other Google data.
- Usage data: IP address, browser type, pages visited, session activity, and profile view records
- Payment information: subscription and transaction records (card details are processed entirely by Stripe and never stored on our servers)
- AI interaction data: inputs you provide to AI features (e.g. job descriptions, cover letter prompts, resume content) are sent to OpenAI for processing and are not used to train OpenAI models under our API agreement
2. How We Use Your Information
We use your information to:
- Provide, operate, and continuously improve the Platform
- Match workers with relevant job opportunities based on skills and preferences
- Display public profiles to employers and other users where applicable
- Enable direct communication between employers and workers
- Power AI features including: skill-match scoring on job listings, AI-assisted cover letter generation, AI job description writing, AI resume parsing, and AI candidate matching and scoring
- Create Google Calendar events with Google Meet links when employers schedule interviews
- Send transactional emails such as application status updates, meeting invitations, invoice notifications, and account alerts
- Process subscription payments and manage billing
- Monitor platform performance and detect errors via analytics and error tracking tools
- Comply with legal obligations and enforce our Terms of Service
We will not sell, rent, or share your personally identifiable information with third parties for marketing purposes.
3. Third-Party Services
We use trusted third-party providers to operate the Platform:
- Supabase — database, authentication, file storage, and real-time messaging
- Vercel — platform hosting, CDN, and performance analytics
- SendGrid — transactional email delivery
- Stripe — payment processing (card details never touch our servers)
- OpenAI — AI-powered features including cover letter generation, skill matching, job description writing, resume parsing, and candidate scoring
- Google Calendar API — creating calendar events and Google Meet video conference links for interview scheduling
- Sentry — error tracking and application monitoring to maintain platform stability
These providers are permitted to use your information only to perform services on our behalf and are bound by their own privacy policies and data processing agreements.
4. Google API Services
Work Whale’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only request access to the
calendar.events scope for the purpose of creating interview meetings with Google Meet links. - We do not use Google user data for advertising, market research, or any purpose unrelated to the meeting scheduling feature.
- We do not share Google user data with third parties except as strictly necessary to provide the meeting scheduling feature.
- We store only the OAuth tokens required to maintain your Google Calendar connection. You can revoke access at any time from your Google Account permissions.
5. External Job Listings
Work Whale displays job listings sourced from third-party job boards (such as Remotive, Jobicy, RemoteOK, Himalayas, We Work Remotely, and The Muse) to supplement internally posted jobs. These listings are fetched via public APIs and RSS feeds and are stored temporarily on our servers. We do not collect personal information from these external sources. Clicking on an external listing directs you to the respective job board, where that site’s own privacy policy applies.
6. Cookies & Tracking
We use cookies and similar tracking technologies to maintain your session and improve your experience. Vercel Analytics collects anonymised performance data (page views, load times) to help us improve the Platform. Sentry collects error and crash data to help us identify and fix issues. You may disable cookies in your browser settings, though some features of the Platform require cookies to function correctly.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide services. External job listings are automatically removed from our servers within 24 hours of being taken down by the source job board. You may request deletion of your account and associated data at any time by contacting us at info@workwhale.ph. We will process deletion requests within 30 days, subject to any legal retention obligations.
8. Your Rights
Under the Data Privacy Act of 2012, you have the right to:
- Be informed about how your data is collected and used
- Access the personal information we hold about you
- Correct inaccurate or incomplete data
- Object to the processing of your data
- Request erasure of your data
- Lodge a complaint with the National Privacy Commission (NPC)
To exercise any of these rights, contact us at info@workwhale.ph.
9. Security
We implement industry-standard security measures including encryption in transit (TLS), hashed passwords, role-based access controls, and secure file storage. Payment data is handled entirely by Stripe and never passes through our servers. However, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and to notify us immediately of any unauthorised access to your account at info@workwhale.ph.
10. Children’s Privacy
The Platform is intended for users aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the Platform. Continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.
12. Contact
For questions or concerns about this Privacy Policy or your personal data, contact our Data Protection Officer at info@workwhale.ph.
