Privacy Policy
Last updated October 11, 2026 | White Coda Inc.
This Privacy Policy explains how White Coda Inc., a company based in Austin, Texas ("White Coda", "we", "us"), collects, uses, shares and protects personal information across the White Coda platform: whitecoda.com, portal.whitecoda.com, app.whitecoda.com, the brand pages, checkouts, forms, booking pages and member areas hosted on it, and our APIs and MCP servers (the "Service"). It should be read with our Terms of Service.
1. Our role
For account holders, their team members and visitors to whitecoda.com, White Coda decides how personal information is used and is the controller.
When you interact with a business that runs on the Service (a "Customer"), for example by buying on its checkout, filling in its form, booking a call or joining its member area, that Customer is the controller of your information and White Coda processes it on the Customer's behalf as its service provider. The Customer's privacy notice applies, and requests about that information are best sent to the Customer; we will help it respond. Customers can review our Data Processing Addendum.
2. Information we collect
- Account and profile: name, email address, phone number, company, role, password (stored hashed) and sign-in history.
- Billing: plan, invoices and limited payment details such as card brand, last four digits and billing address. Full card numbers go directly to Stripe and are never stored by us.
- Content: pages, funnels, emails, files, images, video, course material, templates and anything else you create or upload.
- Connected accounts: when you connect Meta, Instagram, Google, TikTok, a calendar, an email or SMS provider or another integration, the data you authorize, such as profile and page details, ad accounts and performance, posts, comments, messages, calendar events and contacts. Access tokens are stored encrypted.
- Information Customers collect through the Service: names, email addresses, phone numbers, form answers, purchases, subscriptions, bookings, messages, course progress and similar data about a Customer's own customers and leads.
- AI inputs and outputs: prompts, instructions, files and data you send to AI features and agents, and what they produce.
- Imported and lead data: contact and business information you import, or that our lead-finding and scraping tools gather from public sources at your direction.
- Communications: support requests, emails and messages you exchange with us.
- Usage and device data: IP address, approximate location derived from it (city, region and time zone), browser and device type, pages viewed, actions taken, referring URL, campaign parameters, timestamps and logs.
- Form and booking submissions: when you submit a form, opt in or book a call on a page hosted on the Service, we store your IP address and the approximate location derived from it with your submission. It is used to show times in your time zone, to block spam and fraud, and to tell the business you contacted roughly where its enquiries come from. It is never your precise location.
- Instagram profile information: when you enter an Instagram username on a form, booking page or opt-in, we look up that account's public profile (name, username, bio, profile photo, follower and following counts and recent public posts) through Instagram's own interfaces or a data provider, and keep the details and a copy of the profile photo with your record. Only enter a username that is yours. If someone entered yours, ask us to delete it.
- Viewing and engagement: which videos, lessons and pages you watch on pages and member areas hosted on the Service, for how long and how far, and what you click.
- Messages through social channels: direct messages, comments and replies exchanged with a business through Instagram, Facebook or another connected channel, including reply drafts prepared for that business by AI tools.
- Call recordings and transcripts, when a call or meeting is recorded with notice to the people on it.
- Information from public sources: some businesses use the Service to research prospects from public business listings and public social media profiles. That business decides what it collects and is responsible for contacting people lawfully. Anyone can ask us at privacy@whitecoda.com to delete information collected this way.
- Cookies and similar technologies, as described in section 6.
3. How we use information
- to provide, operate and secure the Service, including hosting pages, processing checkouts, sending the emails and texts you or a Customer set up, syncing integrations and running AI features;
- to process payments and manage subscriptions;
- to send service messages such as receipts, sign-in links, security alerts, booking confirmations and changes to these documents;
- to sign you in to a free member area on the device you used when you opt in to one. If your email address already belongs to an account with a paid purchase, we send a single-use sign-in link to that address instead;
- to measure advertising, including telling advertising platforms that a visit led to a sign-up or purchase;
- to provide support and respond to requests;
- to detect, prevent and investigate fraud, abuse and security incidents;
- to understand how the Service is used and improve it;
- to send marketing about White Coda where the law allows, with an opt-out in every message;
- to comply with law and enforce our Terms.
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you, our legitimate interests in running and protecting the Service, your consent (for example for non-essential cookies and marketing where required), and compliance with legal obligations.
5. AI features
When you use an AI feature, the input needed for that request is sent to the model provider that powers it and the output is returned to your account. Providers process it under their API terms. Do not submit sensitive personal information to AI features unless you have a lawful basis to do so.
Businesses on the Service can use AI to draft replies to the direct messages, comments and emails you send them, to summarize calls and to suggest who to follow up with. A person at the business reviews a drafted message before it is sent. We do not use AI to make decisions that have legal or similarly significant effects on you.
7. Retention
We keep personal information while your account is active and as long as needed to provide the Service. After an account is deleted we keep data for up to 90 days in backups for recovery, then delete it. We keep billing and tax records for as long as the law requires. Aggregated or de-identified data may be kept longer. Information we process for a Customer, including form submissions, the IP address and approximate location stored with them, and stored Instagram profile details and photos, is kept while that Customer keeps the related contact and deleted on its instructions or on a verified request.
8. Your rights and how to use them
Depending on where you live, you may have the right to know what personal information we hold about you, access it, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, and opt out of marketing, targeted advertising and profiling.
Submit a request through our data request form or by emailing privacy@whitecoda.com. We will verify your identity before acting, and you may use an authorized agent. We respond within the time the law sets, generally 30 to 45 days. We will not discriminate against you for using these rights. If we decline your request, you can appeal by replying to our decision, and if the appeal is denied you may contact your state attorney general or data protection authority.
9. California and other U.S. states
In the last 12 months we collected these categories of personal information: identifiers, customer records, commercial information, internet and network activity, approximate geolocation, audio, visual and similar content (including profile photos and call recordings), professional information, and account login credentials. We collect them from you, from your devices, from Customers, from services you connect, and from public sources such as public Instagram profiles. We use them for the purposes in section 3 and disclose them only to the recipients in section 4. Advertising tags on pages Customers publish may count as "sharing" for cross-context behavioral advertising under some state laws; to opt out, use the cookie banner where one is shown, your browser and ad settings, or contact privacy@whitecoda.com.
We do not sell personal information, and we do not knowingly sell or share the information of consumers under 16. We use account login credentials only to provide and secure the Service. Residents of California, Texas, Virginia, Colorado, Connecticut and other states with privacy laws can use the rights in section 8.
10. International transfers
We are based in the United States and store data there. If you use the Service from elsewhere, your information is transferred to and processed in the United States. Where the law requires a transfer mechanism, we use one it recognizes, such as Standard Contractual Clauses. EEA and UK residents may also complain to their local supervisory authority.
11. Security
We protect information with encryption in transit, encrypted storage of integration credentials, database access policies that keep each brand's data separate, role-based access for staff, and audit logs. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
12. Email and text messages
You can unsubscribe from marketing email with the link in any message. We only send text messages to a number whose owner agreed to receive them, and agreeing is never a condition of buying anything. Message frequency varies. Reply STOP to opt out and HELP for help; message and data rates may apply. Mobile numbers and SMS consent are never shared with third parties for their own marketing.
13. Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact privacy@whitecoda.com and we will delete it.
14. Changes
We may update this Policy. For material changes we will give at least 30 days' notice by email or in the product before they take effect. The date at the top shows when it was last updated.
15. Contact
White Coda Inc., Austin, Texas. Privacy questions and requests: privacy@whitecoda.com or the data request form.